{ "Event": { "published": true, "date": "2023-02-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-02-09", "timestamp": 1675987381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "62eb2873-093a-48bf-a959-ca9a92f467c9", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4a2174-a830-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675916065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916065, "uuid": "fe59d5c8-0533-4641-b53b-6bbd88499da0", "comment": "Malware payload (Amadey)", "value": "a3c06eb5ecb4ead73e61c1ede40904e6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916065, "uuid": "b4047234-f6c1-4b52-8dc4-ae093abae4b8", "comment": "Malware payload (Amadey)", "value": "0009a3ca74a8aecddfd34261d7e14b076347e85edf2a0a6e5d9cd760d5eedbea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916065, "uuid": "1757b5cc-3451-401e-ba8d-fdfbe549c784", "comment": "Malware payload (Amadey)", "value": "96c4c7f16957d2434ab0e6db1401ed3044e66a1c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916065, "uuid": "234b0961-29eb-47a3-a9b8-e8327afb41c7", "comment": "Malware payload (Amadey)", "value": "a65cbf9772c852a09a1f40c5a10c0793be145a5ab302d5ce18d72a949fc621b3e08a6af138406b127463f5b0211e54a0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916065, "uuid": "723e7097-23c8-493c-b1fa-6840a8cdc4e3", "value": "T108C41247E7EC8132DCF5977049F502C30A37BDA04A39939B674B5C5A5CB25B0A2317AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916065, "uuid": "c02e66a6-3f24-4b77-93bf-45bc35dfe65e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916065, "uuid": "096eaade-7102-43bd-b86f-2c58c2e2c501", "value": "12288:eMrdy90+iTP73fuQk/MrDptLH6iIDGCRDuMR015dyQpEeE:DyfmP73fkMrDXH6eS41uQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675916065, "uuid": "93d1cad5-3fce-4cb3-abb2-1469cc713d14", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675916065, "uuid": "30cb865d-5b33-41e7-94f8-8c9d0b14507f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916065, "uuid": "99b00407-c111-4124-a71a-a4fcca3c9a7c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091f6f68-a816-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675904811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904811, "uuid": "eabccdb3-2afc-4976-9da1-9e5fcbe597f1", "comment": "Malware payload (Mirai)", "value": "aa4a5ed958d0bfa96e526b8fa1d07b0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904811, "uuid": "3bdc6c08-119d-4a04-a4e6-1969869125f1", "comment": "Malware payload (Mirai)", "value": "00b8d64d79deb2d4b6bdf6a971aaee1fa8d3a01cf5659e6677aee1ab472b37f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904811, "uuid": "df9fd9eb-bf7b-41eb-a186-83a4332dd341", "comment": "Malware payload (Mirai)", "value": "d4c0bbe762247819e2de814b5632357a96fb719f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904811, "uuid": "cae0ccb6-0c0c-4be7-99ce-b650b928736d", "comment": "Malware payload (Mirai)", "value": "3584a07f5071a7d2f7dab0529f75de34b9c445201062724eb91ce9b69d3883580767f8d9f241a6ff7e04f4f7c3ab0f08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904811, "uuid": "c9d7b202-ffd8-4beb-8dd5-9355561d7c61", "value": "T1CDC3E70E7E214FBDF268863107B75E21975923E72BD1A685E2ACD5102F7024E285FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904811, "uuid": "457bcfda-ad2e-48dc-af24-cbd2715009e9", "value": "1536:4ICxr8yOvXGzSuRpIeTsmXZ59cRhdzh9hN0xHpT/W+2TshjeQr1kdvY008YYPZ:KfOv7mXZvcRhBh9hN0ZpT/W+0shr1S0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675904811, "uuid": "aaa84c75-2682-4214-a2c8-c945c87482a9", "value": 119956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675904811, "uuid": "00443a6b-5c22-45e2-8a71-c16471163011", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904811, "uuid": "d8eb90f5-c8bd-48ef-9a8e-18fdbb73db00", "value": "aa4a5ed958d0bfa96e526b8fa1d07b0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa82a08-a8bf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675977747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675977747, "uuid": "82e7dbf1-17f9-4fca-894b-d4ac0ada224d", "comment": "Malware payload", "value": "ab579f97eb8b15e47d0989e7d039eb19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675977747, "uuid": "7801c05e-2e0c-4e94-ad69-0dbd8244ebae", "comment": "Malware payload", "value": "00fb3bed3fd8fd8ea2b0963d6216575ffd85ef471b20b3242f21bd8c4f43b840", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675977747, "uuid": "2f274121-ee6b-4927-b235-c7b66b52c6e7", "comment": "Malware payload", "value": "e26f4af24520b7c2acc2dbe75bc5acfbe9fc0439", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675977747, "uuid": "3cf01b23-43ba-4a82-8c93-291bd1eb51d0", "comment": "Malware payload", "value": "152b7465f228c46a16120fd865977b0d03cb99770c0592243b6a8cdd8f5d9044d7e75d5240baa034154188c4820845d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675977747, "uuid": "b71013ee-5f82-44bb-b2bc-72c4c8333379", "value": "T1FFB4020BB6EC8032D5B817701CF603C719367D919A38879A268FAD9A4DB35B0B735367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675977747, "uuid": "ecc34c5b-8d9b-4a43-a997-29d51d6eae50", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675977747, "uuid": "31f30ed4-837f-41aa-aebe-9acb6c24c66e", "value": "12288:JMrPy90jhF4kq+8LVjantUDbCBIl6bF+Viz6DnYpEvWbvs/EzlqermwLW:qyUh5zuVj+WHCihiUnYtYEtBLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675977747, "uuid": "79924d31-a384-4cb4-b80b-8255ea3be231", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675977747, "uuid": "57651b0e-c483-42bf-aead-f8a44741ac27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675977747, "uuid": "aaed2e60-b733-4b28-8430-d77ba6cca265", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ad7421-a848-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675926337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926337, "uuid": "cced1cad-a18c-4b91-91bb-f266910d18bd", "comment": "Malware payload (Smoke Loader)", "value": "e7dd09e0178e2ab9f921e02c0bccb96d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926337, "uuid": "59d1bc15-0197-4074-adb2-de77dfb58d6c", "comment": "Malware payload (Smoke Loader)", "value": "0183fa83cd87bdaa58103a2d1f058e7c2b150621ffea2f018f642de677ff51bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926337, "uuid": "c7905ff1-2b1c-4f23-a1a9-08d7e3874dea", "comment": "Malware payload (Smoke Loader)", "value": "e1cab984144fc6335d018526480f5980ce7a06ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926337, "uuid": "2ef99154-07ab-41ac-92f1-c928f36306fb", "comment": "Malware payload (Smoke Loader)", "value": "d7a5a4c22464400fd0cee425cb1ee3e881e90e6afe80e6267ab7a42b32d27f53e05c5e62271c2e776e99955515022042", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926337, "uuid": "81493ca8-e2a4-469d-b45d-23e3089f63ae", "value": "T1D514E032F6D0C03FC47A64345864D6F56BBEB4304676890BB7A81BAE5F312D0663638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926337, "uuid": "a208c247-41d6-4c39-a608-41c74b6b7d51", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926337, "uuid": "be0118d7-5c62-44ff-a4a1-90da83828a0b", "value": "3072:NWGPOjneijtehLIbbS8WPLd54Hy74ByTsvN9FoWALIN7hBjiOYt/L3Fl6:cGP9yiLoS81W4ByT0ALIphEL3D6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926337, "uuid": "7f8cadf4-2b3e-4b80-93a6-94e1b8496a53", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926337, "uuid": "c4e86256-9a29-4037-b99e-be79808e8d32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926337, "uuid": "6e5f2e6b-a9b8-4cdb-adf3-3b93fa9d9c12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1da839c-a83a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675920636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920636, "uuid": "6cf066e4-dad6-4386-842d-03e9d4e3396e", "comment": "Malware payload (Amadey)", "value": "371b26d8a9feea02d642d5d818373095", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920636, "uuid": "3bf0bc3d-6dac-4656-ab2e-9bfc531145a2", "comment": "Malware payload (Amadey)", "value": "01899dcde43b93483487c8cafc4a9b621def5898cbc611205a337409ad9a7842", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920636, "uuid": "203e32ef-eb85-4706-aa30-96effb1cab34", "comment": "Malware payload (Amadey)", "value": "c3624fc980bfbecbae94faf4b769430e24072fbb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920636, "uuid": "777c5cc8-3a22-4677-b0a0-c6b58cb250bc", "comment": "Malware payload (Amadey)", "value": "0af164e3c94a29ea5fd3280d748b1b7ba4733687e9aff2b0243913b32796608ae05a305eec168724d5d32444056b5f26", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920636, "uuid": "64524390-d00a-4bff-8d48-48b38a5b72c1", "value": "T1E6C4024BFBFC9132E8B55B701DF703D71A36BD605638C69A131FAC5908B26A06232767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920636, "uuid": "3726eb81-3720-4fd2-a8a9-9e79eeff24b7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920636, "uuid": "9c8e8966-fe4d-4d4f-a103-fc6c8b5a94a9", "value": "12288:9MrYy90KHYBzTLVazAvLZyxfQXiWp5zxZM1Ng:5yPHKbVY+Ny1QFjzU1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675920636, "uuid": "d2ab9c59-6139-464e-be68-a761c25ffe5d", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675920636, "uuid": "f96d1253-7f4c-44b9-a659-2275bca07295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920636, "uuid": "025c00a0-e670-4521-b220-2df38705df6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41ed8a7-a825-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675911513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911513, "uuid": "357d1a29-9610-4c5b-9a85-d88b7b1aa35c", "comment": "Malware payload (Amadey)", "value": "426e66e8bcd23c9627d1e9242874032b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911513, "uuid": "682ceedb-3c24-4385-9e49-3a59f5dd2267", "comment": "Malware payload (Amadey)", "value": "01a8dc2b16e2d9f41ba598e829f978e7763eef6431964f805c2f2325dff36a2f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911513, "uuid": "00e01d1b-6982-48e2-87f7-8a5d8da47cbc", "comment": "Malware payload (Amadey)", "value": "b2ecfc8d19f94fe8c772aab69d2cf4825763e3ba", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911513, "uuid": "bc541322-89da-4044-a7d5-dc65484ecea0", "comment": "Malware payload (Amadey)", "value": "f864075b966ff8e9fcaf144dad05ed801b6dbba7c8ad198ebffce47276de02b49f2183895a580101e655581e3b4f9b45", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911513, "uuid": "3edc6e97-d99e-4f43-860a-0a184677ce64", "value": "T1AEC41207E6EC4032E8B46B701DF601C30636BE905B78469B224F2D5E1D73AF4A675B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911513, "uuid": "2ccb0690-f13f-47cf-974d-87c7a70fbc2d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911513, "uuid": "3f143090-e059-4ca5-be06-d23e9111fa64", "value": "12288:jMrIy90scoPRCxnE/t6XPSBLFBn7D/q8UY44PfqKm0A:byRPRCxE/sXsL7X/q824PBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675911513, "uuid": "52727203-170a-498c-859f-5120f2f7ad0b", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675911513, "uuid": "4262eab5-24e5-47c6-b6f7-fbf3c1c54511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911513, "uuid": "64ee1e50-221a-4e24-8a78-c32927ee5fc1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1b597c-a87d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675949240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675949240, "uuid": "9ab79074-5d64-420c-8f78-4d1d3ab38516", "comment": "Malware payload (RecordBreaker)", "value": "900d27e6128c54af6b69cf16612ef16b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675949240, "uuid": "0c6630d4-f565-487b-84e5-e49dcf3ad027", "comment": "Malware payload (RecordBreaker)", "value": "01e388da881c2c5b5689b1c9919ee092ffd24b269e5760159c75b5478d1e4b58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675949240, "uuid": "d5eee36f-984a-4f1e-a242-897e6b9acc5e", "comment": "Malware payload (RecordBreaker)", "value": "e21cfcd4e5767612b050ae2fed4868480af4ea1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675949240, "uuid": "47473585-c191-4067-a8e0-1d2d48792ab2", "comment": "Malware payload (RecordBreaker)", "value": "fee441716df810aba50d4a3f96486d4e8243ff638a5570ee34668c6179d273d00d3493d4394590feed8f0692c41b3d6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675949240, "uuid": "5c7e75fe-545f-4be5-80bb-5bf3144d2d54", "value": "T13666236262A9151AD5C18C354837FEB271B81F3B1E94E83AB5DD3FD438710A1BF1A983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675949240, "uuid": "f1a7160f-cb36-41ef-9bad-d35362050240", "value": "161839a78ef6f07a30d3f07895f6fe23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675949240, "uuid": "303a2a6e-662a-4075-9c5c-2d866c6cfcfa", "value": "98304:j/GdnxlHE7MJ5ugeMaobWs8DkGYUESUpXM1juz6yY2a179kP7ePKO:adfB7ufbobWPhXUN4I1ah9eG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675949240, "uuid": "e3512821-ca8b-4636-bf68-965b805cce3b", "value": 6896128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675949240, "uuid": "48c1dac4-6c8e-49c0-a759-24cff25e4adb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675949240, "uuid": "a9f46cc0-af00-4387-8953-4a13cd0d7c9f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee3fb47-a85c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675935154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935154, "uuid": "19594acc-721a-4faf-b7c1-7792eae4de67", "comment": "Malware payload (RedLineStealer)", "value": "84e148f9c432c4d1e50b1bf8dc541391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935154, "uuid": "49e595ce-9d28-4be6-8551-296541d17a13", "comment": "Malware payload (RedLineStealer)", "value": "01f8826f5c5b4a9aac3068c74eecf1d1537c3ad314a78d4efbfd938c99ecd5e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935154, "uuid": "b4a0101c-a514-49c6-865e-b465b9b3c401", "comment": "Malware payload (RedLineStealer)", "value": "a449036cc1afaa73dbc4b8ae19733cc03eac5907", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935154, "uuid": "e9aa2f47-8fc3-42e2-b1da-5534a8e74bf4", "comment": "Malware payload (RedLineStealer)", "value": "1db7bd5c8f78791aac8514d52da20ffb17d60ae193b3645bf3659931acb1f975ab143f52fbbb58ae87f11186f4b053a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935154, "uuid": "131c79f2-aee5-4cbd-a54a-eda1996cec33", "value": "T14564F13236A0C072C97614345C29CBA5AFBDB8305A798A5B7BDC17ED4F312C1663A787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935154, "uuid": "8e0616d7-3cc4-4ccf-8233-9ca56ac28835", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935154, "uuid": "f17893c8-7b00-4961-ae72-efe14d04e79f", "value": "6144:cG3yKlhLvEDvjOYnn4I5nsdDLfR5tjWs9X+8BIMeA122IQPmwFnJqT:cG3yKlhbEr1VsRt/iswMekI1oJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675935154, "uuid": "278d706c-2ff3-4382-9fa5-143f9c5032c0", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675935154, "uuid": "299f12a7-1825-4246-8891-1848eed979f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935154, "uuid": "00b6682f-30e2-458d-ad1b-80edae9265df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a17aa8-a8d0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675984846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675984846, "uuid": "0272355d-8946-404c-8c3d-ea9edd8d8c56", "comment": "Malware payload", "value": "4f0a3cbaad0282304013d8d6d0f7dff6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675984846, "uuid": "ab8e8722-c7e1-4176-a4e4-2f6f74b6701a", "comment": "Malware payload", "value": "0212a44bbdb84328b74f2556c90bbdd993a62ee981a62c8666aa04a3c759716a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675984846, "uuid": "9a525f20-78b5-4997-b3e3-0c1a7230e1d2", "comment": "Malware payload", "value": "7bdec79fc589d934bb1c0fde3e8b1d8fb67cec96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675984846, "uuid": "98962fc2-d831-4559-a3ce-b2453300fdc3", "comment": "Malware payload", "value": "5dbf22209ba4c57641b7b82031a2587f7dd48b06961fabe27a1c5f38a5702204a7240946570c2e1584883adb71e99237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675984846, "uuid": "31f987fc-6b20-4462-9687-cded2c156afc", "value": "T1F7B4024796DC8132E8B41B701CF702D3193A7DA05B38839B1ACEAC5E5D735B0A63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675984846, "uuid": "96dd5212-eacc-4a38-991f-597d8360819b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675984846, "uuid": "cc9f2974-4829-4c35-85a2-4d8e41425dd2", "value": "12288:/Mr2y90DKQwN8oyNc4iz6D7YfEvWNvxVbpbtkuSGhF:hy4KjN8/+4iU7YtZVL5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675984846, "uuid": "3a2e2121-b663-423c-82f0-fde30d343cf0", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675984846, "uuid": "0fc07fef-a928-4a9e-934d-799de3f50052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675984846, "uuid": "7ccb2def-8dd0-40ef-83cd-3332d42d2543", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a24f4e-a81a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675906901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906901, "uuid": "11927751-8e7f-4840-bb6c-14bd3c62fe31", "comment": "Malware payload (Mirai)", "value": "40e547a638233692d9acd3723a60d749", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906901, "uuid": "ec551e7b-3478-48c5-b984-79b556b155cb", "comment": "Malware payload (Mirai)", "value": "03013fe6d4e84776680c790ce829f16ea870499fe963d08c8283a9f447ea61ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906901, "uuid": "d3520f4b-ac37-439d-a7ea-db0f4ca70047", "comment": "Malware payload (Mirai)", "value": "71c35dead0bf1113fd858f4c780bbd4da3a061ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906901, "uuid": "2e5fb7cb-ea84-45fb-a9df-12de7e575715", "comment": "Malware payload (Mirai)", "value": "7e304d399f290e74b9bd33bc0c2d7edc03fe329077c4c64b0b80264e1e94937900537e235f28e1748f4f1618b744b608", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906901, "uuid": "64df1329-2f90-44c7-b511-24644f01b004", "value": "T165735C9974018EFCFD9BA9BA44520E0DF82173411F630B37BA6BFCA37D620A4AD16D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906901, "uuid": "a0c8e483-ca06-4dc9-9372-c4957a04e528", "value": "1536:3QSjlsUy1H5RSwzcrXD7NdPg1pnVmQEwjDHKxQIdt8a9M:s1H5RSwzcrVdipVJEEoQqZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675906901, "uuid": "2ac64c9b-7e09-416e-a41b-4505d14d86de", "value": 74732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675906901, "uuid": "5f321c82-9650-4056-8fa7-40843ecdb031", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906901, "uuid": "6aa6ef18-6492-4399-b930-b069db9dd80d", "value": "40e547a638233692d9acd3723a60d749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcedf135-a89f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675964061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964061, "uuid": "d66c226f-be7c-4b83-b0ed-842a976f2877", "comment": "Malware payload (AveMariaRAT)", "value": "1fc0585822b0a07342d1f345f9c8ae83", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964061, "uuid": "070679ce-1771-4203-8dbd-992c26453612", "comment": "Malware payload (AveMariaRAT)", "value": "035ba1ad04ed83fc6e13064509f0646fc087aaea121b0fa9896d04e4bcc80782", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964061, "uuid": "a8a065e2-0210-43b4-9935-8101d8d26d41", "comment": "Malware payload (AveMariaRAT)", "value": "5b61409b8441d5a08837e20d7e31225aa47c6873", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964061, "uuid": "1b8036bd-101b-4bdf-95db-35999553833e", "comment": "Malware payload (AveMariaRAT)", "value": "11d8e9dccca8d88f7621664ed4fe381d66a0f04f527b9c79e01580a6fc9a2838920c03f980399c5a0f3f644d7e5154f9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964061, "uuid": "09e5054c-9b2f-4c56-9ca8-3331700b11e5", "value": "T108824A47B65C7621D3E6CA3FD8A3CD000EB1EA52A453CBDE745A134218033A9FF2D686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964061, "uuid": "b5a6512e-089e-42e8-8a56-0925a33f885c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964061, "uuid": "f68efcf9-72a2-4aff-88fa-98a499e88908", "value": "384:fUnBEfm4tLuZLeRoe2gwRshilxsy5sx8ZkGzd3GI:sSviteKbpRs02y5K6bP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675964061, "uuid": "8b33d431-0adf-4a8a-9cca-c7dbc19ab4fc", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675964061, "uuid": "7b1704f6-2455-4b28-8901-2a0bbbd8a01b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964061, "uuid": "7c4dc47e-6085-4a74-a8e5-f25f0f415834", "value": "1fc0585822b0a07342d1f345f9c8ae83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e18e81-a871-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675944158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944158, "uuid": "8e67b6d9-75b5-4957-ad6d-3f72187a8fda", "comment": "Malware payload (GuLoader)", "value": "3839c6b1eb4af40aa2cf8750fcf23e01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944158, "uuid": "7d402a3a-e108-43c9-8dc0-060faec8e886", "comment": "Malware payload (GuLoader)", "value": "0400ed9d2d399ed0d1cfd12c3460065679fb6461d53ff463e548e654ba171eaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944158, "uuid": "a692a1bd-2bf3-4c87-8223-deae5e6179bf", "comment": "Malware payload (GuLoader)", "value": "a73eba6fd8be32f3157a91a8665f34093801aa22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944158, "uuid": "88c7629d-c2df-42e6-ae9e-048114cdc6fd", "comment": "Malware payload (GuLoader)", "value": "dbb1af10afebdae89dcd59d5397795eab8ad029e181b4f411bc3013dd0bf32679b9562010fa0748ba6e318e72b39767a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944158, "uuid": "f200aeb0-975d-4e31-8ec1-5c3c99bd7ae0", "value": "T1A4052240D3D221E7CE8A49B68DD752786CC66D1240C40EC38B8D72365AFA941FEBB5BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944158, "uuid": "a8124ac7-afc1-41e7-9947-79b1997d7d9d", "value": "076b06e6a65c9b7cca5a61be0cd82165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944158, "uuid": "d4779442-4406-47e5-a7ee-28472fe82ab8", "value": "12288:BVKBG73lOUG2H7zS8zjOH7blXZq8Dl7EHooQuY/WYNtaauDQoKp3pAyYLZk70B0n:RrlMa7zbziHFpq8DqHooQusJMMP378O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675944158, "uuid": "39ede193-200c-4fe7-a64e-3be7948a944f", "value": 867907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675944158, "uuid": "41ff0ede-6021-4963-a4e2-e3143c1a91b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944158, "uuid": "072ec324-a9e5-494a-abae-1f2a68a1a4c8", "value": "Payment Advice Note from 06-02-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c724b9-a870-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675943735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943735, "uuid": "3b73129d-d92b-49d6-b937-dbf16347f10f", "comment": "Malware payload (AgentTesla)", "value": "ddbac9c99278597f892a78508156d2ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943735, "uuid": "d0e255d6-725b-4192-aebd-ef6499ab5582", "comment": "Malware payload (AgentTesla)", "value": "04518db5d52daacf4a9805b90a3fee8eccf1bedafe203a728baeff92f25bb143", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943735, "uuid": "c77d8192-f89f-431d-9ef6-8dd11b812b08", "comment": "Malware payload (AgentTesla)", "value": "35851e3471d686ea14dd3a3273ce012b92817607", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943735, "uuid": "34a43777-fec1-4bf0-8bbf-82f94b194bfe", "comment": "Malware payload (AgentTesla)", "value": "6956f48a9513c710722503062a25df21d5aca2585059ae3e6cb7f8550ead4d4826fa93f8cb4b17ce1bc30a63cb742d80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943735, "uuid": "84b366dc-1ee8-4d18-8df4-68973a0badfc", "value": "T1ADE4027E35B88E5AE3ED5BBE59A1010153F6F182B0A2FB2D0F9830D51EB6FC1412255B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943735, "uuid": "1817da3d-9f6a-4250-9324-645c39b21b2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943735, "uuid": "3778a15b-3692-4f6d-bdd5-307f74a2765d", "value": "12288:3GADzsjpbaKvAgn5kX9B/nt5bLJniB9VPROommyK6JwJ/a7EVQlQX:3Ti9/kNtt1xi/VQIyKawlaYVQlQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675943735, "uuid": "d68ae7ed-cc5a-4587-8026-dd05548018b8", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675943735, "uuid": "e89a9d36-807b-4037-b2fa-ac17a613dc65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943735, "uuid": "52a69df2-ac6c-46aa-92cb-292728c4d445", "value": "ddbac9c99278597f892a78508156d2ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d1b4b6-a875-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675945878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945878, "uuid": "d83a29e5-f6f6-4c5b-b8c7-48f1b9786dbe", "comment": "Malware payload (Amadey)", "value": "fb1b7e4b5e89f0285a2ac6d14941bfd7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945878, "uuid": "361b5ef6-3d1c-48c6-95ef-b621a37b9fb0", "comment": "Malware payload (Amadey)", "value": "04b7901e74540bab5d90498955522dd6bb0d18c118fa43650548a442310320b5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945878, "uuid": "c883314d-c3d5-41f1-87d1-87d69ec54392", "comment": "Malware payload (Amadey)", "value": "82d30ea681520cd3e1e45bcee38616a5af18b976", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945878, "uuid": "f9b43002-330d-4d97-bb0f-57bfeaf0e49a", "comment": "Malware payload (Amadey)", "value": "0965a05e7e831e13af702ac6962841c70c8f6ad3d7e7eabea009ffd159ffa6ce5510ec79213f3e80d8452efa998cedcb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945878, "uuid": "458f9dd2-913c-4807-ac4f-bc2035bd6e29", "value": "T127B40207E7E88131D86117B019F603D31A367E91AB3883EB578F5D4A0C726B4A7357AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945878, "uuid": "fd79ffb2-8d90-4ec4-9123-d15d0d143e9c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945878, "uuid": "36ce636a-b16f-4337-8194-dcd5ff535e8a", "value": "12288:lMrqy90ISVSwrgpoPHk2KXQbCTvybLAHa7xLvYLbF0ux5nhp6DyY:LyxS/rPPHk2CQbs6QKLUbF0Whp6mY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675945878, "uuid": "be0e2cae-8f8a-4903-a4e6-8f28d2b8aab2", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675945878, "uuid": "b62ba091-0035-4b42-bbe9-4685536dac6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945878, "uuid": "d460c47f-ee79-4399-abb1-0d9f17cc25ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d4ceb5-a869-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675940479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940479, "uuid": "da107c76-2928-40e3-be39-56cf72382ece", "comment": "Malware payload (RedLineStealer)", "value": "24fe2f397991d06c7f62a006f9d91dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940479, "uuid": "8be15a54-4475-46de-a6a0-71bf59474aa4", "comment": "Malware payload (RedLineStealer)", "value": "04d5d0a805fc24e217528c61aa3c13ffca9aea5ca01f87ede7011e2085d4d7eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940479, "uuid": "94d2bcc0-d422-46a4-a55d-304d4c911605", "comment": "Malware payload (RedLineStealer)", "value": "ee2acc13d65bd206c83e79fffe356b65475c9df6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940479, "uuid": "7a9dce91-8c6c-4b25-8c26-d2f6a65efb3d", "comment": "Malware payload (RedLineStealer)", "value": "bc5b609461d7a473793460c312033cd783d5863d5e06e9ae36ad99e4126c41c7f30f3f49b899b12d7118a10f4b97a9d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940479, "uuid": "4413f905-e83a-4f15-a688-1e7c6ada0892", "value": "T1AF64F13236D0D0B2C82EE4705D25D664ABBF7430967A459377B81BEC5F702E1AB36346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940479, "uuid": "e356c59a-e378-4234-a23a-bff6e97ebec8", "value": "83d1b8095e33f74e23ddae505b88bb37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940479, "uuid": "9f76fe9f-acfe-4c04-b19f-d932884d0910", "value": "6144:NheEnlLbhhZBIoXjy6OiqBv/viUYifEVI5OSbQGjp0Xa:NheEnlnhhZyoaviU7EOFlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675940479, "uuid": "f1819395-1ac6-4a33-9201-211c2536a5e4", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675940479, "uuid": "8a8cbce9-61b1-4c20-83dd-3919c5805c42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940479, "uuid": "247ef73f-2d7a-4239-86dc-378a8a75bd13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fd42a5-a80d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675901261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675901261, "uuid": "859bb48e-52a8-4474-ae8e-32cfdc12b5fb", "comment": "Malware payload (Smoke Loader)", "value": "49cacdf535c0483b864ade080d4018d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675901261, "uuid": "b3dc8139-b341-4a86-8114-9d5060cdc927", "comment": "Malware payload (Smoke Loader)", "value": "050eb60b9d6dd8b866da3835f3a0393d0376a687129d18738dd223c2242a558a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675901261, "uuid": "f9f9251b-b0da-4f9e-9f2e-17cbd0b664a3", "comment": "Malware payload (Smoke Loader)", "value": "f537e4f005eab38ca8f1dac07dd731ee9fbebe56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675901261, "uuid": "8bce9509-d2dd-4bd2-9dc4-dcbee7221dec", "comment": "Malware payload (Smoke Loader)", "value": "bd9b79ffe2a14d4194db3ff5806efaec260166209f7ea920ba332d44207ec93da1f0536e8699437b25fd91f7d825a18f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675901261, "uuid": "d68a53fe-347f-443f-bb5d-c56e8d90f528", "value": "T1A8641B0393D17C84EA2A8BF2DE1EE6E8765DF6504F4BB77552189B1B30B3172C5A3A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675901261, "uuid": "9138b93e-e624-4c29-b34f-dc6c8f4af963", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675901261, "uuid": "f48c13be-9a16-4da0-9aba-56fd16bebf75", "value": "3072:3PEOIArLWPRdhdinJ7Shgik6t+7laIIlwH5CQENe+pGSkez3:3MOIA3AAcE6tWOOcQkeQGS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675901261, "uuid": "27568b68-18bd-4228-972c-81ae5a8309ba", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675901261, "uuid": "6de531f3-f8ae-419d-b52a-3d331990be3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675901261, "uuid": "2c5deb8e-1843-4de0-bd77-078798e8c0ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d8b7cb-a819-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675906329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906329, "uuid": "4aea441c-9580-43ec-9058-63a10c58645a", "comment": "Malware payload (Smoke Loader)", "value": "296e721fafb568938ee68bee0af47d60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906329, "uuid": "848ceab8-7697-4426-bb03-5d7c859f2af5", "comment": "Malware payload (Smoke Loader)", "value": "057516c0c183e4d3559a015e8f84067d5ebbd176e1b2b1bea864c6ee6e402c92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906329, "uuid": "30e0dcce-da98-4909-ae78-2d974631c562", "comment": "Malware payload (Smoke Loader)", "value": "cdd0de32f59c52a9ecd5c64e7a47c50a5717c05d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906329, "uuid": "da8e25d1-09b7-4784-a748-1a911195f944", "comment": "Malware payload (Smoke Loader)", "value": "643051a4517e46fdd5c2c718d40a9ab149fc981c0a304c372dfaf5b3a17b670745ab87168aaab93987f456bbc71640dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906329, "uuid": "fdbc09a5-34d2-4f80-8029-f40f04a2650d", "value": "T1CF64180393D17C80EA2A8AF2DE1EF6E8764DF6508F4AF77912189B1F34B1172C563A54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906329, "uuid": "07414d5f-0d58-4565-95c1-961c8e89ccdc", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906329, "uuid": "1842528d-a92e-4c61-97df-4b0252b52fa5", "value": "3072:jPEi+VSPRdxKET4InfU7koacgFgg/5KNYruCQENe+pGSKBvz3:jMi4ExKrIn7gmKq7QkeQGSKBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675906329, "uuid": "b5274820-50bf-4a4e-a5b5-249c32a3e918", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675906329, "uuid": "626ea6de-bd07-4b4e-9696-cfef43ab5f3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906329, "uuid": "ccf104b0-fbcd-4f19-b101-af1a84167b04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94528b39-a810-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675902467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902467, "uuid": "92e29b35-0f36-4b05-962d-6703b2d0940e", "comment": "Malware payload (Gafgyt)", "value": "cbe8f4177d6c9fad0587138254f40874", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902467, "uuid": "bb8f8dd1-7265-418d-9a2e-5421f4ca3841", "comment": "Malware payload (Gafgyt)", "value": "057ed610ff298558aec617e389dc061c92955fa1fdf041f60d2dba7bf55f2304", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902467, "uuid": "9632592a-6217-4a07-a8fc-2dda5c69acb2", "comment": "Malware payload (Gafgyt)", "value": "03016334049183dacf6c54881dc7a58d684b02b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902467, "uuid": "dad22838-1691-41b3-b51b-a64903aa05d6", "comment": "Malware payload (Gafgyt)", "value": "3efe6b5e4c23303aae8b2a470162b8b0d25ea10eb46f71231061e5c73f7a8f2b2ba5b3eb39d02c44b16da46636f4c1ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902467, "uuid": "58765a25-9721-4b4d-8601-2e741f7f5035", "value": "T167C3B61ABB619EB7CC5FCE33059A4901208DE58612E96F2FB2B4D56CE74B94F08E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902467, "uuid": "55abdc7c-fee1-472d-b661-29c75c0e58c0", "value": "1536:BfKneTGp19FFM4Yv3ZyBEaoLqUgx8Auau00peX1BErZxrmthjF71Dj+1MdI:BfKFve3Gxx3u00k8rmthjF71Dq1MdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902467, "uuid": "c965ad5a-2372-4e79-a39c-2b4096fe3489", "value": 126387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902467, "uuid": "33c95924-95d4-491a-adb0-61a899af4ed5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902467, "uuid": "ef9fb000-b5fd-4e16-8c88-79712a205b75", "value": "cbe8f4177d6c9fad0587138254f40874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e7144c-a8b0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675971052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971052, "uuid": "99f484ff-d4f8-43d2-8634-77cb3e544191", "comment": "Malware payload", "value": "cd0c90fb04ca97829b346b56905ef5b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971052, "uuid": "d706bd27-288a-4498-96c8-d2d74ef8cb6d", "comment": "Malware payload", "value": "060ab710f9111bc490572643d316faf169ee396ed968697b35bc19362bb9c933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971052, "uuid": "367b996c-b673-4636-ae79-3cd0fa62b7b9", "comment": "Malware payload", "value": "4b17a2c25105980619355b5a3f4694a828b8bdeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971052, "uuid": "9a9aa530-b691-49ab-81cb-e83512604ac1", "comment": "Malware payload", "value": "66b28734c43ccb0d2c51b89ee8550e07ed53614a662659670469e64b5c58c6830c6119088bb6c7a75ecfe77b31acdb3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971052, "uuid": "f028d8de-6c72-48d7-a6d7-9b5539049e53", "value": "T10354F122F6D0E8B1D572B2395C29C6F56A3EF5114A38DA873758272F0FF02D1A976342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971052, "uuid": "2a5b031b-49ba-458a-865f-68ecebf5091b", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971052, "uuid": "5277c363-260c-4e18-9bc9-f13180fdbb02", "value": "6144:OFZ/EftuyI0Rs8doiujbpUSNAS/yuFzn65Vwk7yCHbQns8j161:OFMtuym8dodjbpt2puFm97DQs+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675971052, "uuid": "5fae0fa0-5587-472f-aa2c-960c6e301eab", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675971052, "uuid": "e90556e6-5345-451a-b0c5-0ca9dea46a74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971052, "uuid": "71e8ed3a-d6e2-4c92-9a66-9f49bd0d9fa2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7d3bf4-a87c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675948868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948868, "uuid": "8215b132-d953-4669-930c-cebf04a05b8e", "comment": "Malware payload (RedLineStealer)", "value": "8d3a50d27c4b443fb500db748873d273", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948868, "uuid": "c3d3247a-21d1-4d39-b62e-9e19f2b909ad", "comment": "Malware payload (RedLineStealer)", "value": "071c426323a5b58e50a3d076709492c79781a672ce63d5e8a9ca20cce4d9df84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948868, "uuid": "c5d9dcf3-16e9-403f-887c-9bcacafaa372", "comment": "Malware payload (RedLineStealer)", "value": "a3aec747cf6cdd72ed78541924a74c862dcefea3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948868, "uuid": "b0175efe-042a-47b2-b536-f64b49e28149", "comment": "Malware payload (RedLineStealer)", "value": "8904304ac50cef9e7d855eb16b9244e4af730dcf5bdffd3975afb87e4b8aa0139b52b4ca39bf662c0dbfa7f99fd24ebf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948868, "uuid": "1f45a422-5ade-43ea-9991-6390ff2e0caa", "value": "T1D2B40207F7E84533D86217B019F603C31635BDA06B74D397239E6C9A19B26E0AA3177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948868, "uuid": "3cdf4269-2719-409f-b7e1-68c6fadb21a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948868, "uuid": "26972847-5ac8-40e9-8e14-4de37148e113", "value": "12288:+Mray90UarJUF6sxWhEt1S/Fo4aZ4iq/NQcKFO:EyerJUFx89FLaZK4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675948868, "uuid": "5650ea5e-a533-4e5c-b5f2-3989de1f81b5", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675948868, "uuid": "47e28fff-501a-481d-a6a2-351cb24c6560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948868, "uuid": "6e27ae77-8d4c-47fe-b58c-5475ef02adbf", "value": "8d3a50d27c4b443fb500db748873d273", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0829204f-a833-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675917265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675917265, "uuid": "33e110ea-5106-4aec-b991-84cb6b93d36c", "comment": "Malware payload (Amadey)", "value": "19b6fb8cfb423f8473ab19f6afe25518", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675917265, "uuid": "aaffe39e-f213-4b7f-b3e4-286b006a2ca6", "comment": "Malware payload (Amadey)", "value": "07b082ea6fa249957be7cd1369571d8ad59b0113deff62e754298bf86ba19e9f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675917265, "uuid": "d585314c-a9c1-4f52-ae77-8a4585f6b867", "comment": "Malware payload (Amadey)", "value": "cf42e7af3aff46548c3469c39fa8d6c9bfaf6d8b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675917265, "uuid": "98678d04-c83c-40ee-b4f5-3e7ce9535ef9", "comment": "Malware payload (Amadey)", "value": "d8b5cf5372e3140b7d343a5c5675c5f5d918698e29f5ffeb484780339ef87b2a348b549711b32a175d7b850a00997069", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675917265, "uuid": "46945718-2f4b-4168-8b74-acefb78d9e9d", "value": "T16DC4124BE6FC8422E8B1577019F506D31E36BDA05F3987AB135A3C5D0C736A0A6317AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675917265, "uuid": "309451ef-3c96-4c98-a062-3f643fb13eb1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675917265, "uuid": "317492de-7002-4894-98f3-173d64d03ec9", "value": "12288:CMr1y90SQlAiYhixn3YbqqtLw6iIWGCRDuKR0HDVpGX/9V:vyPDfhyn3Y1w6jS4jaX/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675917265, "uuid": "21508874-bde0-456d-82b1-fc3898c75651", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675917265, "uuid": "b00f0668-ddb3-48d2-965c-a4e3e5f77b0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675917265, "uuid": "6947539f-1bcc-4960-910e-63f911636004", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde883a3-a892-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675958479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958479, "uuid": "0db685b0-873f-41ef-ad41-aa89a7cc9ac3", "comment": "Malware payload (GCleaner)", "value": "2658770c65780ffd60d8ab6b73e576f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958479, "uuid": "567c0c96-b6dc-4aff-9adb-d41ebe3ef6c5", "comment": "Malware payload (GCleaner)", "value": "08541f6e46bcc885a7f68dad6207cc5c43801fc8c06a6248868aad052e8854c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958479, "uuid": "d94bc117-6ecf-4ba2-8e93-9808c2f148fc", "comment": "Malware payload (GCleaner)", "value": "eb01f834450c2d5314fcc407bb259b428d95fa35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958479, "uuid": "cdb7a440-a384-4506-b6bf-41d78fb76b4c", "comment": "Malware payload (GCleaner)", "value": "b5e5193920cdac61efa93024012fc51c3432cf638969bafd94fa492ed3a9776867f1532e4291d7a0eef104c4c4667c7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958479, "uuid": "7fcff62f-b657-43f4-aaa4-13112bc0487b", "value": "T1A4C5127D7545C8ADC280FEB48C3A98E71CD66EE3E9D4A06270DD7F3F81792849A09607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958479, "uuid": "76707ed7-8534-438b-ba34-477222e03591", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958479, "uuid": "fe74d546-2142-42be-ba9d-913ec64559d7", "value": "49152:rdH7JkyUjG8bpvK6jglzfCm+XrGEyNIZgtZELpNpqCX+O5b5LCgv2MR:JH+lbbpvKcCjCTXr7yCCWTqebVv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675958479, "uuid": "835bc35e-cf9b-42b6-9d82-37b12397a28f", "value": 2528551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675958479, "uuid": "9f77ea0d-d863-40ec-9899-e78a55bbddaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958479, "uuid": "9a5ecfc4-5264-49f5-9129-055fd3393f1e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11704e7e-a863-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675937896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937896, "uuid": "84eabc7b-a330-4c91-8e25-d9c9632408e5", "comment": "Malware payload (Tofsee)", "value": "00a1fd32993d68910eada180425b4055", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937896, "uuid": "f41d3162-465b-4c3f-8abc-b4382dc05b3a", "comment": "Malware payload (Tofsee)", "value": "085749419c4bdd9120552b26add425d8b03cc2d9b5575fdf60ac7fc3fe4740b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937896, "uuid": "62a0a530-879c-427c-af67-d17372a1b69d", "comment": "Malware payload (Tofsee)", "value": "62d73b56c94e0cdab7edaeafff166b06b124eeb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937896, "uuid": "5af8d563-37bc-4c49-8420-3b6f79646cdd", "comment": "Malware payload (Tofsee)", "value": "0e2975745be4986733d15e33c04bb87881da024c4f4106149c38eff609af956eef45d5327ebcdecf48a9d861a541fb9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937896, "uuid": "f2d7ae91-3390-41ef-9a46-8f03c7f0e9cc", "value": "T14614DF323690C071C56FD0305864EAAA6BBEB8315638DE5FB7A81BAE5F303D15736346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937896, "uuid": "995f616c-1b0e-48a2-95f1-900f2ac57b57", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937896, "uuid": "3f1df3c1-a257-4a3f-8feb-e308b4f31e9f", "value": "3072:CGgO7Dy4hpbTXLcOo4DWXzd5YRtJ8+PZRREAkriTn1rczBqTKvcCQ3uY+9ISb:CGgxS7LLDZN/RREniijcCQoSSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675937896, "uuid": "5f7ad6f4-211d-4ed2-9959-89ad5c73c82d", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675937896, "uuid": "c3d0254d-4388-44e8-a87d-189b2fa8b77f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937896, "uuid": "5facb84b-077b-498c-b88e-fe6ff817ce95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563590aa-a883-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675951755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951755, "uuid": "1a48db57-7bd8-4039-a875-dabfc9bbcc87", "comment": "Malware payload (RemcosRAT)", "value": "9004e3f595500af0da3f267d83f06645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951755, "uuid": "9618c36b-e851-465d-a1df-37793ec7b392", "comment": "Malware payload (RemcosRAT)", "value": "08612eb6f416fc41170572f28e93b9d9ffed49b8b5d1b8615337c0fec58f871e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951755, "uuid": "2dc8b5d9-67ce-435a-b036-ba21822817f2", "comment": "Malware payload (RemcosRAT)", "value": "e3f8786637a2d5bb12165ee5ce98eb65be64317d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951755, "uuid": "2c29e72d-2606-48a9-8da1-841cf8886d78", "comment": "Malware payload (RemcosRAT)", "value": "dc9dcdb81fa6e8e809884c0c242bc89bec8d34ba3740c710333fa5664bdebe9ba4d8c6aa66ba32376a95a1e5bc5c0bd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951755, "uuid": "4b6f6862-8b79-4240-96ef-e732617ae6ba", "value": "T13125223975B84E5EF6FD477AA9E1004A93FEB486B062FB190F4474D00E7AFC0812A657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951755, "uuid": "ef2ab2d1-7294-4801-8eb1-d6e6b748b434", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951755, "uuid": "eba708bf-aeb7-49bd-8d6d-4d9593cf9f42", "value": "24576:5RH5MiKljbipiLqsRalRP+3qs9tu9zGQlQX:5R1cjbIiLqsRmRP+R9GbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675951755, "uuid": "8dfb6fe0-efc4-4f8d-8ea6-09fe30f116bc", "value": 1007616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675951755, "uuid": "0a069aab-7f78-4157-be88-625d36ac928d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951755, "uuid": "b18925a2-f0ec-46d0-a430-ffc965fa7c00", "value": "EGF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164de14c-a82c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675914282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914282, "uuid": "dc6f54ed-350c-41cc-9971-747f3a82e38d", "comment": "Malware payload (Amadey)", "value": "1f025d14622936b143c32a5cc656f5d8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914282, "uuid": "b4cd5097-f914-4fcf-86d5-c1feb073eb3c", "comment": "Malware payload (Amadey)", "value": "0887974f81f7e6a1aa7658d37ba02ebdcdb45f84254b6fc19934147a25f02aa0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914282, "uuid": "262952b5-01bb-4510-804f-c32b4ec29ded", "comment": "Malware payload (Amadey)", "value": "53db56ed2778ec9a39adae10441e406a7c7e27b9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914282, "uuid": "4a3be790-4cdc-4c2b-9aef-49db20b2f153", "comment": "Malware payload (Amadey)", "value": "9629ab7e32418324e41705c272d24deaa7de4706e46992e5c4d714e9e63216289669cb95cda620aa4cd5762d3aa9ed19", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914282, "uuid": "6ed40c7e-722a-497a-a37a-fda3ee1e6fd1", "value": "T18BC40207E6FD4432D4E65B7019FA02C30A367EB09B3986EB674E6C1D0C321B5663636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914282, "uuid": "7c38a483-7831-455d-afe8-5da7dcbacbdd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914282, "uuid": "9fed0215-93b2-4aa2-864a-d7348298c32c", "value": "12288:0Mrmy90QIimQWlXCHzbPvuoUXG88Lmt7bt:Sy3Ii4XMvuoGG8g675", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675914282, "uuid": "d02af45a-bdc7-459d-853f-63c9d24baab9", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675914282, "uuid": "d8f33859-d2db-4a08-a4f5-df3494f48436", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914282, "uuid": "b746585c-9fc2-4a76-8204-25b447ed50df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7547f77-a887-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675953609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953609, "uuid": "4fe5a859-d3cc-4ac7-8074-14f8a345f3e3", "comment": "Malware payload (AgentTesla)", "value": "4358ae4d2cb08c73d3a55191a5d09359", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953609, "uuid": "a16a1fc9-0f94-4553-bc95-8d6ccb2807c8", "comment": "Malware payload (AgentTesla)", "value": "08f2d92fadadcf9ae31ea64ca5ced09e510875ce05a1fcfa93ee299a5eaf70ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953609, "uuid": "3e5326f3-6bc8-4f51-8f98-3f535f817f2f", "comment": "Malware payload (AgentTesla)", "value": "c61738da38088f7c39c44a6bcd5f0a5c6f212e9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953609, "uuid": "dcc108f9-513d-423d-b291-c10627394335", "comment": "Malware payload (AgentTesla)", "value": "c8591a18f874497a0f230b03300c55edb30bd7a2c800a2e220c64c4dc3dc6476c1928c940a41b285424f22b706b82614", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953609, "uuid": "87d1ba03-23c4-42e8-ac71-0470ee7a8839", "value": "T11505F12C2CB08711D1BCC6FE86A36634E37F7E93B58AD6190D8271CA1DB5BD3505889B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953609, "uuid": "ee490e65-3ee6-4403-9060-6f36adaa7452", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953609, "uuid": "a302fb0a-1642-49c3-8236-c49072431908", "value": "24576:iHCtn9BoO/NmSQlQXDYzh0MHm300YKeWgU0:xoK8CMHY00YrlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953609, "uuid": "bf6a517c-f754-42bd-8829-c067337087ae", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953609, "uuid": "e603b6c9-37ab-4ddd-a530-f56b823956d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953609, "uuid": "b9c85017-76ee-495a-99c7-68fdd8bf6ecd", "value": "Offer inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51fc230-a8c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675978194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978194, "uuid": "b6a47c39-aae3-4bc3-ab1d-bbae6b2f6831", "comment": "Malware payload (AgentTesla)", "value": "de4858508e90c545f5b76cae064697a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978194, "uuid": "c89067e8-ee6c-41a6-843d-ccc17d39eaf6", "comment": "Malware payload (AgentTesla)", "value": "09535b3006755b42482262b04d2e68c696ce132b4c4cef30a6d9e139ed888cd2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978194, "uuid": "e704e54e-d583-4f88-ab32-030f00765e49", "comment": "Malware payload (AgentTesla)", "value": "de91e2022e96f848a669d93605336922258db414", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978194, "uuid": "e4081c05-25bc-46a7-8b63-3e9968b3a56e", "comment": "Malware payload (AgentTesla)", "value": "18f3ac0f28d9f649b02507a78d6130217bb43d30525780e5f93beeb5d22095b7dc2d755d8d231864c6aa54a94d803560", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978194, "uuid": "e5bea1a8-1336-4f10-b2f7-fbaa794975ac", "value": "T199F471F95677D691C2B8F53C46E18023A9AC4F826347C878EAB57AC3CF311456BC9278", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978194, "uuid": "e18a5dc9-3690-4fda-8fb7-16c54274c8f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978194, "uuid": "f7002202-7dd1-4a07-ad81-50b22d7b5413", "value": "12288:3f1NDne7f4WYMTyPdLX2tuCAe/ZXWndc0F8bzDwV4xeZiP3vKrfa4pca4z:3T7MTyPdLX2tuCAe/ZXgdDF4z86xaiKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675978194, "uuid": "96d6c3e7-7e7f-4ff3-9b2e-5ec538b4d3b2", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675978194, "uuid": "9a871f33-e02f-40bd-be45-52d2678ada7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978194, "uuid": "0e45996c-3dfb-4a0a-9c52-8da31c021514", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd0f87a-a821-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675909949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909949, "uuid": "61f5e2aa-c4df-41ca-b877-00b1228c589c", "comment": "Malware payload (RedLineStealer)", "value": "6c52c9ec979fbc2d10b27bb32f709297", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909949, "uuid": "77a66c00-2e8a-4079-aa3f-25a785086025", "comment": "Malware payload (RedLineStealer)", "value": "096bb6df85abd72e1cdc2e2cbde27630736203f70b84c7242d233cc11845782f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909949, "uuid": "4581262a-fc5e-4817-8534-15fa59ac4cb1", "comment": "Malware payload (RedLineStealer)", "value": "6bcccb7726803bda734bc7789a54033c90dd4b2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909949, "uuid": "2f23a4bc-1f41-4988-a85c-74ac77a26a0c", "comment": "Malware payload (RedLineStealer)", "value": "d01601b7a10d66e5ae99e28491367989cbfc3cbfcc8b45c4c36691b6bdd6a6a6ea79df5a0187d5aaa21259bbd80858d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909949, "uuid": "5af65644-8b68-4179-b117-136a0c5821a0", "value": "T162947D1393A17C90EA2A8AF2DE1EE6E8764DF5408F4AB77512189B1F30F1176C5E3B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909949, "uuid": "7036e6cb-7e5c-447a-bdcf-0f8b4d42dd6f", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909949, "uuid": "edeed71c-780e-4b07-95be-0d57b29471b3", "value": "6144:0M1LoEc16tlaVz/OIUEsHNnutE4G6KueJgIQkeQGScL:0Mar1MnEsHRX4a16IQkeic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675909949, "uuid": "da2d9492-f8e1-46c2-8b6f-76df16cf27a0", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675909949, "uuid": "afa7ffb4-dcbc-40d9-a7af-7ed8287a8a04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909949, "uuid": "37b9c047-ee44-4536-989a-abd5680a6e9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa642d1-a84c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675928221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928221, "uuid": "34c93a21-4882-438a-95c5-409b616b9e93", "comment": "Malware payload (AgentTesla)", "value": "f45e69e9a0cbbcb0ce638cdd1c96cfe3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928221, "uuid": "f8d30771-92fa-42b0-ae84-679ee53d6a8a", "comment": "Malware payload (AgentTesla)", "value": "097fa705dc9603a07d71bd19b2d0e664c03f0bc2cfcfc9f696d65d3e7fb4b771", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928221, "uuid": "555c0067-bde6-4460-a392-70a156c2e119", "comment": "Malware payload (AgentTesla)", "value": "9414f8a7087c10d8c24962b8048605fc6fba70f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928221, "uuid": "894f22b1-e666-4283-9f89-80677164c582", "comment": "Malware payload (AgentTesla)", "value": "78548c54c101dcbae13913546fcc04ca0364fa85b5a1ca952006b8c611caf52ac98fce2fe3a54e76f383d1d158b4a90f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928221, "uuid": "70da9c5f-7de2-464f-8c7f-f71d753c6a3d", "value": "T151F4127D31BD8989D2FE47BE69E00202A3B6A582B1E3F7290F4434D51FB6BC0825755B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928221, "uuid": "90b3ad1b-9961-4c42-9ea4-da3b21e31618", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928221, "uuid": "7feaf686-46e2-4d66-9146-f2dac0fd34c9", "value": "12288:J9ZUFMWBrz7YOocfDYYOHPaI2l2I6hNO60OqUFQlQX:3UYOXM/zhNO1yQlQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675928221, "uuid": "82f6f970-902f-4d22-ac92-06fe3302545f", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675928221, "uuid": "f21d1432-d4ff-4119-a323-258d140bb13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928221, "uuid": "75e325ba-eab7-462b-80c1-4582072b5ad9", "value": "Purchase Inquiry (PO 32733600183).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2407b33a-a8af-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675970569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970569, "uuid": "8668b606-c174-40fc-8b89-1466b2cb5dae", "comment": "Malware payload", "value": "fd679539a936d8db77528898c741a5bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970569, "uuid": "52634a3b-0ddb-49c7-9c76-a1a6942f93bb", "comment": "Malware payload", "value": "09bb402bfaf52269cb9abdcf46b9b2706c3db8bfae535f0aa6d14149666a3c07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970569, "uuid": "79aaf5d3-e2ab-4e2e-befe-bd92ad518ea9", "comment": "Malware payload", "value": "13e2129cde6d512efb45cbc25fdd905577663381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970569, "uuid": "f1204492-eab2-4897-973f-1782f3bf79d0", "comment": "Malware payload", "value": "fed75759edd86dd2272e78113cff0e9aef72ed7bada23e388461615b06b01472598c7d2f6230794977ddf95a32baa69f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970569, "uuid": "07f69bb3-de0f-48a1-a3be-3ef7ed30343a", "value": "T139362265FE64C169FAA3E2346B29C19B681D6047900CB0E73DB41689247CCE51FC7AEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970569, "uuid": "252a059d-c7ad-43aa-a806-d90e2a47caee", "value": "35af46e721c3612e443f2d1e1e4798be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970569, "uuid": "1395a972-f7f5-4140-ab3f-1aa0f6b5313f", "value": "98304:MCEsTSNXXuoqFOk1c3Y5fjgJ4ycbLGUYbi4ddpX0iJoEADSmIhbG1qAFPY:LS5uMdyfjgeHf4ddpk6SIhqIAFPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675970569, "uuid": "c8fea953-cfe7-4bde-a984-52b09a31ade8", "value": 4938666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675970569, "uuid": "c6b6e30e-2b3e-4e46-ae6e-bdcb69416274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970569, "uuid": "5d9a9edc-a6ff-446b-9059-d85ccae5e558", "value": "CristalixLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee07374-a87a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Cl0p)", "timestamp": 1675948146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948146, "uuid": "53102ff3-e65f-402f-9c1a-ddebb63c382b", "comment": "Malware payload (Cl0p)", "value": "31e0439e6ef1dd29c0db6d96bac59446", "object_relation": "md5", "Tag": [ { "name": "cl0p", "colour": "#4C17CA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948146, "uuid": "e9c25615-0300-46b2-b9a1-9d18d169e8fc", "comment": "Malware payload (Cl0p)", "value": "09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef", "object_relation": "sha256", "Tag": [ { "name": "cl0p", "colour": "#4C17CA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948146, "uuid": "bd218b31-f40d-4585-ac91-7ee57859f66e", "comment": "Malware payload (Cl0p)", "value": "46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5", "object_relation": "sha1", "Tag": [ { "name": "cl0p", "colour": "#4C17CA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948146, "uuid": "ee298164-2594-4d71-a006-e704490ceaf3", "comment": "Malware payload (Cl0p)", "value": "5c100509bf848257024419b3e8146069653765c2d54fcbbbbce4630717fd1a475934bd8ed4fedae4c660cda23d01b6cc", "object_relation": "sha3-384", "Tag": [ { "name": "cl0p", "colour": "#4C17CA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948146, "uuid": "47eb8e3d-66ca-4627-853f-03b62e85bdf8", "value": "T13B454B07EA434EB5CCE72BB0118BE37F86109D3D8412CF5AA65DCD18BA676E5790EB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948146, "uuid": "053cbd50-aba5-43eb-8508-85980500a1f2", "value": "24576:SBHj9n1SKNk1QbdGfVmNtGtR/2qYeFABKGNPhVc95OTmBrnf4XZnS85weLUo9GO6:SBD9n1SKNk1QbdGfVmNg/lYeFABKG9hC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675948146, "uuid": "d55b1e6e-0f7a-4e6e-80e7-8c8e70f97c23", "value": 1250347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675948146, "uuid": "9d67268a-bc74-403a-af61-06544ecd3ba0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948146, "uuid": "db47e412-54d1-4bec-a12f-4eab02da22e3", "value": "09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ff62f0-a826-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675911736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911736, "uuid": "5604c467-37dd-4f37-90d6-6e6ae4660fbb", "comment": "Malware payload (Amadey)", "value": "610ca2f9c4a8c9cc86fe0a2fe9d50be6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911736, "uuid": "34589cce-94ea-4ad5-8023-24b39d6d9277", "comment": "Malware payload (Amadey)", "value": "09eead859813148541374eca59e9c83ff4af6dafbe81bbd7da4e73ad3d0cc3c4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911736, "uuid": "167756ac-ab04-46ee-8a7f-77afe4bc1a29", "comment": "Malware payload (Amadey)", "value": "dd245049e517698c95340cde5d2afecce70a435b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911736, "uuid": "ae89d6ba-2d6e-44a5-8047-c3a7a5134d8b", "comment": "Malware payload (Amadey)", "value": "ade4f54b24464a09beae2d6aff08249949543944e1cc982d5a2a34206e239bbcd751549f8fa8be86971ebf5e8397727e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911736, "uuid": "6177bb0a-9d57-430a-8354-4a72456e3f5f", "value": "T11EC41247B6EC8032E8B43B706CF501C306367E518B78866B178F5D6E0D326B4A675B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911736, "uuid": "775d9e48-700e-477e-a676-1fe7206ac19c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911736, "uuid": "5297cd30-79ee-49b0-a3f7-1b365ed5b3b9", "value": "12288:iMrty90kouhZM47CaRV8BLFBf7D/zfUgXuGwtacpE:fyJhZMWCaRcL7P/zfJn35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675911736, "uuid": "95aac108-b225-4491-ae04-eda211bf1473", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675911736, "uuid": "0479675a-aa25-48d2-9947-3fa3212a4c20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911736, "uuid": "c31c5853-8537-4be7-b7f8-565893bf2c0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d9a59e-a832-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675916878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916878, "uuid": "acda46b1-4764-4949-81d3-9e56ee18e571", "comment": "Malware payload (Formbook)", "value": "e9565aea25722423e054792af30cdc76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916878, "uuid": "c08220eb-4834-47ad-bb44-71b2286df48d", "comment": "Malware payload (Formbook)", "value": "0a3fb57d9fdcf594a55f48fe4853fc37ae7c05d15d710cc902a23b5cccf6c377", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916878, "uuid": "0fc54761-32c8-4baf-a8a5-cc22b4ae8b0b", "comment": "Malware payload (Formbook)", "value": "bb81b0e4dc9ebab4f2e471ec4b0dc6725886f951", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916878, "uuid": "ebe4f37d-9e48-4e7c-ba20-a8c083bad58c", "comment": "Malware payload (Formbook)", "value": "e759b6b7a917b401b27483d0262e237f97cb51b83667e68c6c1e7f79aaccbae1a3747340b7994c9f487d09ee40e2c845", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916878, "uuid": "8c987898-dd5b-4070-81f5-ee5435778a15", "value": "T15505120A27FC9B21D87E4BF9B5B40560473EE836B522F31E4ED560FA6C6AB504141BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916878, "uuid": "fbfe0443-6bcf-492d-9974-9040e6bcfd9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916878, "uuid": "866bc131-7687-452d-8691-6ea053a8ed17", "value": "12288:gCIZozxz0SNFJ75PGWLXJqnpQ9eyJnsIc3wwOfawHRr/CB06KuLp4bDDlG:gDSNFtYWzYpoeyJsIc3bOfawxO5d4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675916878, "uuid": "95e4890e-4342-467e-9d27-2e32e2ded272", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675916878, "uuid": "296fc2a2-d67c-4755-9345-5eea56b67a28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916878, "uuid": "05f69c97-766a-4b13-8359-09c50af66081", "value": "e9565aea25722423e054792af30cdc76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8126fa9-a80c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675900890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900890, "uuid": "81fcd03a-584d-4344-888d-b69780c9a1e5", "comment": "Malware payload (Amadey)", "value": "c196185b27bca57eebd0aa15d92576fc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900890, "uuid": "bdde4413-bcc7-48dc-8d5a-a255985b62ba", "comment": "Malware payload (Amadey)", "value": "0b06a6f26dded0c9fbb6fcfaa09fb4c20f762bd879df9018fd86a07f0bdd1550", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900890, "uuid": "16ab13c9-f374-459b-bfe0-d35895021e7d", "comment": "Malware payload (Amadey)", "value": "52a4151cecd29480e109c09c503f2b97df138c07", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900890, "uuid": "75780c9b-2248-476e-8207-88227edc4d47", "comment": "Malware payload (Amadey)", "value": "8315b52c3b57234b2b2cbc423b29195e7405bdbf12b8e2c2e3fa91d5ebb3f9ddc6125250a62f0773e8eac91bb00bd67f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900890, "uuid": "5d51a8d5-bd6e-465e-8840-b9525a966d45", "value": "T179C40207A7EC8032D8F557B028F503C31636BE619778826B778A9D6B0C726F4A635727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900890, "uuid": "ba709ab7-81e4-4dc7-9de2-2afcd409b10f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900890, "uuid": "10c7698d-1b18-4388-ab82-fc255f937bcb", "value": "12288:rMrmy907xwychxzGQupp2NWeAtmaVlYDQIcLAFGWwUo:dy8+yKaJGEeiWDQJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675900890, "uuid": "bc836018-b9e4-446f-9419-10f61fc21d2b", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675900890, "uuid": "9e7bf204-68a1-448f-9354-ed6e824256b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900890, "uuid": "77deed4d-2a03-4e52-bc7d-dd57bb0b0cb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9309c6-a86d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675942591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942591, "uuid": "ebeef581-72a3-4224-8063-a7f84706967b", "comment": "Malware payload", "value": "c368ec01a1505a8050994650bee8237e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942591, "uuid": "c6078d7f-1363-4ed8-b2d8-282c77099c3f", "comment": "Malware payload", "value": "0b306ab208722fb1114e9c513e4f86a95a51c620d3b0d3edb17473fe3867d039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942591, "uuid": "b70ebb95-99fe-42b4-99af-6ccea4cc892d", "comment": "Malware payload", "value": "6a406c09b835dbef27421e484d3c91c1e18e43e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942591, "uuid": "c4da9a86-5050-4e87-aa68-982694ad70e4", "comment": "Malware payload", "value": "bb98d282086630d2eab3306d9e3ffb9b978979349807857fd070379a81c009f890e77a47f04357db307020a37b194022", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942591, "uuid": "e96bf33a-c0b2-417d-80a4-2d8edd76bfc3", "value": "T1D6C37C5178D0C072D46629314878DAB05E3EF9340E749EABB79C167E5F302C19A39EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942591, "uuid": "df3097f1-c608-4d5f-873c-a486d3b3e7d1", "value": "975cca30fc6fc8cb327e3c61bc677b38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942591, "uuid": "18bf354e-f1cf-481c-a31c-da354f4a428a", "value": "3072:FhfSAPbxJt8vSRbKc2lMn/ez7W1YyqDzkydo/8NiEXIgdKPvMaDAi:fJJtBYcpn/ez7pzkCixAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675942591, "uuid": "e227caa5-67f8-4e2c-a560-c91b63a29d22", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675942591, "uuid": "ae237e3d-7a8e-4879-841c-31bb218a51c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942591, "uuid": "9608ac96-7809-4afc-a223-aabca8e39ff9", "value": "SecuriteInfo.com.Variant.Jaik.95172.12575.20655", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88102be-a847-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675926124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926124, "uuid": "a21c00f1-b487-4fb0-88fd-9751c1df7d56", "comment": "Malware payload (RemcosRAT)", "value": "4184a54011e2ebc0efd775fd1d71928d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926124, "uuid": "42aa22d0-8c96-4893-9ddf-4a3222c745a5", "comment": "Malware payload (RemcosRAT)", "value": "0b801f372647dee83d3d425117fd5c9ee08bc4cfeba9e7d742b89402bc251e0b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926124, "uuid": "85d850d8-1783-403f-b0ac-44a9223c0e42", "comment": "Malware payload (RemcosRAT)", "value": "e39809010188b08c73e9bacadce6d2fa9269af79", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926124, "uuid": "71d24c1d-6305-472c-a3dd-4900b7a03cb3", "comment": "Malware payload (RemcosRAT)", "value": "c3c980bea5046c445d669302c8dca0a9828e4ba45f8abb6ff39196bbe3b54bf032c202d38b5608f50d46b093b3bb36a1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926124, "uuid": "2f129f46-c188-43ce-b56d-07b3d719fc2e", "value": "T1BBF42326F0A5F5D6D65F25E381852B6186381E3E832B6D3D8C39F6BC5B92D383910DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926124, "uuid": "7947a17b-a9b5-4c61-8de8-be7f2d595ba4", "value": "12288:nVV0P4t1YbCpl5UEUxpOj/tvXZzN+e74JHfBld1N1D5j+c7FCVNEU5FESQmrivTU:nVN1YC1UE8pOjdVN+e74B/J1DN+e2H5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926124, "uuid": "38b976a6-f92d-4d2f-b8ea-fc513c639941", "value": 775993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926124, "uuid": "cc7c8d2e-a9f1-4778-956a-e5ca23097f76", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926124, "uuid": "1420faf2-ac7d-48f1-9a64-4d145dd45bbf", "value": "PAYMENTXSLIP.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ccf3a11-a875-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675945673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945673, "uuid": "e67da163-5848-46f0-91db-1d99d96254a6", "comment": "Malware payload (Loki)", "value": "2c2a9dcfa9fbb8ed1c44a11e19afbb58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945673, "uuid": "5efee433-2cc9-4f3c-ae01-846a2b5aaeb7", "comment": "Malware payload (Loki)", "value": "0c32ffa8a2b91fe822e28dea19b2f2cd1f10c4821a8d28cf1ee298dd401da405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945673, "uuid": "7b43edd3-b235-471d-acc4-224e79683784", "comment": "Malware payload (Loki)", "value": "f7f279f9a9af32795e996b015740508385c20182", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945673, "uuid": "836ac80a-961f-4584-8bf8-a2edca8c52e6", "comment": "Malware payload (Loki)", "value": "54f8fcf5c3fd1e08935652b50cec8ca1e7232ada2e92296b0c12510d4becd80b4fd588f93479711770c51322c8d3b64f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945673, "uuid": "3cd8f58f-4b1d-4c53-8c61-c637626ad7cc", "value": "T18464AF2276D0FC60F91A0636CD2ADBD4792EF8F28F3C735732C46A1F69721A0D566219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945673, "uuid": "71ff7417-0c38-4b66-964a-6394cae32438", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945673, "uuid": "6a453c8d-de3f-463e-9291-a45edb61436f", "value": "3072:yIdE3CLen81R/9fLRmNpHfg3rbUVm/HiPFXFnyuVpSHAsm0+L4Oi/XcLY7VNr/UT:WyL31R/cp/g3rgjFLplsm0+MOKXpLUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675945673, "uuid": "14e7761e-19ef-4046-9509-2deb269c549b", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675945673, "uuid": "8b8ec0ac-2835-45d5-baf7-bd9cd081faab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945673, "uuid": "ce821de3-373c-4345-8e6f-d7b2a74c841f", "value": "0c32ffa8a2b91fe822e28dea19b2f2cd1f10c4821a8d28cf1ee298dd401da405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517a30a4-a88d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675956042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956042, "uuid": "e98f0fda-920a-4033-89a1-47a78773759a", "comment": "Malware payload (RedLineStealer)", "value": "30132c45c2305b287d96a3ad8158e9e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956042, "uuid": "c469253e-acd8-4711-8e51-1aadeca3f81e", "comment": "Malware payload (RedLineStealer)", "value": "0cca99711baf600eb030bbfcf279faf74c564084e733df3d9e98bea3e4e2f45f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956042, "uuid": "46e28491-84ae-45dd-b1b9-4e55a3403c1a", "comment": "Malware payload (RedLineStealer)", "value": "c89477868792dbfc6abeb3016e4fcc542b01bea1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956042, "uuid": "8aa32280-8050-448a-a3bb-33ed6ad6bb6e", "comment": "Malware payload (RedLineStealer)", "value": "b11c700e9d95335213818ae71ecb04a7bceaad94d21a089ad0b51060de30bbcd25f99d2ffbaa49641ca1d56354be12e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956042, "uuid": "83a4b805-5b0d-41ad-a086-eac92a9002a8", "value": "T16504C61037FCDD11E1BA1A3F6961A05086BFD8026852F26B76C367DD1E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956042, "uuid": "106bc193-36ed-4bdb-888d-8ffb4f537664", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956042, "uuid": "53c7b91e-8d21-4c1a-a522-736764a4dd78", "value": "3072:+xqZWjHaJIppUsqT9U6eE5iKh6rxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOu/:kqZ3sqTGZKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675956042, "uuid": "d2b19680-ef7f-473f-9ec9-3e78d880f803", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675956042, "uuid": "64cb6538-987d-4807-848e-f04fc32c40c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956042, "uuid": "53bb61bc-8dc5-495b-a440-6d41976612b3", "value": "0cca99711baf600eb030bbfcf279faf74c564084e733d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ebda2d-a868-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1675940244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940244, "uuid": "02242e1e-abb4-4105-b701-05d4adda6708", "comment": "Malware payload (PrivateLoader)", "value": "6751ece6521d2c20be23a4855c958823", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940244, "uuid": "4c0329c1-5522-423e-b3ac-89c9983e7821", "comment": "Malware payload (PrivateLoader)", "value": "0cd8694a6d353aaf9b35ae711c0c9c49cbbd0f7f11c86a3c77168ca46d13538f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940244, "uuid": "e95c6605-7b05-49d4-962b-8fd6738bc47b", "comment": "Malware payload (PrivateLoader)", "value": "25d0de6b309e54dece4e7d7f8b1cfdc54b780eca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940244, "uuid": "a0cad4d6-e4c1-42de-901b-7d456115ea20", "comment": "Malware payload (PrivateLoader)", "value": "780fad2a9ea21d4fb11e9ea8405dc37996dc605a7ed0647a3f54fb88d8dd6677cbbc8812899d3581d4ed50310d0bceec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940244, "uuid": "d7cfdfd6-9a34-457a-ae40-c03d83df19f5", "value": "T12136232362711044E1F1CC3E8A27FDB431F64F969681B97929A6F9DD29728F9E213C13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940244, "uuid": "2e3a7737-421f-427e-9391-21d949e65807", "value": "f51724e08a085aa5e9f0970616ead7ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940244, "uuid": "d25a19c7-4cda-4d99-b450-9c8527f57fb4", "value": "98304:4ezYo0HRBYigZsa0BjkcC+BQSw6qvayvCgnWG1GlbY24B:4ez62tqhAWQSwzv9nr8hcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675940244, "uuid": "178bc84f-ddbb-4168-8c1d-12e979ac7cdc", "value": 5265592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675940244, "uuid": "77a78a2f-bfec-4c3f-8b88-bfd7e130e53e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940244, "uuid": "fb9a5ad4-a753-444c-9c33-499129919a48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c93ae9-a8ad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675969847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969847, "uuid": "0f9138c0-9e27-4193-8a60-ad33d711d2ee", "comment": "Malware payload", "value": "cf18a8206e7d5bd813c408c710c9d03e", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969847, "uuid": "a92ec820-fc20-4118-b60f-148ff0139fd1", "comment": "Malware payload", "value": "0d00c8955fec43dec4ce434afc6994acc832d63341ea757759cc8c446d350595", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969847, "uuid": "c185b4d8-2ed9-4ea0-a9fd-c9e11dcffb75", "comment": "Malware payload", "value": "7a8648dcd4950a9b9e0c80887b355e1a6aa0aec3", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969847, "uuid": "f6c23347-8f22-4aa2-85df-3b6395d12b9d", "comment": "Malware payload", "value": "fe746f92e379ce1c5d3c928ad6b44583c4b0ef7eda4d23d99f3140b145eeb3092b41a37e24a4a0ff4d467970d51b8404", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969847, "uuid": "1e72ffe0-1078-49a2-a3b8-2ae964e164e2", "value": "T117B16CF4A7AC00F51DED47BF97E8AA2AD0B6850C87D694C25E946405201D3DACCC634A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969847, "uuid": "1ba3c7f8-ceb8-474e-990a-eddf20119247", "value": "96:Dpm+CgMzm5CnTBzHYegJIc5oZavddP9EpLpgCkxdxHi74LItW9:dCgeoCVzMToZ2/6pgJLx+EGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675969847, "uuid": "aac2c17e-a4fb-4342-b3b8-c464b6b3f312", "value": 5172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675969847, "uuid": "a1933303-f1e4-46a5-b572-6099a85b3984", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969847, "uuid": "b59e33b5-a34e-42ea-80c7-e65c34219762", "value": "Agenzia_E3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad8b4ff-a845-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675925161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925161, "uuid": "8b13fc19-6462-46b5-a77f-d2bbcfb16a60", "comment": "Malware payload", "value": "e94fd62ea31d8a5c441bde59bf437bae", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925161, "uuid": "4a84160c-4945-4e47-82fe-ff0d6e8fd2fc", "comment": "Malware payload", "value": "0d4ff412df66d9fb0f092920fd71c579f6e89f63972f2da024a19845870aa06a", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925161, "uuid": "d2bb08a5-af77-4e35-9a7e-9b8ad66a2761", "comment": "Malware payload", "value": "b1879b138987d4d70de16af6f9c7f2b218961518", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925161, "uuid": "38829539-029a-4545-9865-6255db8e26da", "comment": "Malware payload", "value": "f49c10278855047aa08db1a1aa9ec9a34715e3f2567b73f6e6ada7b75b00e467d75e061d15232dbf9c2b110bf14f2fb7", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925161, "uuid": "227081ca-7fda-4602-bca9-f76f879d54b3", "value": "T14AD3CE0172E816EDE2F82E3149F63F674266BD62A52E073FABD1214D5DE0A40CD1175F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925161, "uuid": "8e074049-f442-4784-b8c4-8147e8375140", "value": "1536:RIOjciqwpusMOnrRKWDehU6BpAnMie6gac+cna4TMZMaoU:RIOgiJcsR9hyhU6UMn6pcxa4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675925161, "uuid": "9f656d43-df30-4b35-8a90-94e6ea894441", "value": 132059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675925161, "uuid": "ed2b6100-8318-4e22-8709-d4a255b3907a", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925161, "uuid": "b5f3f71b-13b5-471d-936f-0d561bc5d4e1", "value": "AgreementCancelation_658277(Feb08).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f5d8e0-a845-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675925336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925336, "uuid": "49731d00-ea2d-4493-9179-81fd4deac164", "comment": "Malware payload (Formbook)", "value": "d64a97131fde34e31298390555616f26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925336, "uuid": "5544da19-ea6c-4088-aa6a-4a798d5d17ba", "comment": "Malware payload (Formbook)", "value": "0d5a806b29974bb3d8dfbca057f84e27fdd5d087194bfbd19bb2386b62f8e304", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925336, "uuid": "6d335e1a-0186-442a-8b91-70114cc1ed77", "comment": "Malware payload (Formbook)", "value": "9ae01686dc85b185e718bcc7e8b362e13ca02a60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925336, "uuid": "7a1ddbba-89d6-49b5-845c-9f508fc4f6d0", "comment": "Malware payload (Formbook)", "value": "315f7a40063fd5ea0fed5dc152eece77e5e5386f52bc322c26b4f7ac16601d8da83f7592f4a348aa4b9fc3066d109fe5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925336, "uuid": "81ebabd3-4edb-412d-84a6-d313c99d08e5", "value": "T137E4023966F8895EE3EE077E29E1425553FAB0427163EB2D0F4974C00FB6BC04266B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925336, "uuid": "0ee0e7fe-a7cf-46f5-bed5-60e32e717d83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925336, "uuid": "0f24589a-014d-4da5-bc4b-76718cadbd09", "value": "12288:Ik3Xc03/WCeIlim2sERZwb4hJys6irudgkhhMg9Xv3hbQlQX:9d3/WCeMinscZwKJnuZhX5bQlQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675925336, "uuid": "996847e4-ea4d-432e-b101-0aa539f24b60", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675925336, "uuid": "0a527af5-b443-4245-8cf7-a6d22cd95aef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925336, "uuid": "6ec0a576-419c-432c-9b0b-634b4ab38eaf", "value": "DHL Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3939739b-a892-11ed-88f6-42010a9c006e", "comment": "Malware payload (Pony)", "timestamp": 1675958149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958149, "uuid": "8c39556f-3d9b-46eb-8b26-65e7d312a115", "comment": "Malware payload (Pony)", "value": "5238dd7a0a7059c33c31b96d77902e96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958149, "uuid": "043c8095-09b6-4832-8db1-2df822a43e4e", "comment": "Malware payload (Pony)", "value": "0d6005e190d1cc5392772eddddae8de253ad692b2304d9d184014452b604b377", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958149, "uuid": "f059f764-4b1f-423a-9696-8e5efbfc52da", "comment": "Malware payload (Pony)", "value": "47068c6414540df93022ca4d29e6078d8e3f71bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958149, "uuid": "0e2684f8-26f9-4d7d-a414-57dc9cc2c8a2", "comment": "Malware payload (Pony)", "value": "8591082c78978a78471b2dc021567e00161532c8280a994bbf873085631087a548dd530df98fe6571e197d364226141b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958149, "uuid": "3a1fb9a6-01f0-4c4a-b754-a4fac85d7c76", "value": "T1A78402B38BF9A578E148E730BE37549DF42BAC1CA1526E4A1188FE6911B4E0CF7D0B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958149, "uuid": "49217585-bfc6-4a14-9e70-df75898a7165", "value": "f2ab7bba27a321e6fa0ccda9ae4646c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958149, "uuid": "9ab0d72c-666d-43b7-9965-2dd1655274b1", "value": "3072:5UE93J7fU5y+TBqZq43GUC33qcUX8k5Rq1ufCBroK0gfx:B93N85+ZqyG13b6eXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675958149, "uuid": "f2e00a37-cab0-48d0-a994-936abfb7ac18", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675958149, "uuid": "2aa1b550-8d58-4ee2-8a8f-c571f71f20e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958149, "uuid": "a8fa180d-cb8d-45d5-8699-0d6e99abd709", "value": "5238dd7a0a7059c33c31b96d77902e96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4500c4-a8c8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675981344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675981344, "uuid": "c0470025-20e7-4109-9c97-2cb1ee3ebaa5", "comment": "Malware payload", "value": "5354e2fb7b8bd1b61aaf5e1465993b0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675981344, "uuid": "451f510c-189b-4ef2-96d9-c855d7d17d61", "comment": "Malware payload", "value": "0da965239af18982a0bdb7e657be95685279a0a4a5bd3f0320cb0965c91e082e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675981344, "uuid": "b7068aff-98fc-4509-a765-8feb8bbcc2a3", "comment": "Malware payload", "value": "14260b80479bba6901486d6a2d34dfa9af46d901", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675981344, "uuid": "8bad1c81-ed0a-4ef8-a333-8e62ee49221f", "comment": "Malware payload", "value": "64c56a4535e9a68d2102e59a65a9aab56800befb528a1693ee89a2dbcebdd793ba9b13630e50e8627c75329ac933a49d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675981344, "uuid": "db56f73f-8ce1-449e-a909-0867634f4e46", "value": "T18514C02E33C8E832D472B2316E35C1B16B7DB9314E385AA77758262F4EB02D19B76345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675981344, "uuid": "2f9b7858-892e-4dc0-b275-f77c3270cea4", "value": "3ae714bb16df7ea6110fd4db3c856d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675981344, "uuid": "2dd8d2b3-c426-4bf1-ad5b-c7a59e4d4b03", "value": "3072:smvn09mEYLARRA9wH4Fn8bTZ6zOuLL0yAxvcSLeTpEjtkPm:sm/0wSRy9wH4FKZS3PHe9wp2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675981344, "uuid": "a201ceda-25d9-4969-b155-93f889001f93", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675981344, "uuid": "b328d11a-8ff5-4656-803d-1a15a0cb7a25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675981344, "uuid": "c0a81264-56cd-4903-8a28-967af379e37b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c080845b-a862-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675937760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937760, "uuid": "7d8bde76-dbbf-4ac8-bf7d-6b53267036e0", "comment": "Malware payload (GuLoader)", "value": "68a4d5e4c541961d428996136e9739aa", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937760, "uuid": "0e1889f1-2ba5-4d68-87f2-5f59e00590b7", "comment": "Malware payload (GuLoader)", "value": "0dadaf0eb1832bfa87259ffa7481ab5cfdd40455dd6643858f856afceaf17c14", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937760, "uuid": "21923a57-12a1-4aae-8ff8-5cbc99ffb613", "comment": "Malware payload (GuLoader)", "value": "ac722c0b712636eb7efbd995035dd149311e0ee9", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937760, "uuid": "02df6567-1491-454b-8845-5e4818c70d86", "comment": "Malware payload (GuLoader)", "value": "60fe8eaac5dd3ce213a159a4e67605bbd522f17ec66233a740fd1091ea90c28896675d1fdfe4e2b8da56cad2914a4396", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937760, "uuid": "e9990722-f271-4736-9f05-fae60bc0ecac", "value": "T1A833D621AF852864064B23F7A95B3B75FE391CF66531D0F92C6CB3951B03358AE2F606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937760, "uuid": "31f35354-eaa2-46d3-86bb-10efa9f3abf9", "value": "1536:Y7ApYVwpqGY8n/pevDkFwjYkRaSQSAykbhATO4RWKIRJRa:Y7ApYVIsvDkajJUSaxF4Rj2fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675937760, "uuid": "6d5e8148-108d-4415-93fe-1dee7a55b08a", "value": 54372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675937760, "uuid": "f5289b93-e09b-4205-8c17-d97338d7fb9c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937760, "uuid": "54cb6fa0-a82b-42b7-9222-6330d14ae87e", "value": "Articoli richiesti.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3f1142-a8b0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675970964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970964, "uuid": "4977aa2f-1e57-49ee-845d-8da308a29d8a", "comment": "Malware payload", "value": "512479aa12e9b6e39ff542e3bf0779ae", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970964, "uuid": "31cd6fe7-538c-4a5d-a65e-39a0b7d65902", "comment": "Malware payload", "value": "0dc9de05071add15e36841ec195f0d98ad891c1a17d9497ce87e9bfa1902d7bc", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970964, "uuid": "d916f190-1732-46c2-94f2-36d89d1f989a", "comment": "Malware payload", "value": "ef2ab935000336fb9188fa3347a11ce5af501e89", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970964, "uuid": "d34b8d96-0997-476b-b776-e7ebbcf2c164", "comment": "Malware payload", "value": "11039e211b8dcb953aa4f2910f90f4a7f95742cd0bf9a42cd8790441afdc9a0dcde8d68d3d930a4360ceb653f94549c0", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970964, "uuid": "8bec05fa-c94d-4607-ac1b-ca1f77e7e3f3", "value": "T1B5B19F89741C34E8DAA074B887E50DD7D27311A79B8A1EB50CE0D072D3A05D2DEA20DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970964, "uuid": "de809ff8-c179-4499-a09d-7548cb2ec642", "value": "96:upm+Cg/E6uecXleUzsoYLGfDDXv7hQ39wnbKsJXeg2OXj2IcVQC1qCRPanQ:QCg/vaEHuPXv+twnbkg2QSIc3QQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675970964, "uuid": "5d29b480-edc1-40e0-84bd-e71764fb77c7", "value": 5202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675970964, "uuid": "d02d14da-629f-4aba-bf76-ad4272d11e31", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970964, "uuid": "814a0f03-2e65-4a29-a4d0-d26a4c3dfe2a", "value": "Agenzia_E2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ab588d-a82d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675914928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914928, "uuid": "09b1bdf0-3f37-445c-ad07-a5022cb1c651", "comment": "Malware payload (AsyncRAT)", "value": "6662a4fda7458c38236d102649d40226", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914928, "uuid": "ba85079d-5dde-4b66-8aae-516491a063f0", "comment": "Malware payload (AsyncRAT)", "value": "0dd041b802c6bdea3c2399431efd91fe58c59b68f1e782b6ec0acb8af32ce811", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914928, "uuid": "fe24e52c-326c-4ec6-967f-8b467ea89cec", "comment": "Malware payload (AsyncRAT)", "value": "240b448af441ebbd84c8803bb4aa7168d6358cb4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914928, "uuid": "c7f2560b-0b68-41df-8843-d51111b717a0", "comment": "Malware payload (AsyncRAT)", "value": "715764d61fa1a3e808eeefcc015f72a68440c203a607ea22f8535d69c8b4460f19f02502b705238f90364f55ca308405", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914928, "uuid": "2055f080-b2c9-468b-b169-89d96c1a76ff", "value": "T137231B003BE8812BF27E8F78A8F26145867AF6773603D64A1CC452D75713BC696426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914928, "uuid": "89d85302-869e-4828-a2a3-9ae18fb5477d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914928, "uuid": "b4145753-cb91-42f8-8678-d86ccbbaab40", "value": "768:Xu6vdT9slTJWUhCuzmo2qL4/T37EcMOPI0YzjbxgXyiEqgzbwS+ySK1BDZPx:Xu6vdT9W52XFM30Y3b+X7EqgPZ7dPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675914928, "uuid": "71bea3ae-ef19-4d47-ba04-76b69cb0d087", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675914928, "uuid": "71503afa-40c8-4c28-9657-2eb3cd3afcea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914928, "uuid": "d966f340-cc83-4552-9f9b-52bdcbffe992", "value": "6662a4fda7458c38236d102649d40226.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a0e6ca-a815-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675904785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904785, "uuid": "6d9d845f-ba49-4bc2-bda4-df9fc2440432", "comment": "Malware payload (Mirai)", "value": "1caa5691094082b49e8cac72e5ee6bd9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904785, "uuid": "39c89089-d96a-4363-bf26-ff8265090efd", "comment": "Malware payload (Mirai)", "value": "0e7c1f0e56c9d5d72e99f754a1a000960ad42ae69e96b4b00d7ed572a502f154", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904785, "uuid": "9e794f2a-0fa2-4928-af25-61953625c638", "comment": "Malware payload (Mirai)", "value": "46be9ef8146ce76d0bcd383fa5bde7525c8517b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904785, "uuid": "2f418efb-bf16-4d79-9318-0a1c966c7ba4", "comment": "Malware payload (Mirai)", "value": "37d2f5fd30fff0261706e4bca331b305dbca27300d1eb02fada580a2c588402648eb89298bf18543bf4cdaf6206bf861", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904785, "uuid": "ab64a715-a4fb-4cb2-812d-72e985c4955b", "value": "T122A31896F8418A12C2C215B3F72E56CD7B2603F9E2DB31039A251B617B8795B0A3BDC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904785, "uuid": "78f252f0-ba7f-40bb-8009-7b7fed611764", "value": "1536:J4Baj1dDtMcVpW19faDGw6/oMbSFUvignrOUIpvTbW:J4BarNV81IDGHGjgwnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675904785, "uuid": "e85b3d61-24a0-4e42-a0bd-e29b6291d795", "value": 100172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675904785, "uuid": "2e155a61-b749-488c-9db9-47dfea2ba3b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904785, "uuid": "4ac1c97c-2549-499b-a522-9bd01c247f47", "value": "1caa5691094082b49e8cac72e5ee6bd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af346d6-a878-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675946905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946905, "uuid": "939a67a6-d616-4bd2-abf5-f92345bc00d6", "comment": "Malware payload (LaplasClipper)", "value": "3614f71262e063d48226b3271dcc1170", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946905, "uuid": "ec345f0d-f3fc-41e6-9f34-221a4fdc9e4e", "comment": "Malware payload (LaplasClipper)", "value": "0ed511322e4229b80c693f44bddfc44a351b3986d7fd14026ffd1f41962d734d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946905, "uuid": "60b96df8-7427-4140-ad52-f54737288292", "comment": "Malware payload (LaplasClipper)", "value": "c8842873b2ef1d8ed07fd057afb7412ee6e81a46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946905, "uuid": "60e3ef7f-3c75-4e05-af81-be5a9d825001", "comment": "Malware payload (LaplasClipper)", "value": "72784dd198a628805f5b92237ad3c66365fb7fd0fc9a6f0c75cfaab7b1dbfcb9d61c66791019943eedbcde87855eedb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946905, "uuid": "d1d53715-4601-4295-9f16-eb2117e1e09b", "value": "T1BF85336BB684D4F2C87A1930787091F875FAF870C3B45FDBA78D53DD5D609D06AA8202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946905, "uuid": "ae34102e-226f-44e7-8b0d-4ac1b1a166a6", "value": "83d1b8095e33f74e23ddae505b88bb37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946905, "uuid": "cd03b797-c168-4a87-afaa-a55271dc0340", "value": "49152:mve24kPgAjmOkNIYVJ/DXMDZvpeBH+tm/kJ:WVaVJ/DrBHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675946905, "uuid": "609913f4-4e6e-445d-a2a8-4275568e1a28", "value": 1873920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675946905, "uuid": "eeba3f2d-5ac7-449a-95ae-0bb3cb013f81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946905, "uuid": "6c188b39-52b9-442d-aef4-70361ac1597a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de3aaa2-a81f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675908792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675908792, "uuid": "d71229ef-dfaa-49d4-b480-b270457dd2ef", "comment": "Malware payload (Amadey)", "value": "bc8f0aebec90edcc4c10f2d3b3d8522c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675908792, "uuid": "dccab57a-6ab0-4897-9b72-29369d5bfe5f", "comment": "Malware payload (Amadey)", "value": "0f219b505b4f66edc76c83b3ed067faeaa2d3bd8881a76e415a96b44d8906a5b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675908792, "uuid": "51f900cc-5ac4-4987-b3cd-48ad132f096b", "comment": "Malware payload (Amadey)", "value": "2aeeba4fe281a95d1ad2b49481cc9a4c2190e7d3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675908792, "uuid": "933b86f8-efe0-48f6-b7b4-6050064c9b80", "comment": "Malware payload (Amadey)", "value": "852994cbddf89b1d8d54f34a3d9139bc2bd4462019fa805f4dd838d72fe823ea920f4e9fd413079971e772a98e4bca25", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675908792, "uuid": "cb0f7954-2105-4f9f-a452-5f20b1046e76", "value": "T1DEC4021BE7EC4033E8715B714DF203D31A37BE915738836B664B695A0833664A63276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675908792, "uuid": "9262f69b-fcf4-4c41-80eb-4aca32d00fb1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675908792, "uuid": "99a3b3bf-c590-4c05-a751-cdf831584d92", "value": "12288:nMrfy903BTBQc7BT8zed8UqE9iYAVmmnL3SjZIN:8yg9X46eWuFDOiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675908792, "uuid": "88959a15-3c09-44fd-a7f7-af39d07b7866", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675908792, "uuid": "58758b1f-92a5-4154-8bee-c3a66748621d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675908792, "uuid": "b8c74aca-8dac-42b4-b49d-06b46b2f1513", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b4ff65-a811-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675903064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903064, "uuid": "3f269727-9359-4975-a275-921bf43aa2e3", "comment": "Malware payload", "value": "6656a9d5c2e260015f0c6d50a19ae662", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903064, "uuid": "339b1fcd-c648-4834-8a70-c4eeb7a1e75c", "comment": "Malware payload", "value": "0f25622ee13a790ae2549bff82218e83e4d4b3a2a321e928bddb33ffb18d20c0", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903064, "uuid": "51afe0c4-3bc3-420d-8198-d592ddc3efbd", "comment": "Malware payload", "value": "d11aedc2c8cd27e5fe960cb49a33787abd71e117", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903064, "uuid": "503855a1-dbed-4e4b-9fb2-db9c3667752f", "comment": "Malware payload", "value": "014eaea0c3a7e993808fff39b1fb85714c68f9febbd5025a8319864ca5299589086769228f6d4b319f8674c37a784dbc", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903064, "uuid": "120c4fdd-5ec7-4590-8c10-4c504988c3c1", "value": "T1B8A4233031A15154EC2CDC744552C69CADA2EB12205EF4C4B7762AFF2BF09E295A2FE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903064, "uuid": "a311e66a-4913-4a82-b097-384b7a3fbf0c", "value": "6144:4Z0QZluygSDEUbWti+RgpYdd/sajSREwUEYi0/Z8479vuoPzZmd50Omh7MweCaQU:4Z0oluyrD5WdRgsTuRiVi06YEj4Q3KIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675903064, "uuid": "f9110edb-da48-4249-9d56-bfb0c8d63caf", "value": 469720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675903064, "uuid": "d428efd7-5673-43b2-8816-48224f4a4824", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903064, "uuid": "e2cfdf47-2dfe-466a-8794-1ecb6eeefe34", "value": "st4rlightarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4b898d-a832-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675916975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916975, "uuid": "a2ff8b8e-509e-4a39-b472-591c3f40025c", "comment": "Malware payload (AgentTesla)", "value": "2ac28c54dc45653738cd9c89a43a82f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916975, "uuid": "e646b839-b292-41ad-83d8-a710a35f76a4", "comment": "Malware payload (AgentTesla)", "value": "0f43506114d66c47dd526e3688d0759830031936a73b4814443fec2f7ce4e4ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916975, "uuid": "6df45e6e-5666-45cd-ae29-5b46caff8ed1", "comment": "Malware payload (AgentTesla)", "value": "ef5e11aae3f08502dc59583c651edb397f334c6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916975, "uuid": "2276b981-1a77-4fab-8771-83756a0837fb", "comment": "Malware payload (AgentTesla)", "value": "4b07c8b15d594bcd4e79f08c14e828513bd7351bbf6e51f82e5755ebd75afa782fc6c45e4607ed791ff09fc2e74ce069", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916975, "uuid": "c684605d-d80e-48b6-ac01-b5eca1646aad", "value": "T11D2512106618DB74D45847BDC9B18AF057BA5EB5EDA0EED73EC2BDDE7A327A040006C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916975, "uuid": "8d32a001-7743-42b6-b11b-a31947d41bd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916975, "uuid": "19e4b03c-e318-4129-a1ac-9d51e42305bb", "value": "24576:71bgzPGhgzfYgwMYeW75O6tIHaf0M1jtAaHhcp:7ZyPyywgwMYeWgqgaf0opAScp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675916975, "uuid": "661eb7a1-93f4-472b-9c08-e6843aab8c70", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675916975, "uuid": "49beba0a-6eb5-49cd-9d0c-2abcdd307ee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916975, "uuid": "ec517864-5437-4512-a765-541be7b7ff13", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160cb4b5-a816-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675904833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904833, "uuid": "665570b6-bf34-4b94-acaf-edf83a14eab5", "comment": "Malware payload (Mirai)", "value": "d306aa4a457ae212cf945ebb70c95511", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904833, "uuid": "92a8de26-510b-4820-a957-c5f1e6df8450", "comment": "Malware payload (Mirai)", "value": "0f73814105606a5168b2c3daf504ad770e72df61d0d3be8927ace1fa8908495e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904833, "uuid": "16c6f07c-676a-4bca-ab32-31318bf1315d", "comment": "Malware payload (Mirai)", "value": "115be1e57a10519adcb93d1fa9d8c938aa62dfe9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904833, "uuid": "f4df9e2a-78e9-4a66-b863-929dfdf8db3f", "comment": "Malware payload (Mirai)", "value": "a0f204cd873da3205a70817e5880ad2f9fce917781740818671446b7cbf6781a8a7443430d44b4b8fc9f2b818ee0aa0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904833, "uuid": "c4390f5b-3423-41f1-918a-3c23c79775f6", "value": "T1C7A35B03FA0C0A43E1520DF13D3F2BD5E36A96E212E9B145BA5E9A51D272D3312A7FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904833, "uuid": "202ac45d-2a84-4c10-bfff-2451154d2b58", "value": "1536:kSX8zejcsQ0lxq3E+y7xd0lXnCWgVrgd493PIVKSA:kSUYdklgVUdc/SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675904833, "uuid": "5ba8e436-7423-4076-8590-d12a6fde6b71", "value": 100272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675904833, "uuid": "e4ac1f47-39bd-4f2d-84c2-f25ae0803106", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904833, "uuid": "0e03f03f-ecd0-4c8c-b588-c396946ccb92", "value": "d306aa4a457ae212cf945ebb70c95511", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678e3e80-a844-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675924726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924726, "uuid": "7ae684f6-40b7-4670-9b2d-6518eec2edce", "comment": "Malware payload (Amadey)", "value": "a1c22e2240156d7986a9e210d31b25ee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924726, "uuid": "0d60134f-aaed-4f8f-8a00-ded4c3986c0d", "comment": "Malware payload (Amadey)", "value": "1052198cafff51038a52deb7943286122908f133721604d3c7d389c08a88b486", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924726, "uuid": "1fe1b469-564e-4bd7-83c7-a74202693b81", "comment": "Malware payload (Amadey)", "value": "5b9a43493d2b1f5fcb9b01f9fb4afa9487f73bc8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924726, "uuid": "0813818f-54ac-4a5c-81be-c72af9a10b16", "comment": "Malware payload (Amadey)", "value": "f0f458cad904fc217ed422edcb43b0ec1fb901d4a76a085cb9772c6b790410a29391eb2f9c09ea2a983aaf119885833f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924726, "uuid": "1930728a-a8ea-4f1d-8519-d8f37f268538", "value": "T1E4B402277BFD8125E8F8577019F603C30E367ED15E38C39B274A6D4918B21A09671BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924726, "uuid": "a09cfb06-ee3d-478e-86b6-811beee624b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924726, "uuid": "dd8c465e-d12c-420c-ad4e-67d4ae740825", "value": "12288:yMrWy90aIUgnvSxGRym4lek/wrN67tlqksp2:wyuTCHtMksY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675924726, "uuid": "c878c3a6-5edc-418c-bcb9-a566861675f9", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675924726, "uuid": "fca7db27-cf5d-4452-b0e0-e1d965197678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924726, "uuid": "54bd71cd-d22a-4976-a8bf-23fa43268356", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57961b07-a88f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675956912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956912, "uuid": "9381d189-567d-4846-9fc5-0e616c227ee6", "comment": "Malware payload (Smoke Loader)", "value": "3b4529d52a1398f53544e326b81ce65c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956912, "uuid": "c5b9830b-ef9c-4dbd-9d88-9dcb7f22e8a2", "comment": "Malware payload (Smoke Loader)", "value": "106ad768f637e05272dd6b4399fb8028755dbacb23d229f35ba7bf3e2d1dd5b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956912, "uuid": "bfd50a65-5e07-4686-818d-5e4184bb9d68", "comment": "Malware payload (Smoke Loader)", "value": "d987ff5fcdcf71a34e6208b6160a1f16819d1ddd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956912, "uuid": "fc810311-444a-4a92-bec4-4349f0080405", "comment": "Malware payload (Smoke Loader)", "value": "c07dc48777592cf472f2ba7e6386cb6572dfd5e5ad25b1f2f18317ef6b8400073594a81d7563e9afd7b088b6104f1bef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956912, "uuid": "a10e4734-7cde-4c5f-82fe-5a69d8fd52d8", "value": "T10204CF1373D0D872D43EB6319C64C6B1776EB8214B7896AB3738263F4EB12E09A76351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956912, "uuid": "a2419d8c-e034-4394-ab3f-a35ada6bfc26", "value": "910163c173a5611f34260e641a94d790", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956912, "uuid": "df2e3439-a841-4d73-99f3-c18534acfef4", "value": "3072:YbspyUmKqyISdxl7m+kcOa5TzkXhlwiHmCovxL+M5A:Yb1TtSnl7DOa54XsiHmCovwM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675956912, "uuid": "17048733-b356-411c-b657-3e60dcb594a5", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675956912, "uuid": "05f69940-ea21-4c00-84cf-399215655074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956912, "uuid": "7adda1df-6d86-411e-a39f-1a48b506020e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0e51ee-a846-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675925514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925514, "uuid": "3bb108d9-facd-472a-b40b-014ff5f22a8f", "comment": "Malware payload (AgentTesla)", "value": "8240a2d2e29d1e94864d04e129fdbab4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925514, "uuid": "cd3b7e4e-3598-4d6a-9f2b-ba5c3a93aff4", "comment": "Malware payload (AgentTesla)", "value": "10be0a18f4ee73fd9816b7b3acd31fc50cbdb61e3357751850887c7bbe53abbf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925514, "uuid": "f381bc01-b85e-4ad5-bead-0d8d53e9b94a", "comment": "Malware payload (AgentTesla)", "value": "8250e467db16ab6da8e5e68d012e5511f7196488", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925514, "uuid": "663a708a-4751-4e26-840c-68bedbc9ec4e", "comment": "Malware payload (AgentTesla)", "value": "01aa1e973dbc6b01dace8f22b657ca4a5026ad8996c5f4fe8d54f992d0ee280da41a15cd472171675ebf75ac38f91300", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925514, "uuid": "1f2c5cd3-9534-49aa-907c-24610ca07f1d", "value": "T11F64124981F4D0E3E5B357356DFA0F66ABB4DA150476D78B33009A05BAFB3809A9F702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925514, "uuid": "ecbcadc4-79a5-4d94-a048-356f6acdde42", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925514, "uuid": "606c8776-1d23-47c2-9ab4-411f72aaea09", "value": "6144:/Ya6ualxq8tgSQaC40sYV8LWOGsL1c11ImY8xx+W3:/Yoaq8CD0nLC20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675925514, "uuid": "0b2e9d49-a6d1-4896-950f-73120ab51d41", "value": 334666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675925514, "uuid": "aa80d69f-711e-4fb2-9439-37ff77a424a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925514, "uuid": "bee4454f-5efc-4558-8169-45be948240bc", "value": "SOA 7105294.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e31c51-a842-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675923994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923994, "uuid": "e371285c-1de1-4509-aeeb-e2964da05a89", "comment": "Malware payload", "value": "46c33b002df7853909d95f53ad8d460d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923994, "uuid": "0a77949f-a59e-49a6-8229-129c74694e8c", "comment": "Malware payload", "value": "110b4069773fe4e69a340846eae13a014e6d9046117c76e93e560beeb722d1a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923994, "uuid": "8e52efd7-ccb6-4394-acb5-7b979e97d32a", "comment": "Malware payload", "value": "5a9f6e97bc7987fad80f818c6d83ddd4a83e8ace", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923994, "uuid": "2bf9c6e4-b4a8-4bac-8cae-7f436a7073ee", "comment": "Malware payload", "value": "036eb935ae4618764017f88c904cef60b793ba9a2f04777a4e919d261f5008a48379e2736dd952ea243e3163144102d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923994, "uuid": "95d124f3-de02-4433-91aa-d21dd57609d5", "value": "T11676332039F1C8BFD63117B59AB16CD0EC66D6AAD623492333420D9E1F4F14DF91B68A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923994, "uuid": "d1efc76d-bf04-4e0c-abc1-0a639a8eb396", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923994, "uuid": "8137869c-61b6-40b9-b4b9-741315015dbc", "value": "196608:91ORr+iJL/IKWYK5/npwdfbwLf30YZ6DoPNeR:3OCKnK5/npKfbG3H42+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675923994, "uuid": "2d092ca4-a9d4-4752-b39e-3b16d34e795a", "value": 7617529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675923994, "uuid": "ce6139ce-b33a-4e9a-9d8c-3a6965a10f71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923994, "uuid": "dc532212-249c-4e8c-a5b7-b272601d6c29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e08b2b-a810-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675902489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902489, "uuid": "b639ea84-81c7-4f12-9c72-a92d033cbffc", "comment": "Malware payload (Gafgyt)", "value": "6107c4cf5868bb63e7fe16f86a6c2ff6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902489, "uuid": "f52e5b62-6d5a-4064-95d5-c66085116a94", "comment": "Malware payload (Gafgyt)", "value": "111e5e3914b7e33d6c182d9cffd07cf49bf55e0a92ab046ec01fa99d84dec350", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902489, "uuid": "5e7666be-9403-4a54-971a-59f02b531436", "comment": "Malware payload (Gafgyt)", "value": "daf5722252fbce84b16c5e47dbf00afa4c7f6aaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902489, "uuid": "585839dd-29f4-43cc-85d3-73bc5df8be23", "comment": "Malware payload (Gafgyt)", "value": "c722648f4f65484a52bf49002214cee233b97ebf2341a1366d895bcdf69843e0f56dd043f07cef91c5b93c119532dec9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902489, "uuid": "e124e492-3e9b-4dd3-b617-de3b66bfa678", "value": "T1D5B32901F941872BC3D327BAE78E479C3B356A9457D733016A397EB42BC27D82E29521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902489, "uuid": "98c79723-1267-41e7-a888-3d63ee02ee9d", "value": "3072:xhFJsRqE+epkAnniP3QdDmkorQOhPOCXMAX:Jaz+eKAniPimkorQOhPOCXMAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902489, "uuid": "4a5ec162-2031-4ae3-8f38-d93b3c90b79f", "value": 108598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902489, "uuid": "e0d6a719-e963-4741-b84d-f105cae4d70c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902489, "uuid": "8c699f6c-b148-408b-b671-289746c96016", "value": "6107c4cf5868bb63e7fe16f86a6c2ff6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671b1895-a8b4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675972829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972829, "uuid": "2956b9be-ce40-4cd9-9f08-ca970c9b9fb0", "comment": "Malware payload", "value": "f7da79ee2b6a82f5e6931ca66ef14c64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972829, "uuid": "f46261f5-2c83-49a8-b795-370301d9fc9a", "comment": "Malware payload", "value": "116b544b22e3e8a15e2cd1b7116d140010cd30df425ddca99f267ba32c1df82f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972829, "uuid": "4ffe7c1a-9abd-4bcd-a2db-af0b251731da", "comment": "Malware payload", "value": "22bd19b41f7cc7e69c7d21d42083c122329e0595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972829, "uuid": "91a18617-4838-483e-ac16-0e5e3c013bc6", "comment": "Malware payload", "value": "f70f8de88893f24a3455b975f326e7a89fc60292d8bcf022528abb8f3aeb6a0a81bdc6306bfe50f94ee5e8bdb767a725", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972829, "uuid": "64e4ddc1-3c52-4a93-84d9-565a7403e473", "value": "T10C04CF1272D0D871D432B6318DA9C6B57B3EF8214A789A9B3758273F0EF02E1D676391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972829, "uuid": "b2ed7454-4c84-4428-bb74-983c313b0525", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972829, "uuid": "24dccb60-5d36-42fd-8355-caf3b48be8f9", "value": "3072:hFgzPB9JzyU5/zK5DuAaMaaGLcn2SgNYQqmMNDPk/9pxAjb:hFujd5O5Du1e2SgNYAYP0jxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675972829, "uuid": "8654ce9d-a8e9-49db-8f73-44429294c311", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675972829, "uuid": "97283fa5-ad07-4d69-8616-926ef009994a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972829, "uuid": "2f2f705e-3212-403e-b746-63758d011598", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e4d722-a869-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675940741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940741, "uuid": "4c7102a4-269c-4f85-96e8-505b9d51a908", "comment": "Malware payload (Formbook)", "value": "098fb601dea1f992894b88ea6968a737", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940741, "uuid": "15dcf47a-3472-49ce-be14-4be963322721", "comment": "Malware payload (Formbook)", "value": "1191fd64818d7351c0d368ad69f0d0186adb1bf22cca517865a9944f9bbf182c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940741, "uuid": "abd652b7-b5e2-4cd2-afa4-92b198de7c63", "comment": "Malware payload (Formbook)", "value": "dc1550018168c978b4fd41526dbb393a9857d241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940741, "uuid": "ada1b27d-ec9f-4668-a68a-d6d11cf87db1", "comment": "Malware payload (Formbook)", "value": "e8458c43973abd5467167cf25707605eb2732c3564707fe5ae37b78940ddf947413121e252012bfb3145a3e4e622b71c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940741, "uuid": "10feb178-2cc7-453e-a4d1-ae0fe6c323ee", "value": "T17B642321739186E3E8935B712D7E4B950FBADA1B5C94CF1F0B10192E7E121AAE51F323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940741, "uuid": "724d90a3-2f1d-46ad-9609-995488e08101", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940741, "uuid": "9ffd808b-939d-4be3-a48b-3912fbad3f6b", "value": "6144:vYa6aOC76/A1yPoth4OWfIAYe+QpdQBvmuz3RkqDPzGA/:vYkOzI1yKyOUYnQpdkxz3RkqDPzGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675940741, "uuid": "39fe2953-0e8d-48e2-bf09-65ea1d7fb1ed", "value": 315296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675940741, "uuid": "0f106cb8-7f61-400d-b7f6-695cce1147df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940741, "uuid": "f2212118-77f0-412e-8914-ed6a99aa630a", "value": "DSG2011001_INV+PL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1ca4f2-a882-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675951254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951254, "uuid": "794ddb5d-5fce-489c-9d59-38b39922ff39", "comment": "Malware payload (Amadey)", "value": "1da09bef3175bd13696e68f705362b3b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951254, "uuid": "8bf539c2-c739-43ef-9788-484eefdacb1b", "comment": "Malware payload (Amadey)", "value": "121364dc634a3b6098a2477c96a0017a5236a230b6128ea1b3793212f696b88e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951254, "uuid": "8cd9af43-6789-4f46-a395-2bed6e81fbd8", "comment": "Malware payload (Amadey)", "value": "38283d5e6bb450645687aec8bb8133bfe2253d30", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951254, "uuid": "09395850-1080-48cc-af7c-a88dc3a9597c", "comment": "Malware payload (Amadey)", "value": "90d26cbf4266e96359d970d1bc011e37e6bff855053f00ad30cae826a66989cd1a4f4542533c6a3a490eff3eec1477c6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951254, "uuid": "ee180f88-5f58-4d9d-befa-aa7803aad5b5", "value": "T16AB4020BEAEC8072E9B96B701DF602C309367DA157389357238E6C2D1CB2564B53676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951254, "uuid": "f941aba0-1167-42ac-8fac-9d99ec873575", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951254, "uuid": "a7747c19-6ab7-4bf3-8706-149dd898122f", "value": "12288:eMrby90a5JxjT8BRfsja+2CYUOqRDiZcCZIRx:xyjJxjyGjxCHqROZcCZIRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675951254, "uuid": "b0c459ca-5cd8-48a0-b9a1-5eb1a869c947", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675951254, "uuid": "480b269a-cc5d-43ca-838a-348962eac8cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951254, "uuid": "4f2d68cf-198f-4128-b18a-e448e64aa6fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bcd9ee-a876-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675946272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946272, "uuid": "135f5f98-b010-4bda-abdb-8800776ccfb3", "comment": "Malware payload (Amadey)", "value": "4a9a75ff241d4695ad90759e9c5318c6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946272, "uuid": "e669b0b4-ece3-478a-982e-49ab6066b9b8", "comment": "Malware payload (Amadey)", "value": "12471d0b89e8850811bd013c0a8cc0ab16fa5069caf031e67673c65d47915830", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946272, "uuid": "9f20124d-2e5f-4bdd-ae20-9c37401b5d4d", "comment": "Malware payload (Amadey)", "value": "09600a96857d0ed850020a5ed5c01097ac7618ec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946272, "uuid": "48b6101c-d313-4adf-a5ee-d1e7cdeae477", "comment": "Malware payload (Amadey)", "value": "0c27e29e926af42a022c73336ad270b6aa6eba717fd872765480940479f0cfb522c4750e171db4b2b1636af30458a2bf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946272, "uuid": "2b2e3266-066c-46f2-a6ae-07acbb39c55f", "value": "T10AB4020BBBE84175F8B1537009F607D3063A7EA16F3483EA174E6C5A28725B4E63176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946272, "uuid": "607fc69a-1eed-4fc6-9e16-006989c4961c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946272, "uuid": "962db4cb-273e-4a41-9f78-140c1d771f23", "value": "12288:GMrdy90vBfrDsVAkanxhX0HaUxLvJLbFLuJVWBbVCHCU0:vymdcVi2jLdbFQoDCH70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675946272, "uuid": "62e27528-eeca-4f77-938c-087dc14a8aff", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675946272, "uuid": "fc2abf82-77a5-4ee7-9aeb-e710ad4d9af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946272, "uuid": "440f46e8-bb4d-4375-99e4-4a977ef9acb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da02eeb-a874-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675945352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945352, "uuid": "b51300dc-4582-4c12-aae9-c923b94acb17", "comment": "Malware payload (Vidar)", "value": "3216a63e1aa57934d9a253d2df681840", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945352, "uuid": "e63fb75a-799b-41bf-a1cb-c2508362f669", "comment": "Malware payload (Vidar)", "value": "12ba6e94a8bd29aaf0ea26a71a12e864bdcf737376d3855b8e15d345a58b7934", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945352, "uuid": "2b430836-e5da-4287-a5cc-2d7d9bb9d1b6", "comment": "Malware payload (Vidar)", "value": "4ee75b4ad495b7e6dc317885ccc9478768d3a5f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945352, "uuid": "b1f973e7-abea-433d-aa9c-376d57159a58", "comment": "Malware payload (Vidar)", "value": "e88bd5b13bdcb5d1aa84df61da8de109b6b30a4d1af920108c6ef69d798b3bebc16fa3774f20f496a2acdaa997b786dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945352, "uuid": "bd7ad6cf-668c-4830-8ace-0994809bf87d", "value": "T15714D03236C1C072C52B14705864EABA6B7EB9318679994B37B82FAD4F303D1673B356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945352, "uuid": "be8c67a8-cdb0-494e-8792-43dad7e768a9", "value": "83d1b8095e33f74e23ddae505b88bb37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945352, "uuid": "dd02207e-dec3-4608-8dc1-f63dc588a5f9", "value": "3072:DtyOzZpNXglSRjHFLM0FWfeh5ku+MUhfr2BX0UOPYQupoAYVgLWZDB2MocI:DtylEBFLPFejWUVyOPYfYV7Fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675945352, "uuid": "902afb02-fd7c-40eb-b3c6-67d86e2c1e8a", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675945352, "uuid": "92043905-70bb-45c2-8db6-96c8810b6898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945352, "uuid": "46f3d894-fc8f-4b48-bd7f-9389ffd0efe8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbd158d-a864-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675938699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938699, "uuid": "0d5dd177-d2ec-4fa8-baf6-d0f968e4c6d1", "comment": "Malware payload (RedLineStealer)", "value": "8f49da142ec1fb9f16cb580e4f974939", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938699, "uuid": "132f327b-165e-45b7-bbb6-388355c10530", "comment": "Malware payload (RedLineStealer)", "value": "12cb9de9ae87f9269fc9e34102882815fbe3d751665e64033d5bb6f4bae24a17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938699, "uuid": "bb0c7bc2-4167-4036-90d5-35470e60c500", "comment": "Malware payload (RedLineStealer)", "value": "072555cc5ffde9c7ced114b150fd32c3cca7291c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938699, "uuid": "a3fc601c-c92d-41e9-a48c-cb8b1b38ec2a", "comment": "Malware payload (RedLineStealer)", "value": "be5fc798c2dd4a5397917a0e8f7685137de21629d756a265d386e43155e6715fad4e351bf18c9b6637db8c0fa4177262", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938699, "uuid": "01528ce1-209a-4234-8ae0-2079a546bbfe", "value": "T1B064F13232D0C072C867A0785825DAA5AB7E68314574C99F7B5837EEAF312D1DF3225B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938699, "uuid": "6265384d-d3ec-4901-b7fd-029389ff7b8b", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938699, "uuid": "27dfdd5f-5fff-41f6-b74b-5f475d2b915c", "value": "6144:8qnznXVLV2J08ZP7E8p1i7TOGOwzUSmTRrycd:8qnzXVx2JBmKiXROEUSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675938699, "uuid": "aae1d866-2594-40d7-ab1f-6c3fb538b436", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675938699, "uuid": "8d0e2377-6814-4f47-8e87-d00ee30c7a9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938699, "uuid": "60571fd0-828c-49aa-b900-c5f4503922a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588822ec-a8b0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675971087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971087, "uuid": "2730bf24-e009-4689-a5b6-a61553b0cfb5", "comment": "Malware payload", "value": "2ac98a4ef687f9b551f754840ef3c2e4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971087, "uuid": "afbc41b6-be48-4c5b-9e2a-9fa1e2c3f054", "comment": "Malware payload", "value": "1359169eb4bd1f902b44ca3437a6950e43f9bb03673f6694272347672b9c3ab1", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971087, "uuid": "f5ed3e27-b77a-4016-9dd0-e7aa04a561bd", "comment": "Malware payload", "value": "c1ede7a06eb3165c2142af80a06914d2dfce74ee", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971087, "uuid": "16154dd7-afd9-4911-a62e-b959bf9d1009", "comment": "Malware payload", "value": "5541370a8802c6952104b44768f7866f435c85878dad892cb7cbf0dda8add7e5232f5f1f465fda3e59d19d01cb9f975c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971087, "uuid": "d44606e0-8091-4a9a-b1b3-95ab7213d965", "value": "T1AB852299F8A0232BF437C1F50670E7AFE24510E4E5B3611F78F49D0A18B8E9B5B5E189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971087, "uuid": "c78c78fd-2b1d-4f97-ba88-f4b22ccd37d0", "value": "49152:mEqH1Vu3fqCwXOu+4+HSPnFtfr8yyeB2b0X:mEm1KTLh4zPnFtfAyycL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675971087, "uuid": "2e160e4d-311a-4f63-bda0-c1a0601f54bc", "value": 1828122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675971087, "uuid": "be8d61f5-0cb1-4930-9e04-7e0e1c06c45a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971087, "uuid": "e02191ca-6914-4c6d-bba4-72d2e3b4639f", "value": "charsets.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9a6980-a88c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675955744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675955744, "uuid": "a0068fe4-91ff-43d2-af8d-e4a4d16a4526", "comment": "Malware payload (RedLineStealer)", "value": "80f708b08f5c1438d54566890c7908c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675955744, "uuid": "42751239-3746-4bcc-9a7a-610472347f46", "comment": "Malware payload (RedLineStealer)", "value": "137654c88ae7b0cb44defc0645e64f001c788c309d85edd8741a8bdf178184f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675955744, "uuid": "36c3bc9c-b24c-48de-8cc3-bdfa231e9acd", "comment": "Malware payload (RedLineStealer)", "value": "1cd6a3636a57060ee0428bde6388941ce94430e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675955744, "uuid": "ef9a9805-fa56-49af-b38d-cb2946b0a578", "comment": "Malware payload (RedLineStealer)", "value": "2346b9966f7bedfe3707d53fb77b75eb5d6cb491b518d2c32168aebd4dc1f0796df30b7cc009820278d822035d5d1178", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675955744, "uuid": "a3293feb-632f-4738-a1d4-2332ae6ece71", "value": "T16EB40207F7FC4135E8B057B01CF606D31A36BEA16B38879A234E9C5A1C72670A53676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675955744, "uuid": "0112f9b9-d803-4a6a-8698-7468043a565c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675955744, "uuid": "0b79972b-32dd-4853-9fea-27be462275f4", "value": "12288:eMrNy90E0qSeVhf1n3Y6geEwtbWNhH2IJTUZr:ryfZV5JZDtbWnH2WUZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675955744, "uuid": "ae6f5bab-0e69-42d5-94e6-64f9447cfdff", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675955744, "uuid": "0e6cba2b-66bb-4f31-930f-f56d2f2e9b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675955744, "uuid": "d21e8e7a-3928-4b87-a47c-902def6ce407", "value": "137654c88ae7b0cb44defc0645e64f001c788c309d85e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c865b1-a832-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675916856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916856, "uuid": "0b947e53-1d8c-43ab-856e-31ea41fa7bac", "comment": "Malware payload (Loki)", "value": "fdb20bd07c5f92285889e67be255950f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916856, "uuid": "14c071e5-fb48-47a8-8788-e70c8773dac8", "comment": "Malware payload (Loki)", "value": "138a5f951399c688c4f860a1d5ab27a187ec6498720b538b269a343b1769127b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916856, "uuid": "6d8dda3b-f0ff-42f8-bb98-3644731e7974", "comment": "Malware payload (Loki)", "value": "8fad6e560fca0c9e128684d123947bf9a196afac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916856, "uuid": "173e4943-f7d0-4613-ae6b-d543eb595103", "comment": "Malware payload (Loki)", "value": "15b3285a89d7605f09527776b6e6e66d2fb5bbaab50cd60dcffadbaab58451e050aded32ec6a00407630e74728cee21f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916856, "uuid": "acb902dc-e543-43e1-9a43-da6276ae63c3", "value": "T1DFD4023936B88A6DE36D47BD59E1020593F6F582B193FB290F4C74D01EBABC0455BA23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916856, "uuid": "1712a077-3f52-45b4-8d3d-2af3a658d025", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916856, "uuid": "3ec3a544-096c-41ec-8c6f-116201dcb0cc", "value": "12288:mWakXftnekh95bJGwxKdWyh+dhPcAzKoVPwQlQX:dFl1Pb0wxKdRYRckKcwQlQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675916856, "uuid": "c5f94d53-89b3-4703-91a9-cc2888fcfd41", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675916856, "uuid": "49b94abf-c79f-4379-8148-8d00734716eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916856, "uuid": "99b0d21f-50d8-4492-8ddf-0c3b6be03ac5", "value": "fdb20bd07c5f92285889e67be255950f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e1c03d-a88d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675956283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956283, "uuid": "7cf48216-4b0f-4d71-a4d0-e6f01024f183", "comment": "Malware payload (Tofsee)", "value": "b7b237cd994f3dd0b83b901450728340", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956283, "uuid": "3e54219c-1413-45f4-95c4-d8f49700596f", "comment": "Malware payload (Tofsee)", "value": "13cd681d7e45bc2d09e19b295c64b4385fe309f71bb6032a7c9121c1e231ceaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956283, "uuid": "5e1cb430-42a8-441e-9a7e-08d43b50ed3b", "comment": "Malware payload (Tofsee)", "value": "1b439bbcca8b4aa3d69304a39e358f59a49b1859", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956283, "uuid": "1c145ca7-29ea-48a7-b84e-4b19ac3a12e2", "comment": "Malware payload (Tofsee)", "value": "7ef6499ee8ae0785e44a32e81317cf76b1c7a2d822313cf58ac2c4aef86d87d789dea90f06bbea2b2f291f3101d20e98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956283, "uuid": "a05c95e5-15d5-4045-9094-4c53ce06332d", "value": "T13F04CF2232D0E871D432F6319C65C5F43B7EB9214A785AEB3B182B2F4EB02D19B76355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956283, "uuid": "2c308618-b0bd-4bbe-b641-5290bc4e48ee", "value": "910163c173a5611f34260e641a94d790", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956283, "uuid": "99332dff-0eb6-4a00-a8a3-3b9b80764dad", "value": "3072:xfQRIdfbJ/wS7Oi93+h6dhSjqYSs9XQ1RAU:xfj9OSii9lPSGYSxRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675956283, "uuid": "a7491e97-faa9-4cda-b393-5b002cbeafd5", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675956283, "uuid": "b5db8012-1a25-4734-8a47-626989c7513e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956283, "uuid": "39ab3c4a-073d-4cce-be6b-2fd5bf9bf541", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6450eb14-a84e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675929016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929016, "uuid": "71cb4006-9a38-4fde-9a40-3249699cd48a", "comment": "Malware payload (GuLoader)", "value": "8648551770f76791d37dc58347dc24a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929016, "uuid": "3f96f793-524f-4014-bf95-9ca19dde15cc", "comment": "Malware payload (GuLoader)", "value": "13edb5deda2aadf555a23288a6d7eeaf2c5d0c249a71cd6477b7418236b8025e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929016, "uuid": "c7eec4e5-d8a9-49e0-8d66-7f90a2b99513", "comment": "Malware payload (GuLoader)", "value": "6b3f4cf489b44e346746b055a7aa24c7ee0b2582", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929016, "uuid": "c10b944a-e16c-442b-8382-50327f804a73", "comment": "Malware payload (GuLoader)", "value": "61f7eb2d93b11555f77dc847155bf593d041e22c748f43add078bb48fe06e7856cf8f87b45ef418235cadbbc3aee625f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929016, "uuid": "20ba6fca-056e-444c-9aa4-ac3fc95a910b", "value": "T1CFD4F1B5FB14E80BD5590B380C85D2655A20BE403D64C96377E3BFAF7E7E2C2B91508A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929016, "uuid": "5c048c68-1fa7-4d16-8224-d26dc2e9c570", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929016, "uuid": "e2195777-4237-4d6b-8897-e1110396bc48", "value": "12288:Ebif/mHZzu6uhuQgRN6Zuj90Z2upnDOTcML0PpSRPWn6EUVRDpqnuK:Wif/mHZzutuQgHt90TnDOTNoPpSROn6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929016, "uuid": "09f706fc-522f-42b8-a89a-26c4f1423fa3", "value": 638488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929016, "uuid": "d57a563e-1440-460a-8097-130320ef2f01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929016, "uuid": "20da24dc-e8c9-4203-b1d0-734d2a99fc67", "value": "Zahlungseingang 08-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c631ce-a819-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675906334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906334, "uuid": "0ada23f9-68ab-4f3a-a9d8-20deb80ca09d", "comment": "Malware payload (Amadey)", "value": "f418ea2bd1d8b526ad6dc86fea718d3c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906334, "uuid": "c51003c4-7b64-4efc-ad80-31f68a8a73da", "comment": "Malware payload (Amadey)", "value": "1402d052f1f6557394ab9ff0c92eddc09577f054aeda60c65de50ecd117dfb60", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906334, "uuid": "3ae4007d-d2b1-4886-870c-523e6f54275d", "comment": "Malware payload (Amadey)", "value": "e747fb2799f581cd05c4cd7090f777485c5fa694", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906334, "uuid": "b7681de4-411d-49c4-86af-2a2439dcb810", "comment": "Malware payload (Amadey)", "value": "c0ff50c3707be16a85f0ed4fa68f7577de7df88f2cd69fc05369c162632a4591e46321cd7bfe7e4ee66c16f68615fd70", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906334, "uuid": "522f2b4a-0b8d-41a1-9728-6144c0908230", "value": "T17BC4020BF6E84032EC749B704DF603C31B367E904A39829B935AAC9E04736E4A635777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906334, "uuid": "2e5c1786-bcdf-4b1c-ac6d-278d8c460c91", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906334, "uuid": "ef1c8dd8-a2a0-4f35-be58-3b97ad7b65ad", "value": "12288:iMr0y90s3wcUDbZsGQfNDjLwzed8UqS9iYAim9Ogu:eyZwcMbZAfNDvw6eYncZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675906334, "uuid": "c6ff2046-d90c-4d68-a5d4-8d4556983943", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675906334, "uuid": "415324f2-53bb-48d6-9da7-3b68d85353e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906334, "uuid": "edec39f7-bf28-46d4-8dbd-c3bb6b1c4679", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c062c5d1-a861-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675937331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937331, "uuid": "5321ce7f-1d02-4f01-afd6-d7f7c8ee3fe2", "comment": "Malware payload (Formbook)", "value": "16c308da19462c682f3c7efd19e40155", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937331, "uuid": "993ed8c0-4522-4df5-b8aa-2837d5483039", "comment": "Malware payload (Formbook)", "value": "1429c1abb9518085745981f85593eaab6a5712ee9df8324e4e10e0b1bd42d54f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937331, "uuid": "06e9b1b4-2b0a-48a0-90fd-05ae5d221b04", "comment": "Malware payload (Formbook)", "value": "a06483c90a4277198e5bc5e401c05db012f854ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937331, "uuid": "7346eacd-8b9b-4b25-8fd8-8681b557d9df", "comment": "Malware payload (Formbook)", "value": "8019e47e029a4629388f623ad639069823c42ea2fcf777b7934cb1309f2aebc273a13834eff2cc9258643474d8eb5142", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937331, "uuid": "49734a61-a7f7-402d-9686-6b176d8ad4db", "value": "T18F6413BA72E0C52BD4D206725EBE43675EBA7D4B05E5E60713502F1E3E32700A25EB93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937331, "uuid": "6e95ce32-930e-4c91-9b06-7ac535679187", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937331, "uuid": "579b3f16-abf4-4646-a77f-942fb5d97c9d", "value": "6144:/Ya66IrRJ04KyUyKDc4sIiFqfFTK2oi6IzkJioprNsFjcuH:/YEV4V4sIiFCo2vQL3AcuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675937331, "uuid": "df4411ec-684a-4939-824e-d69988279f94", "value": 315732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675937331, "uuid": "5f9801f5-fc41-43ea-ab53-93a964f5ee74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937331, "uuid": "aa7afb95-064b-41ea-960c-50371b50dcde", "value": "captain.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0707b0da-a857-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675932725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932725, "uuid": "93e2ae8a-5c1e-4feb-9499-056e73f08df7", "comment": "Malware payload (Amadey)", "value": "b048e714c2f206514ac33a05259b88c2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932725, "uuid": "a9d94447-fa4d-475e-bc30-f4a9d0772112", "comment": "Malware payload (Amadey)", "value": "1435b4e9fa212473f2dee376b0a93be41a0dd83f825eb6316b8ae44b20eac567", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932725, "uuid": "45902e79-ec0a-402d-9b96-45d5ae169857", "comment": "Malware payload (Amadey)", "value": "5638ef4ea9f327019c4ea23825cbbde43ff633c1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932725, "uuid": "f4d0ce13-e010-432d-8638-785d3a5092e4", "comment": "Malware payload (Amadey)", "value": "f964e967dda9fb352037deb3ab863ef5650b4543510bfa6fb9a4f2cd4a43cd5a976eb1fcbec83180721150c52491815e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932725, "uuid": "5e658338-4cbe-44a5-b929-9575af5d82f5", "value": "T181B4021BA7FC8432F8B6577049F647C30632BEA06B358357234EAD5A0C725A4E63176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932725, "uuid": "9ffe66e5-7231-4489-bf2b-d06368940a2e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932725, "uuid": "e1800736-4bda-47d8-b7b4-96f0db9acce2", "value": "12288:LMrfy901ieI1bAYJkNDvTtkbm5oGokQchYNeY39Z:UySQuDlFdQ/Np39Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675932725, "uuid": "6ca8ce41-f6c4-423f-9f22-c5e9456c62f1", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675932725, "uuid": "94e57f52-9edf-4387-affe-9d01a16edc34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932725, "uuid": "33fafd77-6ad0-40b4-98ea-4d7c70ca1409", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a909332-a849-11ed-88f6-42010a9c006e", "comment": "Malware payload (Octo)", "timestamp": 1675926771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926771, "uuid": "10878213-9cf9-4a26-82a3-e85634014d82", "comment": "Malware payload (Octo)", "value": "c518c1536c0a03b6df35727360c8e26d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Octo", "colour": "#C7ABB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926771, "uuid": "7e426ae3-8456-49cf-a503-044931c3fef4", "comment": "Malware payload (Octo)", "value": "144cb58badccd0d201ef6b9befef75f7a2860cf6b978b14d9acf9b77a6a3fdfb", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Octo", "colour": "#C7ABB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926771, "uuid": "1fad52b6-3b0c-4cf2-995d-27af7af41b34", "comment": "Malware payload (Octo)", "value": "06f20290b976b5ae46621335107ba67f68a2acae", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Octo", "colour": "#C7ABB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926771, "uuid": "926a20cf-c172-46b4-bd89-705c895cba33", "comment": "Malware payload (Octo)", "value": "81e240ddc3480c55b2b27105b66b990bb11c29752163aa1de660b4207c72e85cc1a5c942d9b21b8626949bee5dd9869c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Octo", "colour": "#C7ABB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926771, "uuid": "a3204c47-e9e9-4124-a4e8-e4620b074721", "value": "T1D0B423E54C8E9809D0D16234949CF0320B5BDB646E18FA5C96337A8947EF26C25FFA3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926771, "uuid": "64f2e520-76ad-4450-b9fe-6888c3f0d558", "value": "12288:rRsmrT4IJHhWf0fB3YfbpTgbop6GP5Kxv9/O9gw5YYytdTWwL14Ux:rRsmr5JHh4030p8m4st5D4Bp4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926771, "uuid": "9976758e-c36f-4f1d-b723-045e7d5e93b4", "value": 540559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926771, "uuid": "f2d0bc29-21e8-4855-bc0b-396151a8560d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926771, "uuid": "68c9c735-b642-4c7c-b6fe-2b1a4af93576", "value": "GooglePlay23.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e534b6-a88e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675956640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956640, "uuid": "b29260aa-2c0f-4782-9565-d8381e526910", "comment": "Malware payload (GCleaner)", "value": "948186cfff9442907c8c9f2cb22907e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956640, "uuid": "828a6efc-090e-4fd6-bd45-705dd35adc87", "comment": "Malware payload (GCleaner)", "value": "1464acc46c09c24e0b15b76c355a2665a221064dfaf885a75c6b91cafc961785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956640, "uuid": "d353dc12-0bc8-41a3-bc45-1b74dc016604", "comment": "Malware payload (GCleaner)", "value": "e58bc778a2cf31721aabc236ee042c72154ef1e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956640, "uuid": "ca7bb6b7-cf14-47ae-9fa4-5f2e3fa7a59b", "comment": "Malware payload (GCleaner)", "value": "aa5abbe36d7110a698c7c31d4ba6f16d4a7fb8716920c6afda73cba349b682e50b800101424debaeae77530fd7794ce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956640, "uuid": "7230e4c8-13b4-4254-9c80-ee605aacbc33", "value": "T110C5127C7105D8ADC290FEB48C3AD4E71CD66EE3E8A4902270CD7F3F52B92889A19517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956640, "uuid": "19aa24f1-30de-4409-971d-d9aa167c85a4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956640, "uuid": "df662dea-31ab-461b-91d2-96485b29e58a", "value": "49152:rdHebPN8yq3j1Pi/Y6TC7B9sIigMvU/EhZ70IW77O+1SLCgv2MR:JHebl8yqzl8TCzs5gMvT37zW76+Qv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675956640, "uuid": "5472781b-abb7-4ab7-9ddf-6a012d7b5793", "value": 2638461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675956640, "uuid": "a54dc5ad-2265-4e57-8d4f-07b3205bb8e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956640, "uuid": "85426700-e00a-4514-89a0-23754216720e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0caa35e-a8c1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675978509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978509, "uuid": "07ce0be6-37ad-4831-affd-3746e3a3ef21", "comment": "Malware payload", "value": "2de7ac950cd233792cf26ab2e48c38be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978509, "uuid": "aa02d657-5cdf-4145-8f00-7b247e5a2b92", "comment": "Malware payload", "value": "150b0bdfe9565819e69d1332b8861513e3aaaf9a04830126a97b915fdadf5496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978509, "uuid": "419a368f-6638-4993-8796-b107d5ad81d0", "comment": "Malware payload", "value": "afbfbcda0a90ccff872f2369d7cf145be6dd99e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978509, "uuid": "fbd9940b-99cf-4178-8f9e-735f6316d371", "comment": "Malware payload", "value": "9f9501d5b0ff1066206d5369c39425bf423cc7b455564df1610fcf0b38eaa5abb0d69844ecf0965c2cc588cc258dc7e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978509, "uuid": "c66d0fb9-4243-44f0-96e4-5c4c40307524", "value": "T104150181FB5BDE1BC90001B0DC82D2BD4522BF69FC37599336913EAFF9B86761808569", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978509, "uuid": "d44df088-e640-404c-b57d-af89bd527618", "value": "ecbe4aac947feaf05c89434ea2bada60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978509, "uuid": "485270ca-e291-4c2f-8cad-431ae222e39d", "value": "12288:dx+ABSlj4BcdC1X0xvj5VGZ/pDHv2pPieAoh0GUWYnaVO9hCs0nIhSM9dEotNHEL:7+0eCcd9vVoVZHvY6xohzirTCIhSodi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675978509, "uuid": "9664399f-286c-448b-9bf6-d60271f829d5", "value": 945656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675978509, "uuid": "4e973e5f-246a-418e-8c28-cafd62cc89c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978509, "uuid": "ba6565d8-1ef0-4e4d-a8e9-ac3700715394", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5048b08d-a85d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675935425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935425, "uuid": "cedc6b03-1597-4af5-9db8-4bae3ecb8891", "comment": "Malware payload (Amadey)", "value": "997da84b8067f9c05f58b0209c8517e5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935425, "uuid": "49597584-9135-4f40-b0a8-0b76cbc716f0", "comment": "Malware payload (Amadey)", "value": "1518f569e749af8d0b2e73c43686cec5a7d924c8ea5a4a34c1771fea91da3240", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935425, "uuid": "752bd0ed-b868-4aa9-b07e-788e252e0273", "comment": "Malware payload (Amadey)", "value": "bcceb410d01c9058817cc58dd88a82281b0421e2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935425, "uuid": "3a055df2-e3ce-46ad-9fdf-29758e6dd955", "comment": "Malware payload (Amadey)", "value": "6cdf1adf7f261411e0d1b7e102ce2cdaa57bc3707f4d002631c259dac66f31216b994062e815db232d60af1327067a80", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935425, "uuid": "39d7fe61-d345-4708-b452-d119918c6d36", "value": "T128B4011BF6E88132E8B1577009FB03D71A36BD706B34479B265F6D1A0872560F532BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935425, "uuid": "ded460e3-9ca8-4117-b8eb-f398606907da", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935425, "uuid": "a5564ed1-9f4d-4b7c-9066-43af91e3ab7c", "value": "12288:MMrny90Ak+e523IMvERE+Miyxw5oGo7HSJryqq:jy8+eRMvERpzF+HS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675935425, "uuid": "301d16b4-9937-4f1f-9ef0-bbd31deebdfd", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675935425, "uuid": "df977215-243a-4c65-8147-ec388f5ae426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935425, "uuid": "44682ccb-9c7d-49de-88d9-70b4682f3697", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbe6f5d-a875-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675945916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945916, "uuid": "7a429b82-340a-4814-bb9b-16b964271ca9", "comment": "Malware payload (GCleaner)", "value": "6a95c379e421745c83f2a22ba9dffdda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945916, "uuid": "52722979-e11b-4cde-8b2c-c4eefb9d4a02", "comment": "Malware payload (GCleaner)", "value": "154df2fe91e3ba704225e943be09b86aece415f325072b893cf9c027cf9584ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945916, "uuid": "5cea8dfc-0316-4419-a46c-d0e96455d029", "comment": "Malware payload (GCleaner)", "value": "4bb23a3309a2c882c5dd7b1c0bffab86fc241be3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945916, "uuid": "23825d32-1c94-438e-a520-a0e7d0d17486", "comment": "Malware payload (GCleaner)", "value": "b90715d6c6144fa9c299dbd890fa8d6eee8ba286e2ffb31dda56fa7b4ff12c1475ff658d90b155d0bc606e53771a9bd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945916, "uuid": "91ca77dd-ed67-4240-9902-06e363304f5a", "value": "T189B5027C7145C86DC2C0FDB48D3A98E75CDA6EE3E9A4A12370D97F3F81B91845A1A207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945916, "uuid": "09f16cd2-50f9-470e-bcf5-29b481544c8d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945916, "uuid": "324f78ea-a980-4ad7-89c5-2fdb08de4007", "value": "49152:rdH7ydiXoMIpJJFRY7Ep746G9LQ1UwVmstbXTNxGQ2K7vkk+/aeZfVLCgv2MR:JHWd0iJJ470nGhQCC1GQH4//aevv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675945916, "uuid": "d8ce2e6d-e27c-41d6-acea-a37992836566", "value": 2471327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675945916, "uuid": "df16a1e1-5ab0-4457-9b4a-45b8bc8c3403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945916, "uuid": "b59d7bb6-8b64-4f2c-b73e-3a5f701ee924", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14162f8-a852-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675930863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930863, "uuid": "48bdcb68-591d-485f-ba11-b39b343e8f86", "comment": "Malware payload (AgentTesla)", "value": "b2e8b2b52093b16b24a3d3d71731d211", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930863, "uuid": "a497e127-76ef-4fce-9ca5-243ae7f7294d", "comment": "Malware payload (AgentTesla)", "value": "15bc05973eab85ca53379d5fed201193b381bebc6bcc57f23d807b9c123e8b70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930863, "uuid": "99d9eefe-811b-440b-965c-3dbe6ce0fccd", "comment": "Malware payload (AgentTesla)", "value": "487ed919bad1e058a9ddb0b52c56bd71d474f343", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930863, "uuid": "01cd277c-d9bf-4b02-8c2a-700ff1b4273a", "comment": "Malware payload (AgentTesla)", "value": "e06e05c1ad5902cddae4fc06363214bea2334b31925081f83d77441c4bcd40f410e79f68ff382dc25d946721c5827e38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930863, "uuid": "649ee58e-6d16-4842-81a0-266ced0f72dd", "value": "T18E7423BCA0F6D863D69706B11E755AFA5EF7F4211029830F93B09B1CBD906411E2DBE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930863, "uuid": "b0dd94ea-e746-4875-a597-a1f92babc1c3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930863, "uuid": "356e3b13-4096-45d3-a13c-90f2e18fbe39", "value": "6144:vYa6eMB5gHAuhVls0HlO+dThgE6b+s8ctqsXcaASomTgei5DiZm7f5KEjAaij2U9:vYAFAuhVtFO+dHy+s1kpe++EVKNB+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930863, "uuid": "f25b8bf2-71cc-4f7e-8eca-173aba2f8f2f", "value": 338971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930863, "uuid": "04a507ed-aa0a-47b7-8394-07530c9425d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930863, "uuid": "6b8ba4bc-c500-4f9b-b7e2-f7dcef9c143b", "value": "Urgent Price request P.O 1672891 And Images (ITF).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e031e9-a886-11ed-88f6-42010a9c006e", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1675953115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953115, "uuid": "3354269e-e39e-4000-9b87-7a1972d60356", "comment": "Malware payload (Cobalt Strike)", "value": "b3da6f8cfd89a27b1e7346f1d3ccd370", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953115, "uuid": "c1bf5939-3e90-4eb0-999f-e994c4302396", "comment": "Malware payload (Cobalt Strike)", "value": "15f237d42968bb43de74e4a164b511efadd9864f5ee94fadbb8fd207dd59eaa5", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953115, "uuid": "3342e2f4-93b8-4fa8-bb54-34af569daa5c", "comment": "Malware payload (Cobalt Strike)", "value": "b48042611e1249a729315d8047112ec88a311c18", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953115, "uuid": "cd9ce154-2ed7-413b-9879-4c6f3bc763ce", "comment": "Malware payload (Cobalt Strike)", "value": "db848d986786bb2e417a8c5162f42685139d26cc5d713bf8c9ebaa6bb2e4cccfa9af8f4a10b2f2f9362ea173aa517b1d", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953115, "uuid": "69b59437-1627-4466-b463-7bbfff3f9cbf", "value": "T15224BF81B41DBF64F14B46BA0E4FF092ADD0B2D6A59EA72B30F5950697CA673300F643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953115, "uuid": "509e4bb7-9d0c-47d5-b1c8-73b7a9291f1f", "value": "c39257d0809c7863eb9636edb4217cc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953115, "uuid": "bc840dd6-0312-4e98-82a1-ed01245d6b16", "value": "6144:m443XR4SH8CWBeBxi66thkbAzLks1YarGR8ej4rC5Jju:ucLMBIz+YLks1YarGR8PWju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953115, "uuid": "b232b675-926d-44c7-9867-61e6877a0e9d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953115, "uuid": "168056a3-1637-4c7a-bb91-6d214e1b840a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953115, "uuid": "7a322ce5-5126-4bac-afb0-63a2eb890fcc", "value": "2023-02-09_b3da6f8cfd89a27b1e7346f1d3ccd370_cobaltstrike", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f350c6-a852-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1675930763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930763, "uuid": "94be6119-2e66-4e77-8cbd-da2197073fc8", "comment": "Malware payload (SystemBC)", "value": "0a4f1fa510bfbd0ad51f1dde8551020c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930763, "uuid": "f8aea0fb-4b04-44d9-aa52-33fa8696bd8c", "comment": "Malware payload (SystemBC)", "value": "16040162181865bf929e54486bcfe9ea3a73fe510a069da7a28c90e33ff22da1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930763, "uuid": "c124ba51-ed14-4f1a-8e02-f8484661050f", "comment": "Malware payload (SystemBC)", "value": "bbead5f9dd38b13ee867448400e3963bbf6df7c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930763, "uuid": "ff6e608b-1d3b-40d8-9109-3027ebe77706", "comment": "Malware payload (SystemBC)", "value": "dd1ffdd3b8c4f6b877c1dafd446beb008104cb837c8b1e3a8f3ef997619c801b2b286cdb02cd73b402abb257f898505a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930763, "uuid": "ff8afb87-0dff-479f-920e-7322cb7fe399", "value": "T16934AF11F6D340F3D0B20B3144E6D73A6E3E2672172E8EAB5790173D5DA43E1BA32666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930763, "uuid": "3c990c02-af5d-4d43-9d69-61dd00f45923", "value": "ac02242614f7e8b38463eec95e866d14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930763, "uuid": "72c1601d-6af6-413f-84c6-b6eed09b894f", "value": "6144:EVHUq4NCV88JShP1YSc8KN3h5lhJ+tsdZVHHB5:m3rBJS/pKRDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930763, "uuid": "12c487e6-c081-4fdf-abb4-e76d7f2d4725", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930763, "uuid": "111d9fd5-4d74-4cab-8a0e-140e0904d87b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930763, "uuid": "309d477e-fc0d-4021-99f6-7c9fcc2e7e1d", "value": "0a4f1fa510bfbd0ad51f1dde8551020c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e9e383-a854-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675931520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931520, "uuid": "27b8d873-7731-4328-a1ba-17660c984f4a", "comment": "Malware payload (Loki)", "value": "68cfaa1470955b1ed82bae272ab160a1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931520, "uuid": "3faaa3ea-6c49-49bb-b9af-8b8fc20d048f", "comment": "Malware payload (Loki)", "value": "162f7f288ed8ea63c5d2b73b99663ee2526bd4e2747a0e216ad8b9bf6983653a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931520, "uuid": "35a4daa2-11d3-4f62-b304-c0dbde2b34e9", "comment": "Malware payload (Loki)", "value": "279168bb2bded4b25e072ee4080fbe63628f36d8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931520, "uuid": "4bb6cea0-9577-430a-a823-c3b732a5a322", "comment": "Malware payload (Loki)", "value": "ed15ef8c9df1d1e278324d9bc51a4907b786d3693b8b81a42ec6c0779106139e4856beb26a8a158d68b26c867b34e1c8", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931520, "uuid": "c2e95d3c-8f0f-4b17-849b-dd60c83d746f", "value": "T1147423B1C4298E9B9A3F7E4DEAF004DF40DF889FDDC568E01EA2F44F06525B29832195", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931520, "uuid": "27f8976f-2734-4462-b1db-6f056ac2f176", "value": "6144:ZRwymQClxkeM9QqZe4ktg25BfD48ZCmwaheztfUUVQ:ZuyyFqZCHD4QthezBUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675931520, "uuid": "9c5990ca-f99c-4021-b1d4-51d073403901", "value": 341298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675931520, "uuid": "0c36dcc5-e0ed-4156-817f-bd3856a6d4aa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931520, "uuid": "747e75a5-3246-48d4-9ee4-272d18b41c26", "value": "TRANSFERENCIA R\u00c1PIDA.lzh.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eaf21cc-a873-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675944898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944898, "uuid": "94945ace-a831-40fc-a49e-077a1f6afd67", "comment": "Malware payload (AsyncRAT)", "value": "4014bed9e193a427b033c504a57671b8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944898, "uuid": "0b7cc23f-5ddb-4111-98e0-8c1f1167ef84", "comment": "Malware payload (AsyncRAT)", "value": "17915f90eb7e41c7d6e27c1d01edb3b6affabdbc6d02afc0df55352c57b9c22d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944898, "uuid": "1257e96d-3172-495b-9d8a-fb0b6fa41a69", "comment": "Malware payload (AsyncRAT)", "value": "db58ec92f1ed1109983787c09163a7039099f74a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944898, "uuid": "5f17369a-94b0-4d46-97d2-c0a47654c5f3", "comment": "Malware payload (AsyncRAT)", "value": "60468b41025955121a920ce98446ad80b62e48f3bc2fdc5b6d9343267e1c17adf3237260a01f2677d892078acad032d1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944898, "uuid": "93d838b2-d210-45f4-9d81-5736aac5d35e", "value": "T1C5049E113AE184F9E2625432CBA96FD0E1F6FE351F3188AB23C43A1D5E39641D531E6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944898, "uuid": "a96d7bce-bf56-425f-b45d-4b490b75f6db", "value": "3072:xY0FHdppuOf+wMSHjnywM0vY9t8Qkh+n8KMmkYX3HB8ox1wmaffJ/:bFPMOf+wMAywM0EJksnJvNHh8Snuh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675944898, "uuid": "233eb8f9-2465-4ee7-80ef-2588c26cbae3", "value": 186872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675944898, "uuid": "1cfd3e8b-5d1d-4c46-ad81-b4441e551bbe", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944898, "uuid": "d44e5082-b1d4-49c9-b0b4-49708a8d9a41", "value": "4014bed9e193a427b033c504a57671b8_Invoice due.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45165b2f-a83f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675922521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922521, "uuid": "c4650201-0676-4f1e-955e-4a47acf20cf6", "comment": "Malware payload (AgentTesla)", "value": "921efc17a704b953a27095446b266875", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922521, "uuid": "f9652aa3-1435-4c47-97dc-d51b4d569762", "comment": "Malware payload (AgentTesla)", "value": "17c51c5c304118f741428ba3894482bf4b052783a923fee0ac730093ffdf241e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922521, "uuid": "6230b1c4-8bfe-442c-8e7c-8a8df95153a1", "comment": "Malware payload (AgentTesla)", "value": "0b97d95a689e8c3eac2b442bc29af05bc295c683", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922521, "uuid": "43ae4855-4a5f-4a0d-b418-95abe8cdb99f", "comment": "Malware payload (AgentTesla)", "value": "0be0d5624be6af4d532dc550d96fd60849caed2f17b0ee864b2e7696288180195bcb5bce80c87b3c8f82bd206b67755f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922521, "uuid": "847471e9-f7da-47d7-98d9-c39bd1651b28", "value": "T18AE4023A39B84E19E6AD47BA2DE1010557FBA89272D3FB3D0F4534D60FBABC04216617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922521, "uuid": "10e6e0fe-0830-4bfb-bf48-7f8063a69c55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922521, "uuid": "e1239fda-79d5-4350-a129-ccd09d84a35f", "value": "12288:wk7pp6ftQtvEX2LNHRoXgxaS4DMfhEllnKnSpMBdVjmZyYrlG3zZ5Dqt1S2QlQX:1cOEX2MQaDAYnKnWMBWMYoZ5ut1VQlQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675922521, "uuid": "8faacc54-d2f3-4337-85be-83f4532f5fb1", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675922521, "uuid": "b7fd708d-5844-47c0-808c-d299b638d729", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922521, "uuid": "57de1a39-40ae-43dd-b038-f111fe5a2dfd", "value": "prosperzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4ffa40-a849-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675927073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927073, "uuid": "6e5826fc-9d5a-4e76-949c-964d6a169874", "comment": "Malware payload (AgentTesla)", "value": "8cf638f80cdbf5a2ac20faed91022f68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927073, "uuid": "43dcbe86-b1a0-4b7b-b398-bb9f407a3e8b", "comment": "Malware payload (AgentTesla)", "value": "17dcd280363e6a4df6fd66e4d46938c4a3d13775a15bb3ab40f38729a03643a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927073, "uuid": "fc95642f-1e78-42b9-aba8-a83b4bb17679", "comment": "Malware payload (AgentTesla)", "value": "16162d108fc01b6b03fa7df6f3e8410a6605791a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927073, "uuid": "05bef01c-d7ed-4fab-8fbc-56e11a2ef878", "comment": "Malware payload (AgentTesla)", "value": "8827a758ba87645b064571b11d9655ccb1f4e13ef5a3a06eccacd15e1821bc03bcb93ea9556bcbc342273aba5d207d52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927073, "uuid": "927c4e4d-feef-4976-b122-97cc86ed06cd", "value": "T11E2512206058CB64E46847BDCCB19AF463BA2D79EC68EEE77DD57CDE7A317810044AC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927073, "uuid": "46823f9c-3966-4fd8-84a9-0ff6e4e9d435", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927073, "uuid": "562ba781-a6c1-4dc2-a4c4-0639822980b3", "value": "24576:w1bgzPGhgzfYTwMYer5n+hV30wjrNd/yC:wZyPyywTwMYer5nKV30ERd/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675927073, "uuid": "dbc12caa-8db2-46f4-a058-cf75eccf6be6", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675927073, "uuid": "44e43245-b875-4b87-bee8-7a4e6d9a16b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927073, "uuid": "a3794abb-a948-4d86-977a-e3e4d545c184", "value": "RFQ - Scan36711006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8fd1a6-a847-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675926073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926073, "uuid": "d877c9a6-3b5d-4f15-a86b-8e0bc933cc37", "comment": "Malware payload (RedLineStealer)", "value": "3d772b4b84db577acf9ae25d113009f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926073, "uuid": "2528984a-e9e8-454e-8bbb-8483e8e04ab0", "comment": "Malware payload (RedLineStealer)", "value": "194073ea6d7104f0e1bfd6742ba7384b7185825e77ad4f5f4fa937da9c9c3861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926073, "uuid": "36d7799f-3a3c-4f4e-b839-3f7e50ff06c9", "comment": "Malware payload (RedLineStealer)", "value": "0a68afb9cfc1cba5e4161f80282f7e27c6561941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926073, "uuid": "9983d1fb-a785-44a9-b4f2-ca60cb683fb8", "comment": "Malware payload (RedLineStealer)", "value": "3e69cb56e0a56ce9f1da0d23294f941055b45e0c0fcc8965b516a16c31a08d940ff26727d443f3bc2479875fe01bb515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926073, "uuid": "215992c3-94aa-4d09-a73d-207637f817d2", "value": "T1AF64F1A23BC0C0B2C17A9036D934DFA467FE7830567586473BA41BBD9F702D29A36356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926073, "uuid": "215dde4c-d89e-4ef0-8f57-0c5f06dd6cdc", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926073, "uuid": "bf27c9c1-e988-4236-889f-2b890b467e48", "value": "6144:dGTi6FFLIAvMqWdIHloIcPEYrdaBBpcilNZqpU6nnkuvF94mWubTwU8:dGTiOFUAUqNKZha7p5M3nnhc4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926073, "uuid": "8e7ee27a-9462-4ba9-a0c0-0f1f3dfa59c1", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926073, "uuid": "a2f26d5f-f483-472b-b86b-93fd2aa5a909", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926073, "uuid": "65e30fa5-da9e-4783-bdf9-f30a38fd5a7a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5620773b-a84e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675928992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928992, "uuid": "12ac7567-a4e8-419d-ab23-3e1c5b7075cf", "comment": "Malware payload (GuLoader)", "value": "00c703e53e2066fd27a91684ec21923f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928992, "uuid": "3e059b29-99b6-40f7-a505-9401595c27bd", "comment": "Malware payload (GuLoader)", "value": "19827dc901104e2251847e4b4850df57ac9c87e264afee888a3d7b5ff33cb5ef", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928992, "uuid": "5e726d4e-2b5c-4e34-a3be-0ac96bd8ed39", "comment": "Malware payload (GuLoader)", "value": "d40c5978fbce223fcaff6a526b2cf0e56f03070e", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928992, "uuid": "5e2ea3d1-12db-46b7-96fe-72a295832381", "comment": "Malware payload (GuLoader)", "value": "ed53500311533682c1f3b36aef0b81c2dc3f2d893c0846d4572fb9d0006009cbc7395653b54b258b314d4d128acfae11", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928992, "uuid": "94ef8529-75a0-4c1b-b8f5-f818ab1fed4a", "value": "T1A7A423452799FA0A4193D89BF20D8E990A8D4CF1F7005C5917A3E7FA07B99B696F0333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928992, "uuid": "8eca843f-4a95-41a5-a9b3-8e8c0ad80ae2", "value": "12288:Q5V+SQ2h0gNdnFEzWklzygvTT3mSxqp/L:Q5VNHAegWSMZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675928992, "uuid": "72fe3735-1d68-4ae5-a078-0b4afbe625ad", "value": 463134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675928992, "uuid": "f0b93600-2dd3-47dd-a286-cc40d30928ba", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928992, "uuid": "ef84f350-3bec-4210-be80-ccaf6ccbaa15", "value": "justificante de trasferencia_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad8826b-a883-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675951871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951871, "uuid": "1efc8837-61e9-47d1-bb29-cf7f76fda7ec", "comment": "Malware payload (AgentTesla)", "value": "8a5115ed937279c5bcd9a0d2a75522d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951871, "uuid": "e1cccb20-44a7-41cb-bc28-df0fadaa8c78", "comment": "Malware payload (AgentTesla)", "value": "19b67a778610a5af561f974ae70fb77d86bdfc1c51fcd7798fb9da90e33b4571", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951871, "uuid": "818c9d3a-8238-494c-93ba-62196f8e897b", "comment": "Malware payload (AgentTesla)", "value": "f48bf87d6bbbd3ce889f381cc15279925017d0d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951871, "uuid": "0eca12cf-a5e6-4d7b-b6ae-34f4980f4594", "comment": "Malware payload (AgentTesla)", "value": "936a37b4ebe4859643d8410a8d86901fc2e98fa263d03099471581eaee24055d7a58f25cc3d99a0ebcacfa2805475e99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951871, "uuid": "a7813734-4c03-4a67-aa02-fc00876adfe4", "value": "T14A1523199875AF22CB6603FA6429510117F464EBF6A6F3773FC860C69E65FC00291F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951871, "uuid": "3cf8d079-721e-4306-bf1e-65123b2ccb2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951871, "uuid": "1b1c3f9b-f023-4643-b848-98a0fb27e0c3", "value": "24576:LTSRZFATWNx1k1mxi0qv6af3sWq49au5JWoPVc3:LRTGximA0qB/sWrKoPVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675951871, "uuid": "197c3020-c8ff-4c4f-ab49-128a91f11600", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675951871, "uuid": "ce351faa-3911-4f79-8878-04a5caf78ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951871, "uuid": "85284593-8cf1-4ef2-8db8-4467de0d057b", "value": "RFQ - Scan36711006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e72a0c-a833-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675917259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675917259, "uuid": "45ffa8c1-2999-485b-9351-0c7cf3373886", "comment": "Malware payload (RecordBreaker)", "value": "0ad36102679c4b70f88390619dc2d2e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675917259, "uuid": "556c2770-5fb9-4189-bcd9-0162d1d12a67", "comment": "Malware payload (RecordBreaker)", "value": "19fa224e56e38469e91a26692b8dc29d9c3de2b5e3dcd1c591122c96fd7c7e9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675917259, "uuid": "d021fe1e-e9f7-4433-bd59-f26d1f0f5808", "comment": "Malware payload (RecordBreaker)", "value": "d41f893a2fb88f2e9022064598705128e10762d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675917259, "uuid": "d51904c2-c238-4b85-9db1-1ceb6185e931", "comment": "Malware payload (RecordBreaker)", "value": "e6377a86888ef144f7f8779badba1037f6c755e4b7c8a46960ce6b3ddb4ca44b945f574e6b9438b5dcf346e30486dfed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675917259, "uuid": "b939f444-bf26-4d77-b146-88f4b1d02f2f", "value": "T1A8642B8393E17C80E62A8BF2DE1EE6E8764DF5508F4BB77512189B1F34B1172C563A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675917259, "uuid": "0698c9a9-8339-46f4-b843-5964a0d464c5", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675917259, "uuid": "34ac95e6-7319-49c0-90a1-bce61cdda873", "value": "3072:9PEOD/NWPRd2GeU1UZ8mH8kW8O2EGV3EqSOqZeDwCQENe+pGSWz3:9MOD1A2oHmHC8O2EiIO2eD5QkeQGSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675917259, "uuid": "83da517a-e97a-4d84-9410-1cf88e34dc3f", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675917259, "uuid": "5b9b0c59-806c-4992-98d3-5269a4f02673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675917259, "uuid": "a42f5060-76ef-440c-83ba-23ae67b30d76", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16db9ef8-a818-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675905693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905693, "uuid": "55b78ef0-2d60-4dce-a8ec-521a68c42f4b", "comment": "Malware payload (Mirai)", "value": "feab8c6cdb93b3a614f575d7a6c093ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905693, "uuid": "eff81e3b-155e-42aa-ae33-2ce298724958", "comment": "Malware payload (Mirai)", "value": "1a09670f67441b681b1cadd9656cbd9cd4343253c90dacb3891df2889ac5f156", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905693, "uuid": "7ebbecc0-24ed-4923-a4d9-488a927dcbc9", "comment": "Malware payload (Mirai)", "value": "1245a58d7f2e9f77f263502303ef7df216704bf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905693, "uuid": "de86e86c-017c-44ea-9d48-2e7df9bb2650", "comment": "Malware payload (Mirai)", "value": "6c610206cb6904e4e6829d3f174f0e48a7735993193827d4261965bb532ed25a617ca64fdbb284dd2dd224cac9378c33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905693, "uuid": "1d2ee5ef-4920-43d8-9b3b-d83424fa1b47", "value": "T1DC534A22A9792E27C0E5F57B22F38324B2F5270E24A8C66E7C720F8EFF1854055476B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905693, "uuid": "eeb905b0-e669-4434-bc3a-5e91b9a6e9b4", "value": "768:47TSq1owq9Hg/pQxtCQ4zoIdDmZpfdIKnC2pCKe2ySGO+hZahFcA:wTSq1lSHg/pWCLzoIdDQpfdIKREhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905693, "uuid": "605fd776-0c30-4957-ba20-bb687239c64c", "value": 62484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905693, "uuid": "dcef92f3-538b-489a-8b7d-8dba16a7ae46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905693, "uuid": "a5533f1b-6d13-4d9c-9eee-ddbc78e30037", "value": "feab8c6cdb93b3a614f575d7a6c093ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bfb39b-a846-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675925530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925530, "uuid": "22970ca4-d5c7-44ac-9044-c9ade7c3080c", "comment": "Malware payload", "value": "354cd38cd6780ce73787a36b6de31dc3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925530, "uuid": "3356d163-8464-4d2b-8a97-c294dcf4cecd", "comment": "Malware payload", "value": "1a3668c6588d67369272c5e77e5f49f7190436168bbc652f7d4fa441975e5630", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925530, "uuid": "68b9060e-f041-49f7-9a48-b0803e5ba9e7", "comment": "Malware payload", "value": "6a81ee01bad7fb74a5d007f315ad486a83031bbb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925530, "uuid": "8d87ce27-cfdd-4a01-bc09-6b975c707fe3", "comment": "Malware payload", "value": "dafb27436afe27fe07c15989a7abd8bd25f0e57a29772747e461788c69802d39e3ac795c72d278ca8e656e6e27908277", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925530, "uuid": "aca45dcc-03b0-4c00-98bd-9a0a1f372e86", "value": "T1C6F39D83F9D1D6F1D47E2A79847A93500B3F2A109F16CCE7239912641F660D26F72B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925530, "uuid": "209db847-2bcd-4b29-bbd1-f00ab06e1c05", "value": "6652f1a4d5005cb50ad0e122c1bd7ba8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925530, "uuid": "dcf1c63c-71d8-48fa-ab34-42fcb2bf293d", "value": "3072:8uZ6hcvJTZ9oVFBfnIyht8vPs1XQHBC92ePuH:dTN4HBnI2t8vPLu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675925530, "uuid": "6339ab33-8221-4045-a2b0-9d8c5cb43374", "value": 170656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675925530, "uuid": "e6d61675-c043-4812-a5cf-26e2633b3b16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925530, "uuid": "b84371eb-1edd-404d-bb4f-0461343c435f", "value": "02.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6687aa-a83d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675921783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675921783, "uuid": "98138903-c7a5-4f2a-b40b-2adf18345d70", "comment": "Malware payload (Amadey)", "value": "26b862010f519f2554994f8e629b1a9f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675921783, "uuid": "21b4c915-b8c4-48d1-ad2c-51cb044f3bb4", "comment": "Malware payload (Amadey)", "value": "1a67cb53a941bec069515f6939955b3f4e8df5ea7cdd3e2d7a557960ae1c7d70", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675921783, "uuid": "d6eb180f-f67e-4007-b2f1-dc5222901eef", "comment": "Malware payload (Amadey)", "value": "853ccf95925283fdf5ef70de3684015b411f2376", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675921783, "uuid": "b1328e99-99f3-4f00-9133-cd59a30c1acf", "comment": "Malware payload (Amadey)", "value": "c4c97f08d9db1da3c52b61ffb77038bf0c305aa75378da917d557a77b5c847a64dd0b0b593f605933894d8e8c6cb375d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675921783, "uuid": "3d0c38ff-7de6-4449-8752-d19c606052bb", "value": "T18DB40217B7F94132D97557702DF603E31A327D615A38839A238EAC1908B26B0BB3576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675921783, "uuid": "e981fa43-392e-45bb-838f-e00ffcc8a39c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675921783, "uuid": "ef5f6c69-de27-4612-bc09-9ef085fb53fd", "value": "12288:PMr5y90LIHKI8VE/Ka/b4+Cg39PKivmjskNXatEMyjrL5:ey3MVY/b4+Z3FKivWOncr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675921783, "uuid": "1edb207e-f7e6-47ed-a867-b6ff84f0535f", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675921783, "uuid": "46e0283e-11da-49c6-a9a3-0ec9639b9199", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675921783, "uuid": "9d52306f-2da0-49b3-b14e-0a584791ce01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3122b1b-a8a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675964796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964796, "uuid": "def524a0-602c-42e7-a9cb-c99e43871b74", "comment": "Malware payload (GCleaner)", "value": "849cb1860ea1b6dce3bbc9f0ae79937a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964796, "uuid": "cfefc44b-498d-41c5-93f3-ed2846b322f5", "comment": "Malware payload (GCleaner)", "value": "1a82f7c756e837c7ce541930af421b928f26d0404a9fcd6e48447ede655e00cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964796, "uuid": "00f2be00-2134-478f-8c38-0108b1dc71e9", "comment": "Malware payload (GCleaner)", "value": "66337282e721a8beed8568a28c0a3d7d9531f8c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964796, "uuid": "78fde875-4a5f-43ab-932c-283416ec12e8", "comment": "Malware payload (GCleaner)", "value": "6e4855a649b6f7b528f53a8fd246b14ebd86765f267b0bd12d59159b68ee7d9b8692dda39e82e9231d33066c4b6db909", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964796, "uuid": "055edcb3-098e-43dc-b81d-0f36ccde484c", "value": "T173B5127C7145C4ADC680FDB48D3A98E31CDB6DE3E9D4A062B0DC7F3E52B95899A0A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964796, "uuid": "30b403b4-7863-45ea-8254-850916f748df", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964796, "uuid": "ec8f9636-d43f-4a16-8c31-8998ae9df49b", "value": "49152:rdHvPUGXcozowVUrkDlFKkUrZhauAPDRy8fNSnEPq2LCgv2MR:JHvPTXco5UgDVJSESmv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675964796, "uuid": "0d1f6578-d1ef-4a05-809f-b5595663ab7f", "value": 2459218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675964796, "uuid": "1d2ba572-9718-4e29-8eba-97c07b63073f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964796, "uuid": "439304fe-4a1c-41e1-baee-1c2ef496c866", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3d689c-a858-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675933351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933351, "uuid": "7a043684-08fe-4d93-ad5b-32b9240896f0", "comment": "Malware payload (LaplasClipper)", "value": "610ac369f1ae1bd0f3b864a833436c9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933351, "uuid": "18b49d16-0f8b-49d9-bfe0-6a5a601b61b4", "comment": "Malware payload (LaplasClipper)", "value": "1af5805ca8f035123fa89eea0eba3945a9dce47c376ced924501569ae8e5cdc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933351, "uuid": "e4fbe45a-8a12-4df9-9a9c-ad2e82eace68", "comment": "Malware payload (LaplasClipper)", "value": "4653947d9ed2c390063058e48cd9e8f19ea5f9e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933351, "uuid": "931268c5-3b6e-411e-8783-bf51fe3a3636", "comment": "Malware payload (LaplasClipper)", "value": "8d4b109e92cb87aad0b9a10db8d9e6d62785cfc5d53a5c7fc96765bd979eff1c05fdc0611f58235209f644cbf554d6e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933351, "uuid": "cef59616-b911-47ff-9c0a-3e792d3ce8a0", "value": "T11F14D03239D0C072C46B11304C64DBA47FFEB83156749A5B77A82BBD5F332D15A3629A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933351, "uuid": "c3121dab-11eb-48f9-bfe0-284e13d6170a", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933351, "uuid": "1a53cb99-31da-4201-9072-029a5e4cb3aa", "value": "3072:UWq9O/I7EkD7zxhL24jWMd5rwbCJb4ZqyborirgvTN82S:pq91Eq3TLRjjVJeqygTtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675933351, "uuid": "e915c617-dc95-4240-9a62-889a0f9fcf53", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675933351, "uuid": "b110e30d-a9c2-4270-b7d1-90f85384fa8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933351, "uuid": "3ff84f8f-c4e8-43c9-8987-99d826a45886", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f6dfef-a8a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675965737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965737, "uuid": "7343e41c-1b83-461c-a3d4-a9da589e5fee", "comment": "Malware payload (Smoke Loader)", "value": "c663bcefaf3344f444b6c49eacad8528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965737, "uuid": "4adf032e-a5a2-4c37-a24e-cfce33ac82a9", "comment": "Malware payload (Smoke Loader)", "value": "1b16784dabdfd7cd61b7a77a23502d070f1920a51fd9732b6c5e21f21115f1d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965737, "uuid": "f11ff584-024a-434b-be0c-fd5193a7d4b1", "comment": "Malware payload (Smoke Loader)", "value": "950899a141f392a73caceb4b623cb508e0e7fe99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965737, "uuid": "1a646780-c03c-4a4e-b1b8-2cca60529ec1", "comment": "Malware payload (Smoke Loader)", "value": "664b49e152a71a958f9ac1d377df278dc4ff0f308134863a1bfb58123587527e0eab1e809e8a1d39316512d09efd84f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965737, "uuid": "21db4d31-0ede-4edc-b4a8-85b721e63487", "value": "T18D14CF1372D0E8B0D03EB6384C25C6B57A7EF8214E749A9B3768172F4EB02E0967635D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965737, "uuid": "118bc491-2e80-43b1-a6a9-2b74e11b7fde", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965737, "uuid": "1721a50c-425a-4401-b417-249dd0d0dc97", "value": "3072:YFg9WsvVlHBB75iLWayvlMwwrTtQnp5U8xnlyLQZ0VKC5TDMvwpAcWg:YFqVtFiqay+6txlyEZ0L5To4p5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675965737, "uuid": "8af269d2-390d-4763-9d2b-0b050dcbae97", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675965737, "uuid": "e9d1d299-80d7-401a-86d4-af1d63476033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965737, "uuid": "002808b3-73b6-4cd8-b6c1-c133de73dd3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0406f877-a87b-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1675948182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948182, "uuid": "055ad80f-c666-4794-bb39-0a656a8a8a96", "comment": "Malware payload (DarkCloud)", "value": "5cd2b1de342a75a8b638b46f3e30ecaa", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948182, "uuid": "2d59f8ea-60fe-4f7f-b6d6-cebd413fd72d", "comment": "Malware payload (DarkCloud)", "value": "1b6757fd5268321dd7028c1930d939202e0d826dc378c7a53694ebeedbf92e27", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948182, "uuid": "05996838-c0df-485f-a249-0872d61235b7", "comment": "Malware payload (DarkCloud)", "value": "a3be41bf6f71c90022e8d92b7ed26e4af3bbe934", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948182, "uuid": "3d407503-ba80-4666-a166-519ad9b04ae8", "comment": "Malware payload (DarkCloud)", "value": "fa8dd2564c19945720d550c23dc3137e2e26c9e7564d5533e1a1f80cd17b60832e39b6bb6593022431333c4f3863df00", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948182, "uuid": "bd24812f-b574-4a60-9209-843801213c24", "value": "T1F775234AB28BA228DE35957580A7556413A3DF8331F7E6457FC861650F023F68E0FBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948182, "uuid": "7054fff2-ad4d-4b4f-a636-9681de87ae05", "value": "49152:pfuCXfaqg5r/PxhNO1KCxLcNirA+8dUE6JJcxkUR:pJvgJ/P3NOMecYrAxGtJcxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675948182, "uuid": "d394f862-5ed8-41c8-b46a-e72686260c82", "value": 1644544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675948182, "uuid": "a092094a-9a3a-44db-a17b-2707ec05ccfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948182, "uuid": "01d7c71e-9370-4b27-95d7-92fe05d69bcd", "value": "Requisito de pedido.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699bb1da-a852-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1675930743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930743, "uuid": "d0318559-e19e-44dc-b987-179fcea04fc9", "comment": "Malware payload (SystemBC)", "value": "6f21ef2acc3d9b4bb18800d61c61b2f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930743, "uuid": "7734d093-1d12-4228-9e5f-3307fb1d5f52", "comment": "Malware payload (SystemBC)", "value": "1bd1c5a709b98d3b13c3cb3572c1c409334807a05257555e8c11f7ddc0d17e36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930743, "uuid": "6dcf6c4d-fe52-4ca6-89c3-853a9e06cc1d", "comment": "Malware payload (SystemBC)", "value": "d176b38b567ce050c82ecb8b0e4e8cc44a7ea0e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930743, "uuid": "faa6e8ba-711a-4eb3-8eec-2f2740200643", "comment": "Malware payload (SystemBC)", "value": "a71ce282ab9de0a099a69f5852dc5235b173091be73b2c7d960e1ab7a4ed3eea5747e7fc7d758c36957ff3182de214e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930743, "uuid": "5e226ed8-a86a-4778-9270-f09b9219b2f9", "value": "T1F0054C5DE211CD92EDA4233086CF1B75677BDAD82225224FA2D52FB4BF463DB2D07680", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930743, "uuid": "d7c345d2-008e-45ca-bde0-37815c3b25a9", "value": "addaedca6221b64af65b9793540d415e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930743, "uuid": "1fd68cc7-b70c-4402-8f12-0cf75a2d8a7e", "value": "1536:rvG6I+Lt6Pzw6u75dXWeBvfkkcCxauMjx2CaVcG15I4bzWXtmEQ:rvG6I+LUc6ul11cSkj8Rh15I417", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930743, "uuid": "8fd4deab-71a8-4d80-824b-0fd092c49119", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930743, "uuid": "2260df18-060a-41ca-b01b-ff308f517411", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930743, "uuid": "10442cdb-cdc7-4ccd-bcd3-464bcc1a9e90", "value": "6f21ef2acc3d9b4bb18800d61c61b2f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966d0019-a866-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675939408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939408, "uuid": "8dca8022-16f6-4bf4-9e7e-616faf6833d2", "comment": "Malware payload (Formbook)", "value": "4e24c3cc0229d67159a96f9ece6b5230", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939408, "uuid": "decef752-4c20-4720-8d18-a0a058aea166", "comment": "Malware payload (Formbook)", "value": "1beedf169fbe9c1228d77e5f3b8d4117d592e7d98e57c2cf7888f042b031b243", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939408, "uuid": "96b09fa4-fe85-42c2-a09a-1d765c869f21", "comment": "Malware payload (Formbook)", "value": "f36607ab16280da8e1b0d5e19480bbbdbfbe08f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939408, "uuid": "c9149a52-0bff-442c-80c8-8d48af9c1bb3", "comment": "Malware payload (Formbook)", "value": "7ea209d80cb3502932d93261e95c0ebe115e609ba65d5eda4ca9b3aeb5aa287f4c08376c94bc5033a3e19ce0974b1ebd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939408, "uuid": "ef7db004-f0cf-4750-8e4e-99c1a82d0856", "value": "T18705F12C2CB48654D17CC2FE46A36634E37F7E93F48ADA2A0D82B1D61CB5BD25058C5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939408, "uuid": "2707e14a-855b-4ee9-9452-8b9b4f0f2631", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939408, "uuid": "69ea1fbc-9b9d-4c4d-bf47-5cb831af873a", "value": "24576:9HCtn9BoO/NhSQlQXDmkyuOTH+BXec78o9+Q8Afiez4OvQa:6BKLD9eA79TODg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675939408, "uuid": "16931164-fa3a-48ed-b9ef-7070af20bdfb", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675939408, "uuid": "6bbda48a-eccf-4264-ae49-5dbd4483a462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939408, "uuid": "c2263154-66ae-497a-aba4-62e143c9a649", "value": "ORDER-ZWL 0736449574 ZWL0106245448.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4832cfee-a887-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675953450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953450, "uuid": "24b677d6-42e1-48e0-a2f9-09d145ec4a7d", "comment": "Malware payload (RemcosRAT)", "value": "f8458d04469942509a2256af589eb4fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953450, "uuid": "38884425-a100-4ce1-81d6-7c9487d8b106", "comment": "Malware payload (RemcosRAT)", "value": "1cdd50cbdf51d44354d596e4a1f8a3fee6268362ffdce61b608322bba56ebdb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953450, "uuid": "b4b5baaa-dfe6-4b64-84df-04341f624577", "comment": "Malware payload (RemcosRAT)", "value": "dc67932782a2bc57b2585864aa9a3e3e5f81149f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953450, "uuid": "6d75b2b2-aa35-4924-ab59-e02ca55fb1a3", "comment": "Malware payload (RemcosRAT)", "value": "282383d7aadd20349e9c158a8a8e8cdd88d0c03f18f0c3620dfa524469cc03f9a93f5afb9eba2f8888cce1211b004850", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953450, "uuid": "71bd0803-73cc-43ca-84d5-dc3c90dc6ccb", "value": "T1ADC4232513F7E0D7E8A25B712FB14C57BBB599285E8EB30E23687A0D7F06252450C7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953450, "uuid": "c45c4b29-40ef-429a-bebf-e9f497b7c7b8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953450, "uuid": "ae507da4-aa4a-46d5-a6a3-d9568fb50916", "value": "12288:vYu9jOBwHM2rciJAuxFiUOz/PN+9RS9riLJvx2O7ckY:vYu93r7JAuPiUOz3Nd9rOJEQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953450, "uuid": "1d8d32ce-6fd2-4e81-a639-56b6908ca072", "value": 544586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953450, "uuid": "a269ce8d-65ef-494c-8082-e5c482d31f84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953450, "uuid": "97ae54bb-d04d-4bcb-a8dd-8d2e553488b4", "value": "updated statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866d83dd-a819-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675906310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906310, "uuid": "615674f9-6951-4107-a04b-dd75c4d5ad21", "comment": "Malware payload (Smoke Loader)", "value": "1cba3af87a81523e2091ad23d9bf5c6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906310, "uuid": "8f1af675-b78c-46f1-805f-cfcb8db777ca", "comment": "Malware payload (Smoke Loader)", "value": "1cf87dc232e1c607f05e5b3c8769ff9ca5d7fcc84ac018f4836d871432089421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906310, "uuid": "f8a66f1b-00af-48d0-a04b-f56659daa198", "comment": "Malware payload (Smoke Loader)", "value": "43f68650637968b76837c136bef5ae77a8e05894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906310, "uuid": "ce8b949e-11b7-4194-bf53-645f37ce5b22", "comment": "Malware payload (Smoke Loader)", "value": "26bdec346fbcfc7577dcbfbfeb5b645f288328f96ff468d0361eae5e7031cf94761641570ebb48009856d07bcd5c3aca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906310, "uuid": "8f5e0ca0-746a-42bd-a9f9-c22100e8ee31", "value": "T165640A0393E17C80E92A8BF2DE1EE6E8765DF5508F4ABB7512189B1F34B2172C563B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906310, "uuid": "dbc545d9-dcda-4786-9d2d-0dddcaf40c6c", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906310, "uuid": "cf261f5e-a387-49d9-8b5c-1ea78bef45b5", "value": "3072:HPEw4w1NCSPRdp3GwMmi4Cays1I6hakjz+0Qizzfk2NCQENe+pGS82z3:HMw4w1IEp3Bi4gsDa27jzf1gQkeQGS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675906310, "uuid": "72751bf4-3ed1-4398-b828-935e5c2edcdf", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675906310, "uuid": "48e9ef94-2205-48a3-9abf-9acc78e51b47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906310, "uuid": "ee17cbab-4bcf-4755-8ef4-b39a3d0b69c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599cf048-a853-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675931145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931145, "uuid": "a23564a0-2954-4b85-a895-a854bd7d350c", "comment": "Malware payload (Smoke Loader)", "value": "d48fdab921244bf6b4e28f6ec96888ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931145, "uuid": "ffc54fe6-118b-47e3-ac55-b353951a6cac", "comment": "Malware payload (Smoke Loader)", "value": "1d87bc77d38d3814003598501faa9438136bb0216852318b68d4394b6b2866f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931145, "uuid": "76a89444-74b3-4bc2-93db-3a10924ecc95", "comment": "Malware payload (Smoke Loader)", "value": "ec94143d34f0850d8f5a78d91b3456cb61fc850d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931145, "uuid": "302a26df-1782-473e-a669-9d5ff51de8d9", "comment": "Malware payload (Smoke Loader)", "value": "d09808a626ea7f28c4ddb9cded296432a73a6c8476a2723c8a4922b7775bed8cfc3936f8be5fd4ea89c7dc54c8b77130", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931145, "uuid": "3a2e4908-1a04-407c-9ec2-ab60468442df", "value": "T15314D0323690C072C07AF4346874E7656BBEB83146718A5BB7981BAD5F312D0A73A386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931145, "uuid": "5bd2a244-9a0d-48e7-bf8b-871984e5cccf", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931145, "uuid": "d108da9d-f908-4426-9447-48abfe4458a9", "value": "3072:b4q7O4yuiF4OhLYrbpWCd5DH8T6KJpejo+mDbxqe1L5rMFJI:cq7FNyLopBH8eKJpM6D1q2LJM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675931145, "uuid": "33dccb48-1d3b-472d-af22-120aee3391ba", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675931145, "uuid": "7996703f-1f57-48e7-8d5e-5d5ced19ca84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931145, "uuid": "62d47619-9250-4f03-bc50-42b872a3d105", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e33f467-a8c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675980089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980089, "uuid": "ce417509-dc6e-4d76-b89f-55b54603c5b5", "comment": "Malware payload", "value": "90946587170441cd2730e2ee00ffac62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980089, "uuid": "506dde39-b194-4a84-b48c-16193c387ceb", "comment": "Malware payload", "value": "1e4a9b67d30ceee8ed76337adf282c54d045176af8b653ff5e32278d256c1182", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980089, "uuid": "54e4d10c-4e36-43a0-a9c8-48d52cf67696", "comment": "Malware payload", "value": "50561c90041cf8bb15458b280b4c2d8132d56676", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980089, "uuid": "b9aa3443-8d1e-493d-9e4e-f8d6d4ce6024", "comment": "Malware payload", "value": "92aa6e566b5a6da30146dc46eb3213f1876165b1fc714fba7fecf46988ea0360250bf4617cc342e346731f9c22a003b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980089, "uuid": "56242837-fc39-4598-9461-d5b595cb4b6e", "value": "T11C14D02233D0D471C172B6309D29E2F1667EF9305E3EE69B37682A3E4E702D19636352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980089, "uuid": "05dc4e19-3455-4690-88b3-e049bdf9174f", "value": "3ae714bb16df7ea6110fd4db3c856d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980089, "uuid": "0d4c7af8-deb1-42d8-b9ff-973b7c41b8d5", "value": "3072:ymv62AKkBRRRIYqTezMmDpT/nOUijB0Rqu56h7CiI8obA3tlkPDD6:ymS2FKRfqTcMmDp7nEB3u56sidtl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675980089, "uuid": "8cb70f99-ad51-4b37-bd7d-9ad9790a508e", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675980089, "uuid": "d8e8f90a-c179-4866-80af-d9584cf33835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980089, "uuid": "6109a6ba-7264-466a-ad59-4827da8acdac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7762b855-a88f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675956965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956965, "uuid": "a3fc5e61-9395-48f7-8b61-caaf5bebfead", "comment": "Malware payload (Vidar)", "value": "19643b618d2e5c93e169051d45fc5cab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956965, "uuid": "68994159-b8f4-4b64-a1f9-ec228044f7b4", "comment": "Malware payload (Vidar)", "value": "1eab2ffc6adea310c6787a473d37110b1cf7643337032a3e818e3991886672be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956965, "uuid": "a4c31dee-fdef-4af1-ad77-c9e3ce94689c", "comment": "Malware payload (Vidar)", "value": "605c7233e2a7de0d385aef5e996192c9e0c844dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956965, "uuid": "ef05d5f0-fef9-4859-b224-cd6e3d85236d", "comment": "Malware payload (Vidar)", "value": "41ce5e00e7dcbf32ccdc39eef18b29e15e5169418375d01090a5c555a557da820502f7cbc17f021f924f7e8395a0f849", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956965, "uuid": "b5946844-a419-46ca-bc50-45ae92187d75", "value": "T19204AE2233D0E871D022BE319C65C5F5FB3EB8214A749A973758172F4EB03E19A76396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956965, "uuid": "739decb9-de3b-4037-a11b-60e368f38943", "value": "910163c173a5611f34260e641a94d790", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956965, "uuid": "5da84c0c-eb5a-440a-bf1d-9a57948d85fd", "value": "3072:JbsyBEom+Mk5QpEiKMA++CPHHkE2nFcqwqT99ZFTDw1NAEl:JbWfEQDKM5PkDnFiqDZFINR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675956965, "uuid": "e74be597-72a1-439e-b2fc-3479738c0090", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675956965, "uuid": "95cebe2c-beee-4b0d-a3a7-8e53f3c434dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956965, "uuid": "90f84bf4-d0aa-4684-85dc-028aebf1e06c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399ae901-a858-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675933239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933239, "uuid": "5138ac66-ea7d-4ee2-ae98-02cd777c1c53", "comment": "Malware payload (DCRat)", "value": "0892cdc42b4a834bbe8c26ddc9119429", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933239, "uuid": "f0a1fa02-6c4d-4d2a-93b4-79e37cbe139f", "comment": "Malware payload (DCRat)", "value": "1eb74c9de4c43d2b25831e49a4b609792cc9715f0b64c0e639b216ce80f82a3c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933239, "uuid": "05035b35-76e1-4120-9f22-c6c9d4628ccc", "comment": "Malware payload (DCRat)", "value": "f909401e1866aff2f7474d8a0cae08460166be3d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933239, "uuid": "949319d3-095b-47b9-98aa-bfa5d0ed8c65", "comment": "Malware payload (DCRat)", "value": "59573c9063c4f1dbc917a6f5738e992ddc2b6e47dcf203769182c5205fd048d3771ebeb37fd0569c428217cdddb73964", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933239, "uuid": "6ac886f8-de07-4862-8e6a-dbadaed9c798", "value": "T14905F7027E44CE11F0191233C2FF459857B0A9516AA6E32B7DBA377EA5123A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933239, "uuid": "39f95958-4a22-46ec-b2dc-91da04840299", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933239, "uuid": "2e52555a-03d8-44c6-b14b-1b83c07a61bb", "value": "12288:9asaLdZp7J8s5YgCRcLEmrPtjyg0f9p6HoKKYE+cwAptHB1J:mLdZp7JDCRcL7rx0V6lSpVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675933239, "uuid": "b5c0e6e5-4d25-4eaf-9f49-ea7cf5eb9506", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675933239, "uuid": "a495bae5-15fc-46d0-9cb6-b4c1b3b068ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933239, "uuid": "e8b74258-0542-49a6-970c-c6e2a5b25511", "value": "0892cdc42b4a834bbe8c26ddc9119429.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec6e4c59-a834-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675918077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918077, "uuid": "2553293e-ffb7-4a68-80c9-ad221c9028a2", "comment": "Malware payload (RemcosRAT)", "value": "b27a5a159e3069d38e816f1679dbf3cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918077, "uuid": "3338f7cb-19ca-4e31-98fb-d65c753beec8", "comment": "Malware payload (RemcosRAT)", "value": "1ec10be5e16b3bf64560b88f44d02a4bd759e6f7d19f1bdfc6aa8ad2015371ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918077, "uuid": "5913388f-4977-4c81-898d-130becc1e521", "comment": "Malware payload (RemcosRAT)", "value": "f4c902808cf27a7dfb280154009ab20c74e89921", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918077, "uuid": "c7d2ae67-49c2-40bd-8f84-3dac4cd66a56", "comment": "Malware payload (RemcosRAT)", "value": "9239091f47954a32731f0fe77a887c1cb00305d399e3934b8bb7e1fd7c4836ea82aadbbf0258efcf9584a16f12c6cd04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918077, "uuid": "8272ae43-2d06-4340-b7fc-00e8d90f1f4a", "value": "T1D945F1162394DF42D0E543BC8AB2EBD013B7A975D0A5FEC89CC16CCE4521B207997B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918077, "uuid": "f25d1fe6-d17d-4928-ae37-9e163de7846f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918077, "uuid": "5204f75c-7a76-451f-a911-7f4686dd7c43", "value": "24576:7lpDTpRz4lM6NtJXqwZZ6OQeF/JHjZnJLuHLLrTl3il/9wMYe+ylp:77j4lM6PJ3DBtJLuHfrx3ilVwMYez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675918077, "uuid": "d99b030e-63bd-49d6-a535-d91594582a5d", "value": 1229824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675918077, "uuid": "e70494e3-4e8f-49d8-b12a-34d24b4d2759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918077, "uuid": "f4364556-3807-4773-85a9-77716772b12f", "value": "b27a5a159e3069d38e816f1679dbf3cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0f2c04-a846-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675925516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925516, "uuid": "7d16483c-49bd-4119-8816-07101f826670", "comment": "Malware payload", "value": "dd81f258c687129c2294642e39e2e04e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925516, "uuid": "7b203c92-6f0c-418f-b898-eeea7db1ff71", "comment": "Malware payload", "value": "1ec9d36156f91cb3c2e3c2e4e3fac043d36f377cea52583ad2c2a7cc15a0d943", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925516, "uuid": "7909f089-d66c-4f1b-b265-d122dcf8746d", "comment": "Malware payload", "value": "4c5c7888b0b7c4cafb8d050e29dab1e7e3b48a44", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925516, "uuid": "5d708139-1cf8-4c76-b67c-3978ca9bc6c4", "comment": "Malware payload", "value": "ed5e02a4e209d72563bf3c6db3995ec89dc75c2f56833c7767475e4d8e394839da95984b8456e9f2b42cfb3a0eaaf6d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925516, "uuid": "9693f1f5-f1a1-46dd-9e62-b8aa183e6340", "value": "T11BF39D83F9D1D6F1D47E2A79847A93500B3F2A109F16CCE7239912641F660D26F72B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925516, "uuid": "8aa0ba03-d359-465a-9a8b-7c5e3d6f51a8", "value": "6652f1a4d5005cb50ad0e122c1bd7ba8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925516, "uuid": "d07c0dba-17c1-4753-8145-cb321b34d1ba", "value": "3072:8uZ6hcvJTZ9oVFBfnIyht8vPs1XQHBC92ePuH:dTN4HBnI2t8vPLu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675925516, "uuid": "4b9bce49-84fa-48c2-9256-b65a2e3a86d7", "value": 170593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675925516, "uuid": "7c9b6833-ae5d-4e66-a1ff-b53fe26f8223", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925516, "uuid": "5b97bec2-0ed2-48ee-b836-a5592e2a6791", "value": "01.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e884928-a852-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675930778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930778, "uuid": "0a2530c6-bee2-4505-9daf-d7fa8907ed71", "comment": "Malware payload (Amadey)", "value": "e5891eff8eca095d65c4d3d616b90ac1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930778, "uuid": "f1459862-6cbe-430e-9bc8-ac77e4036cb6", "comment": "Malware payload (Amadey)", "value": "1ed9fa435c00f0e57a7483064198f46f788358c64ec6f30616b9ae9b226c3d2d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930778, "uuid": "8f4079de-f299-46c6-b744-280333012187", "comment": "Malware payload (Amadey)", "value": "104b19a8643bbc7b9d07b801640ddf1c9aa58c00", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930778, "uuid": "377f5ae9-2bb4-48fc-957c-76bd16bf142b", "comment": "Malware payload (Amadey)", "value": "5dfe1b5a6936af78115a6fe692a23346017665cff8c2127e26734f6ea1798f9f10d7949cbf11c86be37390da53fa4933", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930778, "uuid": "4fa5d47c-fc27-45af-b19e-93a6ecbca2dd", "value": "T181B40257B7E84065E8B15B7058F607D319377DA15A38C367238FAC4E1CB26A0B27632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930778, "uuid": "a7ff375f-794f-49ef-9f9b-6728b4143354", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930778, "uuid": "2ec1d454-ff78-4eb9-aee2-a9f9341560e0", "value": "12288:kMrvy90IlGfVOrrikZiGKG4FhS3uGNfQY+/:Dy7gVIiYiGzuGNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930778, "uuid": "9f74eb86-5a85-48d4-ab78-22d0db31e251", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930778, "uuid": "d590ab1b-32c2-499b-94d0-c3651231615a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930778, "uuid": "548f9478-5e77-4bc6-b332-3abf8ebc9713", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e41df3-a881-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675950755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950755, "uuid": "5da141b2-b5e5-47f6-b1c7-cff7f388c3d0", "comment": "Malware payload (RedLineStealer)", "value": "693791c39daaff35f135bd34d459335c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950755, "uuid": "03ef041a-4f6e-418c-bc87-472ec8250c74", "comment": "Malware payload (RedLineStealer)", "value": "1f29bbe70674b95a0c57ec3fad7016857bd70d5cd41064ca3aa8dd3aa3e749be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950755, "uuid": "3bfc0eff-dc4f-4dd1-8b10-b132f5b920dd", "comment": "Malware payload (RedLineStealer)", "value": "e73754fa42a937d2f707ff65f6dc1ed037f51ba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950755, "uuid": "d3604874-98e0-4aa6-b114-7efe387f9fa5", "comment": "Malware payload (RedLineStealer)", "value": "9a8ceeed3f525a3145e2508a6c645dd1ada5cb140cdc988deb9cd4f97686d13fb3004545e641bdb9c64c1dd2505dfef4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950755, "uuid": "6f1b7365-88eb-4025-b429-f986669bdebd", "value": "T1C9A52352F5E58072F53109325E2AAB7064BCBE602F22CF9FB3992D1CAA352C1D5157B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950755, "uuid": "d472c7db-83d2-47bb-aeb9-47ef70c90bfd", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950755, "uuid": "7e1505ae-e287-43d5-be65-b9e294a0d834", "value": "49152:V5OmQMezMIA+bW5SaWWMdpGOujuCS7BKW+zVn3:V5PQpzVA95SYMdpYjuC1W+zJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675950755, "uuid": "1e226122-184f-474a-98f9-b16ee2fb03aa", "value": 2160127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675950755, "uuid": "79e07f5d-437c-4eb0-87b2-343447695664", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950755, "uuid": "c7b282b8-a665-4b38-a672-33ed2850fcb7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96d0840-a81a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675906878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906878, "uuid": "16792b05-ed76-4277-8a18-3f853bdd2d51", "comment": "Malware payload (Mirai)", "value": "6aea3bc826c3c9d665524513826ccd11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906878, "uuid": "4191337c-201e-42b5-ac13-5df07c394c01", "comment": "Malware payload (Mirai)", "value": "1f601bad16aeaf9bb21ff9a894c86e6df3bcb3c4ffc17df009fdaead35d95c52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906878, "uuid": "e7ad8fe0-92f3-4828-a900-64b8f4596839", "comment": "Malware payload (Mirai)", "value": "7d284d911201b4ca5a4b97ca23adba2491b2a34d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906878, "uuid": "14c3387b-bd38-46c2-b23a-2b42f900e4a3", "comment": "Malware payload (Mirai)", "value": "ed2719477a9b34ac122f0f4c75b15241b9f8cb1eeb112664221314f16ef2b182acc92b6e8582f1b16fe851382e776c28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906878, "uuid": "f6f08ed4-0ba0-433c-9eb6-a2d60dce7d5e", "value": "T13F531855BCE28A12C6D462B6FA2E418D332663E8D1DF3207DD216F1137CA82F0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906878, "uuid": "7f695bd0-0b8e-4b0b-a679-f1a9993270a3", "value": "1536:hQXM2fd+Zxk6j41aBqwkKVrL2yBCtt5Kcixx9:h6D+ZxfBlvYbKcixb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675906878, "uuid": "cb255865-e555-4161-b75a-c4ddb6f6274c", "value": 60788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675906878, "uuid": "5c783977-8c01-4fc3-a62f-762790dd33b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906878, "uuid": "01b613c4-3220-40f5-9bf9-2a2778b84c4e", "value": "6aea3bc826c3c9d665524513826ccd11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f9a7cf-a85d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675935414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935414, "uuid": "8ffc471c-607f-459f-9b33-550b0c086d4c", "comment": "Malware payload (Tofsee)", "value": "4d78f0a31e7e3631c75272453765a874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935414, "uuid": "674a7be6-4589-46cd-acf2-844fda8743f4", "comment": "Malware payload (Tofsee)", "value": "1fbf681bf37fdf0d5afdf9f592c11d5ce1526b77d8592d7b8f1363b5ab3f9697", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935414, "uuid": "cdf63199-f5dc-4535-a54a-06888be1069a", "comment": "Malware payload (Tofsee)", "value": "9e9b924be76ae04b7e098085766ffb9d6c5c6986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935414, "uuid": "208b879e-8ea1-43b5-b280-1a2740dfa134", "comment": "Malware payload (Tofsee)", "value": "a163839cca945d14f5b1a811605dbfa2ca23283537da0e80cd5bee361941183b62cba63a4670f5ee49797fe13471a5f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935414, "uuid": "fec24727-38c5-4919-825e-83452e624adf", "value": "T13014D0323AD0C071C06730306825DAA57BFEB831C679CA5B7BA81BBE5F312D16776256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935414, "uuid": "bb610aaf-ad49-42f6-ace0-aed3ce51b31a", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935414, "uuid": "a9269941-86ae-48e1-b8d3-573b2b6d947e", "value": "3072:xLqgOSbgKcA/4LmKjWUd5y9VX6IA/eVsWooi76YQw4Nllz:tqgu+QLfjCiIA/eVs9f76YQFN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675935414, "uuid": "403caf29-1929-4315-905e-0dcfeead1477", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675935414, "uuid": "38acbd5c-13e0-489a-9626-2b6492d06ad5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935414, "uuid": "36a42c79-4452-4af1-8d3c-1a2439a66048", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782992f5-a89f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675963838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675963838, "uuid": "b4407c32-90af-4813-b888-3145fd2ad70d", "comment": "Malware payload (Amadey)", "value": "cf4f63f976a0974fd72a129bc7a3c620", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675963838, "uuid": "684878ca-d05f-4f03-8ed7-73e7bd929c0f", "comment": "Malware payload (Amadey)", "value": "1ff6546b55afedcd77c7f03108a6e4074b7b5f529fd6ff5f8ca5fd9214223102", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675963838, "uuid": "ff34e2de-f93b-4d8c-9a2b-b8f3b1bc0811", "comment": "Malware payload (Amadey)", "value": "f352a7c89a74ffed52d56535f74f877f6e50a1e6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675963838, "uuid": "dcb6ffbf-72b6-4d15-ac3b-127cc18f92d9", "comment": "Malware payload (Amadey)", "value": "4af272bd2eca80e19d78377e3a31c76337533e2b9e71169b40a1430854ee922ab0d2a16a9b655d52c41c1964a4cfbbc7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675963838, "uuid": "02876c9e-8e07-4661-a76a-4ee1297d9392", "value": "T1F7B4024BF3E88032E8B0577019F703D31B36BD606934839B678BA91B1972674A53577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675963838, "uuid": "ffb8e6c0-e0b6-4944-972b-0ff4fcb863c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675963838, "uuid": "de6d9908-73cc-47ee-8e93-9fc8409a41a4", "value": "12288:IMr5y90czpBbzG1FGOCN5JvXhIFmfB72OsT+lKy:xyRz6PGOCJvxMmpCOs6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675963838, "uuid": "98282dca-859d-4422-9dd7-c3f269615a46", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675963838, "uuid": "db2009bf-a47c-4f87-b033-25d68670f571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675963838, "uuid": "fce72c5e-249c-4ce2-bffc-a670a8868c99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d999d0e-a888-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675953942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953942, "uuid": "a303bb44-53d4-4a24-9567-92aa7a8762a9", "comment": "Malware payload (Formbook)", "value": "35670866a876441c4c21dff50da4320c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953942, "uuid": "135c0721-89b0-4300-8ed1-ab3475b718c6", "comment": "Malware payload (Formbook)", "value": "200100b843cccd6b1fc8f2455de2d6069aa6272b3b2d94e805ee72d08bbfd665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953942, "uuid": "c4189049-f334-43cb-aae7-0d22ec55f507", "comment": "Malware payload (Formbook)", "value": "0e5ca3add0aa5eb1473f5877c56a7c6ef3dbc2c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953942, "uuid": "ae9aea4d-3fc1-4c8d-9df3-d3372d2eec8c", "comment": "Malware payload (Formbook)", "value": "2dd861be9028b6535746bbcd9c328d19ed398b7c9bdcfe2ba7e8278f6eb2ef4a8e798c2e50278788c6b65a0829bc4aa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953942, "uuid": "ebd19bdf-1337-4912-bc30-626867da8c0e", "value": "T18515F12C2CB4D711D16DC2FD8AA36634E3BF7E93B58AE6190C8271CA1D757E25048D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953942, "uuid": "08eb641b-a4ee-415e-93bd-adc0d41b8de6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953942, "uuid": "5dbcb3ef-7968-453e-96fe-7bd2935b55f8", "value": "24576:xHCtn9BoO/N9SQlQXD5zMROXYsA0WngU1stAWX9JrftK/hM:2tKlMR/NDWXvshM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953942, "uuid": "daf8b725-d1e6-4c00-b8ed-1fbf582a6405", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953942, "uuid": "31b229df-ab3b-44a5-b601-c27345df6645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953942, "uuid": "750db2b6-73b7-4a27-a816-de18faa0bb06", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efbf252-a8b0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675971097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971097, "uuid": "8531723c-be87-4d78-9698-637c9e574db7", "comment": "Malware payload", "value": "a2247f9eaf23e086eef8d3456e405e1c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971097, "uuid": "8f716aa9-ff27-49af-8bf0-776256d29f24", "comment": "Malware payload", "value": "201af3d61b8acea8113f6abbc823b5cbb41e797a6b372780562d48d56028fabd", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971097, "uuid": "255f84bc-1778-428a-b044-a1c37eed24bd", "comment": "Malware payload", "value": "c6e084e8b3e2e373116f78a2ccedae4de125baf9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971097, "uuid": "667812e2-08fe-4d37-beaf-6e5f4be6a97a", "comment": "Malware payload", "value": "cc49ff53c08e579fa1fa2e5f9c4dba6e660a794c5df8076d559381bf774e60d38c09da4f625740c6eea7c22b0c974c8a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971097, "uuid": "2c34d000-5fe1-45b9-980b-376bf24f1461", "value": "T13374E106BE9EC07CE16345BB9C10C11B37191897EC73722B0468065FF5AADE6473AEE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971097, "uuid": "ed545ef6-3e37-45c0-b519-fb0c663f99d6", "value": "6144:hXLg2Ry8c97c4lu9pQJtVWnXfNSvIziFTsO55hruNWFUlMfxi9d21RyPr6WD0:hX0FlemJtVeX1dzA59AWFmMoz21RyPrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675971097, "uuid": "e89904e4-18ec-4db0-99f3-85bf7c7e9387", "value": 341033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675971097, "uuid": "7963aec3-1c00-4f14-9702-25ab444f16df", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971097, "uuid": "dfb0f5b4-1b73-4ff7-8d69-ec6e249e31d5", "value": "jsse.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d108fe-a893-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675958893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958893, "uuid": "85bc2c19-edcd-4e8f-8779-c0aa025ceadc", "comment": "Malware payload (Amadey)", "value": "85322419c89470e2249f73a30942c2b1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958893, "uuid": "a9615379-9a51-48b1-8380-7fd5b72b8e05", "comment": "Malware payload (Amadey)", "value": "2047ecda73aa4dfe5de34d8c623f054218aae9453908c3627bdc62c18af8db3d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958893, "uuid": "185757e6-6b57-4776-a10a-de68b3c02952", "comment": "Malware payload (Amadey)", "value": "6601733dd238d4b7bd6119420d1b92a9b6daf369", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958893, "uuid": "e22a43d4-b297-4779-bd01-e426b632d89b", "comment": "Malware payload (Amadey)", "value": "75be851fe027e79cef8cbf44b5186da0c77df15d1ca00927ad96c4ab19dab323e502eb721fb9d373ada90e300f67d6aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958893, "uuid": "e5fe6c65-ccfa-4d8c-98da-5d47021a89a7", "value": "T180B4020BEBEC5472E8F5177485F602C30679BD616A7C829A234EAC5E0C732A4B735367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958893, "uuid": "c19e4a92-9262-45c8-a67f-54386df79faf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958893, "uuid": "688817b2-657f-4318-9b86-47c3f80a0b4a", "value": "12288:QMriy90g4Ul4q+7iiBvDJ0AFxD7ltultwd/JXz4:iyZJle7LeAFxD7ltUA/JXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675958893, "uuid": "54c61162-072a-4de9-9ada-6d1825127230", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675958893, "uuid": "fcf58d1c-772e-456a-bde4-e105be09c85f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958893, "uuid": "656767cc-6d73-4c94-a73d-47a4972dcda2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c702ad42-a879-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675947650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947650, "uuid": "99de222e-e22e-4238-88d8-d8521f0ac1f8", "comment": "Malware payload (RedLineStealer)", "value": "dae1f5c5f3d0f22a1bf7a5a0d8102aeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947650, "uuid": "47702b3d-6fcc-422e-9313-734c6e70e616", "comment": "Malware payload (RedLineStealer)", "value": "20ba565c7739922ff8471860d1ce669c3c9ad5a2ba7bc31551f1b9b36b81f792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947650, "uuid": "9a853ac8-8d2e-442e-ae5d-4ea2e2e0618f", "comment": "Malware payload (RedLineStealer)", "value": "fac0f0b7eef2192bac2658194f12fe6102ed1cf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947650, "uuid": "d32f2247-7a40-4be1-90a5-382746966379", "comment": "Malware payload (RedLineStealer)", "value": "738bf9d9692ffdfa2a504b97fb290fe1ff41e4e64ec608bbb5769451b44a3ef002d9fd710ac5d2d57d301e25e252ee1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947650, "uuid": "78c0780a-2903-4b93-ac2b-b24560b023f3", "value": "T1BF64F1223780F071C9EA14349C14EA757BFAB430967A9D47379B2BED4F302E1A636356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947650, "uuid": "4de99fc9-0c4c-4a26-a57a-519ba7e05e60", "value": "83d1b8095e33f74e23ddae505b88bb37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947650, "uuid": "ed2715cf-40dc-4d9a-b310-7a685b2d5c3f", "value": "6144:Qt2ek92mLLN+tWxyIMd6sGWfmFf2AVMmRovjsw:Qt2x92mHNmWudp3Q7Zov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675947650, "uuid": "cff57562-b540-47bc-b274-7d12010bd75e", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675947650, "uuid": "f7406c2b-00c3-44fb-ad2e-ed65e4c4a109", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947650, "uuid": "f3074037-4199-4056-93b2-d01802e038c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d613e6b-a88c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675955606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675955606, "uuid": "d9039ae4-2779-4ac4-8fc6-2e0ea19be213", "comment": "Malware payload (Amadey)", "value": "06e4716454574e92d0c2b5458b9f4d5d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675955606, "uuid": "9215945b-e664-444a-97e8-4566926e32d2", "comment": "Malware payload (Amadey)", "value": "20df023dfbfdd1406638cd54eba2d4f9aeb891ce0213ccc58d054415e1a17096", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675955606, "uuid": "53c33172-d1eb-407c-a2ea-71b8d23da2d8", "comment": "Malware payload (Amadey)", "value": "dca609f1afae469219e93eae86ee1872aa9fcd68", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675955606, "uuid": "d6541fa8-f433-42d3-a54e-7b6fca818c1c", "comment": "Malware payload (Amadey)", "value": "bc0e2674ffa352b89d71dde147abd61ec2a8c011892b517ea78843ee3cdb6902215870b1f155aa1de5e4ff02e1529670", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675955606, "uuid": "0a4b53b6-fca3-4047-b1cb-876d2abd6bdb", "value": "T10FB40207FBEC8072D9B657B01DF702D32A367E915B34835A334B6C1A18B2065B93676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675955606, "uuid": "5c9df2c1-927b-4416-886a-3d7bfc1c6558", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675955606, "uuid": "ab2f3637-2a71-4ba8-8396-15780a8ff242", "value": "12288:eMryy90PlETAZVdZJFMKgM8Dsjax2rYUOqRr20YbGFho:4y94Vdm1gjKNHqRr20Fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675955606, "uuid": "918c5fce-c808-49a7-9265-4cd4124609a1", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675955606, "uuid": "30a0c0cd-d28b-4e81-a2bb-ea1ec4e01c17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675955606, "uuid": "429bc683-fb16-4e14-812f-d76d1debd539", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8fe77c-a868-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675940436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940436, "uuid": "f4e05a87-069e-46ac-a664-42e8f1fde0f5", "comment": "Malware payload (GCleaner)", "value": "c26492f34adbcee974c0156a372c2008", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940436, "uuid": "550f6a84-1ad4-4ab0-b086-e4da10490435", "comment": "Malware payload (GCleaner)", "value": "2105f868846388412f04e41f7881572b568f9579b3a5f568bd0de895035d130e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940436, "uuid": "b1987e9e-4950-4c1e-bf41-f5fac5787295", "comment": "Malware payload (GCleaner)", "value": "5a7caf643ed3427446dd0e111b9d3f6271f8bb11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940436, "uuid": "38709c0f-c491-45e3-b859-23e16581c3bb", "comment": "Malware payload (GCleaner)", "value": "b2a174bcf1a901b75a56ef44a7ef34719942531042cbdd14214b8e730212b69bafa834b6c04a58e5a539ab606e011550", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940436, "uuid": "d72f457f-6ee0-4ad2-b705-664d5f32ae3f", "value": "T1A9C5123C7255C5ACD280FE758C3A98F76CE66DE3E9A0A46270D8BF3F917A1445A0E503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940436, "uuid": "ab34159f-7c65-403e-8ca3-c481e98cbd83", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940436, "uuid": "c714af98-71f6-4ab6-b2c6-ffeab57706c7", "value": "49152:rdHWrAeJpXL2gjvARIpBvC+PettZ9SEcgiHvmDOcP+RN9WfnrLCgv2MR:JHAAeJEiA2nVWZ9hcF+DOcWP9yv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675940436, "uuid": "4f59c5ae-638c-43db-a610-b433219ac57b", "value": 2500584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675940436, "uuid": "20aaf033-f15e-4290-9b2c-b67cd0c771e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940436, "uuid": "65d2f783-41cf-4fa2-be09-517e3f90ae56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f11d03-a894-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675959325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675959325, "uuid": "5b43fff0-0636-40f0-8546-608ad943e1d1", "comment": "Malware payload (Amadey)", "value": "a24b33edc90a1c1b938583167dd78427", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675959325, "uuid": "78a14405-5688-4a63-96b3-4ecc83ab9a76", "comment": "Malware payload (Amadey)", "value": "2108093d0fc909d06634ac8f6b1b9186f25fa018aaf53fd347baa9bd3d4a04d5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675959325, "uuid": "2b0358f5-4901-4c82-a59e-764ed95279eb", "comment": "Malware payload (Amadey)", "value": "1cf40f7857694538b0c4210a9ed7ef41852a36cd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675959325, "uuid": "e55ea12d-8850-4166-89c8-4feed164ebcf", "comment": "Malware payload (Amadey)", "value": "5ebcfdb3bc8512d160f0f3d3d16ef4258a15feee30e41b2098c7663fb03bcefbbb02a3f4076cf961a8ccda2594bb452c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675959325, "uuid": "1230fe8c-ed20-45eb-9579-31bd4eb400a6", "value": "T1D9B4020BA7DD5072D8B1633059F603C31A36FE612A3C929B274AAD5A1D731B4B73172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675959325, "uuid": "247dde0f-2a45-4bfe-a7a5-26c36d3c42a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675959325, "uuid": "ed5ebccf-bebd-4ebe-9112-14dc53f93b2b", "value": "12288:bMrmy90ogmsKyJ1LXiDJ0mFbDB9hZlFm6:lybsKyJxXAemFbDB9blFm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675959325, "uuid": "47e04c05-809c-42d8-93f4-2c1db2f96ddf", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675959325, "uuid": "409fcc5c-0229-42fe-8a26-e2d7154e0a70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675959325, "uuid": "a2be2bac-acaa-4af7-9ee5-45d661c41285", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071a5d2c-a85b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675934443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934443, "uuid": "f1f91e5c-f396-4bdb-81df-afe0651857bf", "comment": "Malware payload (Loki)", "value": "bf731f9ae63b2a6f2ec89b3dc5e5cf09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934443, "uuid": "2d804712-e07e-4121-99b0-31bdba41dd76", "comment": "Malware payload (Loki)", "value": "21b866a6443ad4f626f2b192c09cbd81802f36bb7df8c1c6f0fa9ef416d6ed1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934443, "uuid": "4b8ac466-935a-4daa-be98-a207c3b49c40", "comment": "Malware payload (Loki)", "value": "c8e2b9ce9545d1db535919e240c300996dde6ddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934443, "uuid": "f2a43649-264c-4d8f-9294-1d63f9cae157", "comment": "Malware payload (Loki)", "value": "185d3a9fec4a968a65db17f0ef9fe159195f1a36e997f31d3dbac2fa5529b398507853d918f31d6efbc66ba1243160ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934443, "uuid": "c963e46f-ebd4-4f80-ba6d-c6f2a7f77d17", "value": "T17B24129057D1D93BCCB34B311B3E93B6AAF6D9252060975F5B609F883A276C0CA1CB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934443, "uuid": "d878ec1f-3b4d-4bfe-a2f4-388d88079cac", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934443, "uuid": "39d489ae-1d3b-4f33-9b6a-ee867ae6b799", "value": "6144:PYa6w10NEcNSVOeEFHy4Wi8bLfrOCNunUGZA:PYG10NE2SJEtZUMnRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675934443, "uuid": "9d5a5746-02ce-4d77-b614-b63377543b28", "value": 211168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675934443, "uuid": "9370fa8d-a3d1-4f50-b016-b32b0e565aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934443, "uuid": "96624943-3d13-4a0f-b28e-34f0e1da982d", "value": "Golden-Yara-arrival-notice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f196fb87-a8b4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675973061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675973061, "uuid": "eb70ce58-15d0-4fd5-9950-b18513d10f57", "comment": "Malware payload", "value": "4cab0cca75a7c079bcd447640ce3591d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675973061, "uuid": "eb28d772-8278-495e-b555-c316547c20e4", "comment": "Malware payload", "value": "21e2d47602ceb9d4b6037fc8f388111a6651011af86aee1172de5aaec604144d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675973061, "uuid": "44053b7f-9100-4d49-9215-b4a01884a633", "comment": "Malware payload", "value": "67e891ee29d1598d6f14708b1aac506a4c7e2d80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675973061, "uuid": "b71ecc5c-d056-4bbf-bd48-486beeca04e2", "comment": "Malware payload", "value": "d0804ea50b31932bad86a709206d8364986e916f80e3149336534505a4a518e21151e0d714977ba7c4182e6ca3656222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675973061, "uuid": "3bdfe53e-728e-4d09-b6b1-10d32c665c87", "value": "T1CCB40217E7DC9132E4B1537058F703C3193ABDA09B78939B274A9D6A18336B0A63537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675973061, "uuid": "fc91e1cc-d548-43a6-b5cc-f64dbf186ada", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675973061, "uuid": "158493a4-81c8-4b0a-93a1-7d46b47a3d4e", "value": "6144:KPy+bnr+xp0yN90QEssv56W/zmQmrlnDy7tBdosg9HqCcEInFmuG9W1DVMy+keoa:5Mr9y90rk2ilE+sRZFmp96X+5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675973061, "uuid": "9c5d1140-4cdf-4887-8e9d-198fc590ffbd", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675973061, "uuid": "5bf54c28-3ab8-433d-8e32-efa63f445351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675973061, "uuid": "7add1c04-b173-45b1-9e37-be884613241a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81745d32-a886-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675953116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953116, "uuid": "d03cf052-44de-4d84-848b-5e91285a013a", "comment": "Malware payload", "value": "e848d10d4074e019943e113da0527072", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953116, "uuid": "5a1a281e-66f2-450a-bd9a-b99a91eb5ee2", "comment": "Malware payload", "value": "2357440b001c305cea39c098fbf7fd0d3c5de46f123ab2b8de56bd1b215b87c1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953116, "uuid": "bea12bff-821c-4766-bbcc-881709232676", "comment": "Malware payload", "value": "740ddae293bec91bfccb8558b91cd26a46c4ee8f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953116, "uuid": "e4fa7e27-3d43-4235-af06-5934d48781de", "comment": "Malware payload", "value": "48d18736033cc2c53d722d5a4e1e6c4a41b11cb0db62b5e9d123d046ecdf5e199e7ec35ffacb507452ba8bfb62dda5ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953116, "uuid": "aff381ed-097f-4577-be31-fe8987705c61", "value": "T1360339556BF60032F5B31A30A97444A6DFBEBC226477E46FCB800E5D19B0942CA3DB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953116, "uuid": "e3b0db54-9933-4639-886f-acf75c613db6", "value": "f5e4c8acb92fb1c8223cff431020dba0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953116, "uuid": "9f03eb80-676f-4eb7-b87b-0ae1006daa32", "value": "768:W8kr2D6AKlLO+SNhBgCHDck4MV0ggv8KoETBB9D3xvjHhx4eC7Xj8Qc10A:Z/6A0q5HDR4oWBx3xrBx41z8QcGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953116, "uuid": "1e8d5c6d-924d-4398-b7e3-b7a1e7e52174", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953116, "uuid": "bec1ad0d-252f-4171-8a80-c6798610db04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953116, "uuid": "44506b6e-eada-4c75-a096-5bfc9cdf21d8", "value": "2023-02-09_e848d10d4074e019943e113da0527072_lockbit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c824caf-a8ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675969751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969751, "uuid": "56d336e7-82c3-49ff-931b-476638ed5945", "comment": "Malware payload (Amadey)", "value": "b2cbeb04fee9d6ac178b7ed677530fed", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969751, "uuid": "3d553bc0-0bbb-4c95-a91e-ff837dbff8d1", "comment": "Malware payload (Amadey)", "value": "235b5dfc4dbfdf439dbe726800294d3dde5df3e7d3d6941f971f0f23976012a2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969751, "uuid": "304a1ca1-bd05-49ea-83ec-01f6e64e92ee", "comment": "Malware payload (Amadey)", "value": "ea4ad13ee217295408ab9eb7978637c3e9e69a17", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969751, "uuid": "d813c549-94ea-4efc-a618-564c7544654d", "comment": "Malware payload (Amadey)", "value": "9ae18caf86680c011b3083542ccb332bb8404546d7b36610a433609634319a58a886cb38c02016671e64f13846a49ec9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969751, "uuid": "46a2d595-a3d0-4eaa-a0a5-1fa907f4e93b", "value": "T12AB40247EAFC8022F97517705CF207C316367EA29A38839B674B6C5A1D722B0663473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969751, "uuid": "e453526d-d1ac-4b6b-a285-2a9409a72f6d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969751, "uuid": "f37386bf-6080-43f5-be3b-84a0288584eb", "value": "12288:IMrVy90lW4QbXfuW2vevx7aQTUoOFcx15JY:tyrrS2vx7aNoOFcx15q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675969751, "uuid": "c8742af8-3f41-4859-8c68-49e4759a24dd", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675969751, "uuid": "6b3348f9-8f2e-4862-a495-95f1103a8a29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969751, "uuid": "c544da85-4e6b-4a9d-9026-f86776dda005", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0926afe6-a84f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675929292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929292, "uuid": "9e358bd4-81f4-4fc7-859a-c671bb4959e4", "comment": "Malware payload (Tofsee)", "value": "4d04a03c1a89f93b812652d41d0867df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929292, "uuid": "6a2147d1-70af-4df1-8fc0-2790c8670dfe", "comment": "Malware payload (Tofsee)", "value": "23842eb9a19e4e36e467fb6cc7557fe6dcf6ff2b29e283683bbb3d0d0664418a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929292, "uuid": "d1eec82f-ce00-4a73-8a7e-09f680e3d506", "comment": "Malware payload (Tofsee)", "value": "75f7494f5879da39030c98b22a785ed315eb03af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929292, "uuid": "85c46c8d-abb0-41b6-bdb1-cfeae34b1dbe", "comment": "Malware payload (Tofsee)", "value": "0b61adee751af47a3c1b1f4638b5b13db280ccd395e6a67736ee58bd14cfb66c6c62621de05e349cb8636689aec8ede1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929292, "uuid": "b9ca467e-5673-46b9-a9be-17519fdc4571", "value": "T1F814E02236D0D072C56B60305C65DAB66BBDBD30467D895BB7A81BFE4F332E05636382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929292, "uuid": "1d1715e7-ca75-428e-b27d-00252dead7b6", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929292, "uuid": "5b0164e9-9d91-4364-8b12-f4d686a4d32b", "value": "3072:zNqUO0nY4wuj3L24pWid5zqPMuuaygqCvER8qCroHeEPeu:xqUcerLRph9uR9vEyqCraeju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929292, "uuid": "06b7980e-f6d1-41f5-91ea-0f31ef63beae", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929292, "uuid": "8f75bd48-a571-4cb9-95c0-d712ea154e84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929292, "uuid": "5b165e57-d80d-4545-9cbc-e8fe826070b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33dc3947-a881-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675950839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950839, "uuid": "206639fe-bafa-4783-9bf5-463e0ae8d8a9", "comment": "Malware payload (Gozi)", "value": "1ef288b64ff0075bb2ff354850e190f6", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950839, "uuid": "41c39a23-d225-4cda-918d-16c4fa1d974d", "comment": "Malware payload (Gozi)", "value": "2398e78001b8443dbdd9ca47d6c355d169e6ee4b974bdfa205a00293cba6101b", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950839, "uuid": "93cf8275-6e3b-4da4-bda9-1bb91e1fa180", "comment": "Malware payload (Gozi)", "value": "c921ea337b90d3c086d695e910d4a70b64f07adf", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950839, "uuid": "ed56703a-0bd5-4e4f-92a4-83fe46d387d8", "comment": "Malware payload (Gozi)", "value": "1b3cfe69d15a9b094eedc36c6fb07f70dc08d4496abbab16f901e84ea5f75bf36f2a65a1e0610e8efec839bfb23f03fb", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950839, "uuid": "ca0ec5f4-b83d-4ec4-9b4e-220063be3f3f", "value": "T149C022198D4DC0A1D102880AA058FC68AD0EB0840CE78C6C22C3CE869C400C0CC08ABF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950839, "uuid": "c0b34bd8-095a-4f9a-bc23-35d10e47b00b", "value": "3:HRAbABGQEb/4sQaRRR3Nj69QvycAI9RyJ25YdimVVG/VClAWHyn:HRYFJb/4sZRR3j69Qvyc1yc54vVG/4xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675950839, "uuid": "00b3221e-ded6-409d-8e37-b9d909e969a7", "value": 191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675950839, "uuid": "b4be459d-7cf0-49fd-afdf-3da8ae00f8e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950839, "uuid": "e2e63d59-47dd-4d74-920d-df98e5e7bc64", "value": "agenzia_delle_entrate url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f6699b-a849-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675926997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926997, "uuid": "64b3c7ae-ea8a-4ca2-a19b-56769221099b", "comment": "Malware payload (GuLoader)", "value": "32ea683186244a2174e0062a61e45005", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926997, "uuid": "137a2673-5763-4f52-b4b5-6960c19b197b", "comment": "Malware payload (GuLoader)", "value": "240ecfef1a2317e33f4555afaafcab035b4400724dee5b509ade57d2677c9450", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926997, "uuid": "ff6ec701-6c53-45e2-a754-45f8dfebbc94", "comment": "Malware payload (GuLoader)", "value": "a7b3245b54506d15fe4aba2697a909945d25a291", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926997, "uuid": "40fd9dfc-b485-4f13-9ce0-54256b8a2d07", "comment": "Malware payload (GuLoader)", "value": "4d0edb51a2058d0469a4edc0f224e456ef777acb4c64fca97e3cd3e874671b68978109fbfaaf264a5a80793d127fd486", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926997, "uuid": "ba3029f3-2ee4-49bb-824c-bbf09467bf92", "value": "T108D402A9FB10D40BD6550F380D99D6685920BE503C60D963B7E37FAF7F7A2C2B81409A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926997, "uuid": "8076c4c1-0669-49e1-89a9-c3de5499cc6e", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926997, "uuid": "09996586-e8a6-498c-acea-e63df7763fb0", "value": "12288:Fbif/mHZzu6uhuQgRN6Zuj90Z2upnDCgDA/Up2bLH7qCzDBk:xif/mHZzutuQgHt90TnDCgDAcYbj7dzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926997, "uuid": "51d0d10e-f96a-41d8-b4c6-e46e4d90e4e7", "value": 632872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926997, "uuid": "53af5cd2-a146-4001-bdc5-1371205c20ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926997, "uuid": "d0a77e83-1907-44b3-b7cd-db2425a16060", "value": "Facturas Pagadas al Vencimiento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1755087a-a8b1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675971407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971407, "uuid": "d57337dc-6440-45da-bcec-c7cad580c110", "comment": "Malware payload", "value": "10f52d88f185dfc18bbd4eba3325ea56", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971407, "uuid": "c43147f0-9a06-4675-ad66-3a3d620a6fc9", "comment": "Malware payload", "value": "244e54baf7066fa4fd43439b21d9ecba195dba4acf37ae1fb734f31d25948a45", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971407, "uuid": "68b5b2cf-5827-4a62-bfe5-b93a9a6e05e0", "comment": "Malware payload", "value": "11b4a4e0e56d9ec83270305da755aef27b627f31", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971407, "uuid": "0aad8bd7-b37a-4c76-8d06-8b3c6f466685", "comment": "Malware payload", "value": "d63dfe59b4c182ff610b2849fd23e6d9ec240706bafc32ce809f0500586b56ca5a8d1a40386946b26d6eed08dffeba38", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971407, "uuid": "72e0d17d-66d8-402f-be6a-5fe6af662025", "value": "T1DEE16DDF9DCBA01B571763E6BDA22E0CBF212630D8909014BFB4E74EE724B1351416AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971407, "uuid": "ecaa0552-7545-4475-a1a3-9c7772de7c26", "value": "96:SPyUNEbJPl0EJjAr3BZE5S4dwatCu2WJ3f2Wgw9RKUzVj5q4NaM+12AVoolFnwhI:SEFF6r/TC0u2W37V5q0aM0wqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675971407, "uuid": "45aa5b64-29de-4691-b536-7ddc26f2169f", "value": 7196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675971407, "uuid": "75ab5202-6152-4d9d-8ca3-9f1897d793fd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971407, "uuid": "8aacbb7f-fd64-4e44-9a3d-345eb891ec09", "value": "Agenzia_E9.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463d02ec-a81f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675908779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675908779, "uuid": "68fce412-4611-4bd0-a376-f2e35ac4765a", "comment": "Malware payload (Smoke Loader)", "value": "2044653128dbdd815b0525dc1f189ef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675908779, "uuid": "795fc03f-447b-4718-a06f-ff4f5d30e1bf", "comment": "Malware payload (Smoke Loader)", "value": "2497220bb8be761b13f4d785bec5b73a530efbbcefde8ab59240d5c418da6729", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675908779, "uuid": "bf158f58-0c1c-4af5-963a-7679e0783561", "comment": "Malware payload (Smoke Loader)", "value": "1bf1211e185811c64d23101b1d1390fd6b41f789", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675908779, "uuid": "9489a3bd-1e4f-43f8-9c64-7b8c13944d2b", "comment": "Malware payload (Smoke Loader)", "value": "fd8139a45997c2267f91b602bd70e5df49d194535bcc0663bdfabad93f142af8c9396930faaafda194dcbd11fefe3ebd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675908779, "uuid": "4028a2e5-b135-4099-b3bd-d5bbc0bf6281", "value": "T173642B0393E17C80E56A8BF2DE1EE2E8764FF5508F4AB77512189B1F34B1172C56BA12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675908779, "uuid": "2b146ab7-75b8-436b-9944-f3ee402409e3", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675908779, "uuid": "636e571c-8ceb-4a04-b194-681a520b457e", "value": "3072:sPEzStGQtyWPRdFJ8m8WQ2PVEMrTLy0bKgxc9mh3GxCCQENe+pGSvz3:sMzStGQAAF6V2SMHKwcPxjQkeQGSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675908779, "uuid": "82736c70-f9bb-423f-8eb7-6b75df77a58a", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675908779, "uuid": "19a86186-d5f6-4d43-af31-4b9b185a3e7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675908779, "uuid": "8ef06bda-4d9b-4d51-a754-cfea88f480d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6f39a6-a841-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675923473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923473, "uuid": "2245ed65-a01a-42b6-89f1-6503790708d6", "comment": "Malware payload (Amadey)", "value": "b5786081c3aa0720405b8a1e23192a37", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923473, "uuid": "6a90e046-dc76-47dd-a0e3-29bc427143d8", "comment": "Malware payload (Amadey)", "value": "2523f82a9ec43d754b8ad3dbac0400e2f87b3b99810eb93090a26ef5696027b3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923473, "uuid": "e2b758b7-c9b1-48e6-b1aa-6a5da5a25801", "comment": "Malware payload (Amadey)", "value": "3449640dd89cf21dd2d610a294a3137b512257b0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923473, "uuid": "5974a49c-bc62-4d45-9d14-13df41c7f8e1", "comment": "Malware payload (Amadey)", "value": "cc6ac1637d013cf7ecfb2257488b15edbde5df9f13cdf2fd9658eb4c3e12d0dadfdcac81b1db2df1a12ea290cb828dc7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923473, "uuid": "d100ce1b-45f8-4bba-b9c9-2b2bc3f872de", "value": "T1F8B40207B7E88032E9B557701CFB07E31A36BD505B34879A334E2C5A19726B4BA3536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923473, "uuid": "80238e43-cfcc-49dc-964e-43b0dbb2f05d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923473, "uuid": "ba2215eb-5b34-4386-af5d-e1a2f87fb943", "value": "12288:TMrJy90mr6VSD0dksZP9hEvqiLm7skNXakELp7uK:SyWVh6sF9hEiiLezEgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675923473, "uuid": "103e197c-d3f4-4745-b462-3dea669126e5", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675923473, "uuid": "3a1d921c-2e91-43c9-ad28-bf3652bf8a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923473, "uuid": "670e3017-e85a-497f-a19c-00dfeaeee4f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e8bfe1-a84f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675929577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929577, "uuid": "875f92a9-fbef-49bc-a557-e679468d6204", "comment": "Malware payload (RemcosRAT)", "value": "12cd706e39e29bbb7e0bbffd5a163ba7", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929577, "uuid": "08e480a1-7d90-4364-aa48-d30d790e98d7", "comment": "Malware payload (RemcosRAT)", "value": "25a36b81f954ad91c1a424a3ded074d86df90234a4489d1a9cb5799d93bdf906", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929577, "uuid": "fe899158-3633-4518-925d-031ed2b5dce9", "comment": "Malware payload (RemcosRAT)", "value": "b1fb4cdc8bcea5e7b980fbaf95251258b52a398a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929577, "uuid": "f39d1fe7-d8d0-4bb7-b749-8162c8f0db7b", "comment": "Malware payload (RemcosRAT)", "value": "25d7f260a95c36eb09c95c7f26c82f2f120e7bfe50264e37868e10f0c27c63155abfa001d29298aa967d1e9c15b6f05a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929577, "uuid": "d97eae99-04e0-4433-87b3-aa1e24745976", "value": "T1FEB42381DA91F56807E159CFA9310693582078D95CA76F4FF71BFCA20339DBAE325620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929577, "uuid": "966cbd69-3efc-418e-92ff-39a4cc0c3906", "value": "12288:ctYuhJCE8JfVH/mUOkKzY0G44jzVCRORqwXFZUr54ye:qeEeH/XOtzGpjzbRqwMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929577, "uuid": "2e9d0a44-c742-4c91-a765-86584fa37e78", "value": 530466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929577, "uuid": "9575f564-8acf-4c2a-92ad-141ad0fc2718", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929577, "uuid": "e1f18ce5-d268-411e-8196-e50ba8be1a20", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5f0aa7-a8b8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675974776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675974776, "uuid": "7ef3f7fa-098d-4668-8020-04027b484a72", "comment": "Malware payload", "value": "43d5fa688fd7dd2c5fd580f696f5127f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675974776, "uuid": "404af5f9-8d6a-45ab-a95e-690cc3470fb8", "comment": "Malware payload", "value": "25d2a772f0190afbe93da3db6ae1be3ee0bbf1eae14edc444e23428bb8168e2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675974776, "uuid": "b10da1f7-5dbc-4d50-bff9-75903904925b", "comment": "Malware payload", "value": "7903e170ebb4bd0b8ff3ded6f38f40fe205b655d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675974776, "uuid": "b7932b61-80fc-4ccb-9401-8386b11d009f", "comment": "Malware payload", "value": "ff26e6a5e9b1942f0ef3bda0de0977e3cd5928a1de99089d639ca731fc0b58cc958a43c3306244b4049fd7978edbc764", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675974776, "uuid": "6d008dc9-b79b-4a57-8955-b0335802848d", "value": "T1E1B40207F6E88072E9B1477019F703D307367E506F78876F264FA95A58726A0B67232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675974776, "uuid": "b935d3cd-43d5-42b4-a749-078df5df15e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675974776, "uuid": "336f8b47-9c09-47c6-af4e-cb0b97201386", "value": "12288:YMrWy90ZriSjrHs69i/qiSx07HEggyJV7qc:Oy/uM80b15lv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675974776, "uuid": "d53d54c4-23fa-4281-876d-887244982a8c", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675974776, "uuid": "ec3f8b1b-ff5c-48a9-b5ad-1f072419c3f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675974776, "uuid": "a43d72dc-7318-4d20-bd18-ed2b36d0410e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f72a9bf-a82c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675914458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914458, "uuid": "5d18a667-78bb-4628-bd2a-d7e69ff696f2", "comment": "Malware payload (Tofsee)", "value": "c419299d65eed0ed6b9d8abd11f53144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914458, "uuid": "119ef134-e516-4f2b-be49-5be7f2685fae", "comment": "Malware payload (Tofsee)", "value": "260a6b981ec8db1c23b563777253a4764dccca768b6e10b922be41d1d21aa5d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914458, "uuid": "b2061855-8e9e-45af-959b-343433568294", "comment": "Malware payload (Tofsee)", "value": "4268cb94dc30c75763d735ab058bbb933120d049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914458, "uuid": "a196f20e-367a-41f1-84eb-dfcadbb53eda", "comment": "Malware payload (Tofsee)", "value": "5df0a32b2f9122be2f2aa9239c1285a45451f7aa4dfe19db619cb94dd63b3e6cd3fef02c5bbec3cae5c2c2ed9728e46c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914458, "uuid": "6ed0ddfd-8aaf-41f7-8c2c-4a4096c67fb0", "value": "T11A642B1393D17C80EA2A8BF2DE1EE6E87A4DF6514F4BB77512189B2F34B1172C563A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914458, "uuid": "4c6330fa-2d52-46cd-a27c-418fdee96c51", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914458, "uuid": "a9d502d3-dc6d-4345-af09-decebd825694", "value": "6144:WMfG92AFoFaSMZ9P2xlZiiotHTpQkeQGSrS:WMOMJ3MZcViiotHlQkei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675914458, "uuid": "710e880f-357d-413d-9006-1fea39afbc4c", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675914458, "uuid": "88333db9-5d37-4966-9140-007ebaf5e559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914458, "uuid": "ce6baae5-f97b-4e93-bc78-049ec6277f4f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d92a695-a8ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675968840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968840, "uuid": "97af2dc4-9317-479b-93f6-b1ef22fce3de", "comment": "Malware payload (RedLineStealer)", "value": "2268655f509935ce117652faa11a7608", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968840, "uuid": "e7a1215d-57b2-47e2-9c79-89a9ceaf7ce0", "comment": "Malware payload (RedLineStealer)", "value": "2649c8f850edd6b4078b99fb1a60cd5a98561539015bbc480489a1cba5413e03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968840, "uuid": "0cd552ff-41c2-4546-ac75-c6958d47590e", "comment": "Malware payload (RedLineStealer)", "value": "ff92e12781fecc2b4b1604c0315936940be43325", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968840, "uuid": "0c11c3c3-bdc6-471b-8b43-ef4d1a3fbf2f", "comment": "Malware payload (RedLineStealer)", "value": "74a880808ceb5c0312cc913448b5ed45fe62311e88d57e98a5befd635d27e628e9d9edcf3ad606496480e8315147dfae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968840, "uuid": "49d93527-10fa-4813-a77b-f8d129166e4e", "value": "T1BCB40207B7EC4077E87557B04CF706D31632BEA15A788297278BAC1E1932AA0B53573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968840, "uuid": "30a524e8-7be8-4d0e-91e3-8cfd5a5c7f97", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968840, "uuid": "8c82dd25-1b1e-4eb5-9995-627acffe6171", "value": "12288:oMrFy90VgcQgTQJKTLaxxjaGTENuwpIu9x0:Ny7/JmLaxxja9uwpI6x0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675968840, "uuid": "9166d74f-f9d4-4c22-9a98-761b81bd11e8", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675968840, "uuid": "6f17f312-1c17-42e7-8037-95906cd6a59f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968840, "uuid": "3f53ab6e-6a4c-42ee-a810-cf3795671089", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57bdec66-a850-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675929854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929854, "uuid": "496ed83b-ea58-49e4-bd14-3f45b9346392", "comment": "Malware payload (Amadey)", "value": "54027b182e72e2c1602f88db84d18b9f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929854, "uuid": "586e9b66-0d6d-4988-b84b-01068133b5a3", "comment": "Malware payload (Amadey)", "value": "2720869160e239b66c70ec16b761642144fac3f0397f7029180dd841fc618722", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929854, "uuid": "de0076c2-d122-4a5a-9a42-69715d4a4936", "comment": "Malware payload (Amadey)", "value": "83721af1b2539f0ee3755637175fea7b95eec95c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929854, "uuid": "08e424bf-ad42-4c33-ac11-03c5dc918570", "comment": "Malware payload (Amadey)", "value": "efc07c5fc8eb67acd13f9ee6f844e407fb96e058e06f27835cd00cc5c5d19aed89ec210bfb896ec2896b6beb4a7302eb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929854, "uuid": "17564d43-d882-4581-a7e6-765c934424d0", "value": "T1E4B4020BB6F85131E8756B7008FB03D30536BEA09B389357674F6D5E18B26A0A63177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929854, "uuid": "6f83b517-bcaf-4e22-b6da-7cac7b9beac6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929854, "uuid": "2286c460-6918-44e6-913b-8d30b173fbd2", "value": "12288:wMrTy90nWM6mVw2swX8k4f+7JqMPtAPsZP/pseIx/yhN:zy8Wvmdb8k4W48uGqUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929854, "uuid": "01c4f155-8d13-485a-94c3-4a646686c66e", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929854, "uuid": "ca4f4f02-7f55-4db4-a65c-3b4eb5b61182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929854, "uuid": "b6619107-292b-4890-8067-b9cd2a1b6cce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9612626-a8aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1675968645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968645, "uuid": "1b7d719f-3c3e-4429-b487-028d8ef844a2", "comment": "Malware payload (PrivateLoader)", "value": "2e7e8fc273a5e003afaf50be410a9cea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968645, "uuid": "ad88417a-1ee8-46ce-8006-975b58cb39ce", "comment": "Malware payload (PrivateLoader)", "value": "273f433ba1cebfad830e52490a04ca744351fc46249285ff9514c6e1ceaaf99d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968645, "uuid": "60f04ccc-7728-4033-9b4b-19f79ea9eff3", "comment": "Malware payload (PrivateLoader)", "value": "15eac56baa4bfecf8766619740d8540999f28c17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968645, "uuid": "ae5abcf3-b34e-4a1f-8eef-257a331e717d", "comment": "Malware payload (PrivateLoader)", "value": "06833d3a6312d4e65698806a2ae2900427a832b6134c7e2c780fa6f515a99c577678ba3517c31b97c99d9b3f9d7f2cbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968645, "uuid": "b25527eb-2296-4b9e-ba5b-3b56089cb229", "value": "T104163351F2849039CCA251723D294E70ADFBF1558BD58D296F7A4BCC2325E4BC80DBBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968645, "uuid": "6d6c641d-3ef6-43d4-b930-772e0b35e9e8", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968645, "uuid": "f6bd935f-fa6e-43cb-8fa3-3e99fd3c2bb8", "value": "98304:Joei5hiEsQRQpzs3qyUBYwGFQ1lAwAiKRjfxgZsW:JohrsLcqHfj1lAvtfdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675968645, "uuid": "25f9fe11-33f9-4e84-a851-ce1dda94a1ed", "value": 4292466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675968645, "uuid": "1057ad2f-5e53-416c-933d-cc2db01b9ac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968645, "uuid": "8544541c-ce9d-4382-b9e6-bfc17afbbb9d", "value": "273F433BA1CEBFAD830E52490A04CA744351FC4624928.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ff740f-a845-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675925286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925286, "uuid": "ff9e1131-b1ca-41e6-8ee4-397fe71e669d", "comment": "Malware payload (SnakeKeylogger)", "value": "bcf241c28db36b39add1c809627133d0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925286, "uuid": "59a9033d-31d5-4916-8611-c78fa9a3ba11", "comment": "Malware payload (SnakeKeylogger)", "value": "274e1169caeaad7b89691e2e2f7ec932869ed7be922aaa4101cf83c34d2a8962", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925286, "uuid": "24a0601c-5728-4a56-ba2c-c390b63abcce", "comment": "Malware payload (SnakeKeylogger)", "value": "940b59b7babf137f4d24b5e9513e7947cd6cb7da", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925286, "uuid": "e124d41f-4633-42e0-91d7-def5b81c14f7", "comment": "Malware payload (SnakeKeylogger)", "value": "0a67dfcec9e26655e5fdd5d1c6958113fb3505915a769801b2be9b56ea69ed45cb14da35a2b7aa358970679393d77619", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925286, "uuid": "d4308587-e062-4c09-95c7-54d9e61f6f5f", "value": "T1AFF2A24AE79F02A8CF810273671B1A89AABDB73DB3116561346C837433DDC6D42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925286, "uuid": "b52ddeed-ba7a-4e50-81bd-4a8c7f47567f", "value": "768:mFx0XaIsnPRIa4fwJM9RWoJIIVTWf812Y0pVxbx6w:mf0Xvx3EMjWXIVTWfMcHGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675925286, "uuid": "b1427155-b06b-49c1-aacc-5e4e74032239", "value": 37431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675925286, "uuid": "000d810f-c73a-4148-bfe0-1e9ba03098a8", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925286, "uuid": "dec83fbe-73bf-43a0-9768-07dd36a37570", "value": "Shipping_docs.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568f0a6f-a819-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675906229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906229, "uuid": "f648ab1e-1ad2-4a35-b849-e724a440bb8e", "comment": "Malware payload (RedLineStealer)", "value": "4e575e624b5d4822a17e98958410c4f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906229, "uuid": "d40760f5-daf1-4727-98df-0723e333629e", "comment": "Malware payload (RedLineStealer)", "value": "2772daff384534e0455b023285c177210bc038749038f8a41bc74e71b035d516", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906229, "uuid": "68704b26-7240-4c84-ba45-bfbe997fb95c", "comment": "Malware payload (RedLineStealer)", "value": "fe8b87a7ee4bed3f44e47e335a9759bba086c61a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906229, "uuid": "2fccca1c-fdfa-4892-8762-b047777d6ff2", "comment": "Malware payload (RedLineStealer)", "value": "bf65f0e529b21b684bb5d5c533dc06f8b54ef1a610a82b747f2eaea4d217238804fa927fa14fe1cb446cc1471ca0bb94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906229, "uuid": "ec9f204b-c388-464c-ad8c-e7afb47345eb", "value": "T12BC67F39E0A08418FC7B21FA2B1B9887E11FFA95C4BF5D2A2297C1B737387B41515693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906229, "uuid": "33510fc6-10f6-4023-a900-83b29d6fa4b9", "value": "38efbbe304a41273e24521c71d617c36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906229, "uuid": "a0c47828-f9aa-4f63-a03f-f68752d00a15", "value": "3072:+QyZ/mEHgQS7vDYafnPq/KAlTSskcdE/Zli3sI1Snq51YZAkiMJ/c7Er2lJhbJdK:+lZtHHSr/AldE/ZRA11Cc7EOJ7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675906229, "uuid": "46aa2716-3db7-4e50-94df-71b1bd1f235c", "value": 12101088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675906229, "uuid": "4fc37e19-9c3c-47ee-9484-977cf86f8b46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906229, "uuid": "80a498de-f93b-4a36-8fde-4647de90272a", "value": "4e575e624b5d4822a17e98958410c4f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77158e7-a82f-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675915814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915814, "uuid": "92dfbb6f-7a3a-4b7d-8609-d15668ebd689", "comment": "Malware payload (LaplasClipper)", "value": "69fcca0d67ac4be82b5eed6ce4f155bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915814, "uuid": "f45ddede-c1c8-4b2b-9163-6a3d9ebeab49", "comment": "Malware payload (LaplasClipper)", "value": "291003d022e462dc6ece1e0d6cf6a636520060358683596b71623f1c71a539c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915814, "uuid": "a29fae64-02c7-4917-b7d1-0b7de1669efd", "comment": "Malware payload (LaplasClipper)", "value": "64e0406663e0355b75a29220ee4490fb25725a90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915814, "uuid": "aaec953a-a7bc-4c50-a77b-dda4e05edb3d", "comment": "Malware payload (LaplasClipper)", "value": "5bfe6f816225e57d9b4cae7d14b0affc48e1f28a1fe86471c2230712f4041860d956649f5fef1d4e6ebbe0aec9c12d77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915814, "uuid": "ccd81b80-0fa6-4315-aa1d-78bc64b5fc03", "value": "T14895120393D2BD80ED66CAF2DE1EE2E8765DF5504E4BB7692218AB2B30F1131C577A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915814, "uuid": "89e14359-e60f-49c8-b8c7-5362b657caa9", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915814, "uuid": "0aba68f0-c431-4ede-9414-04906ae7b56e", "value": "49152:6zDL7X+Yep6nskNEUCeneZa6Hy4vn78HQSUkXe:mteApNEdeeZa6dYokO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675915814, "uuid": "4fece7a4-9a86-4b76-a86f-8466bf23b939", "value": 1991680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675915814, "uuid": "863b1edf-19b0-41f0-be3d-fbba2b9272ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915814, "uuid": "1253e748-764b-4e2c-96ed-940aed43d13f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9044b845-a8b8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675974616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675974616, "uuid": "243e821b-4621-45f3-8930-81eca97fdbe5", "comment": "Malware payload", "value": "377ab06087e38cc68636086f2a6587c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675974616, "uuid": "9b043abf-d06d-4e35-9430-a4615b788cdd", "comment": "Malware payload", "value": "2957b3959321a98e0a112b56a8795b3d1fe1cf96aefee832e3292bc988cca3b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675974616, "uuid": "749472a9-09ac-47ae-9c47-283bfc3fa017", "comment": "Malware payload", "value": "8da33d08a9e34558f7960e92d6007a63f5e2f4f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675974616, "uuid": "4f1fa934-e0ef-4e3d-84f7-49511a42212a", "comment": "Malware payload", "value": "fc125b577fdc46b48f84d429c4f6ddea808b24d360cd8b5b9b2135f1d93b534679e5e68245dd364800cb4f15e19992b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675974616, "uuid": "280d9e5b-996d-4c90-972d-292b9cb2584a", "value": "T14314CF1273D0E472D072F6318825C6F2267EF9314A3C6AAB77582B3F6EB02D09A75751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675974616, "uuid": "02b18ff4-503b-4bda-bca5-e0e6329aba86", "value": "3ae714bb16df7ea6110fd4db3c856d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675974616, "uuid": "31f3b589-c0f8-4353-93f0-6b2bfeb7038c", "value": "6144:KRJjp0ASReUjByTQvFXEksT3/3BH0xgn2uRFB:KRJjO5eoyTQvF0ksT3BH0anZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675974616, "uuid": "986f2b81-e18d-49c5-ba2d-eec51d7244a4", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675974616, "uuid": "856af482-4fe5-4848-9e0c-1d14f0cc5bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675974616, "uuid": "f1f1aa84-5735-4344-a5b8-f0c95367bf10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc579ed-a84d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675928733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928733, "uuid": "d35c1dac-a3ee-4c91-8253-8e45719261ce", "comment": "Malware payload", "value": "1ae2d31799e4db8168681b5aab0e813d", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928733, "uuid": "bb3e28ab-11b3-4cfd-b5bf-6659a6426a68", "comment": "Malware payload", "value": "29d154eafeb75a7059fc164c70ae746c6f3eb83d29853b3856d0aa8f8df0adde", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928733, "uuid": "a97dfc52-a25b-4a35-aa6c-19042b9ec6c6", "comment": "Malware payload", "value": "cc05d9349026d668e34f659e4de57719b6e75baa", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928733, "uuid": "787d0ca8-ed6b-4142-bf4f-8846c8663451", "comment": "Malware payload", "value": "120f6a689601b38ca960cc29cb668c1471dfe7303fbfdfec2a18c2ba0d639455b8f19155ee43c20eed181630fb48722e", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928733, "uuid": "4129babd-da59-4325-beae-330ec3e025e1", "value": "T17A53E03076865175C0F9BCF5C687A521450A9BA302221BCFB9A7254FFDE5F80DA432EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928733, "uuid": "190de298-a93f-43e0-9c52-1b6084319a98", "value": "1536:IL6Re1INMzCe2RmVd/7Z5IjtRyh9x/UfEgJ8:IKNMWe2RmVdzIBR+x/UffJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675928733, "uuid": "c3e0f940-8040-4ad7-87c9-cc5124f15298", "value": 64552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675928733, "uuid": "fcf0f8fe-491b-4ac5-a418-b8355bdfe953", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928733, "uuid": "4f3ec1c5-279f-4626-8c82-299869410122", "value": "Shipping Report.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc689d45-a8c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675978153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978153, "uuid": "be5a0fc6-094b-4eff-905d-1ab08b4b38bf", "comment": "Malware payload", "value": "630bc6e458d9eaa66e3bccb6e2e8e488", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978153, "uuid": "bdade3d4-3bfe-48cc-b8ab-bccf1a3230ba", "comment": "Malware payload", "value": "29e60baab55448478429cffbfee63eb72691ef13c9d85036ca329dd573a934e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978153, "uuid": "e169e094-83db-4f30-9985-c3874a42c099", "comment": "Malware payload", "value": "3469177c48335a60d1ce4ffb5e01fe2787c5923d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978153, "uuid": "12aa4acb-52a5-43c4-be6e-cd5174d2fb6a", "comment": "Malware payload", "value": "72ae01a4da973737cca00b61d638298d9728261308e2e91bff7b5f082cdc815c6f270ee8166d4f37aabca9cc3527a6c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978153, "uuid": "0293fc07-5eb2-40a4-8527-6af3626a7b36", "value": "T1AEB4021BB6ECC133D8B51B702DF203D31A397D519A38839F268AAD4A1D72574A73136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978153, "uuid": "79e0ce5f-95ec-4957-b22d-dcd85c476be9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978153, "uuid": "25f8b83c-a878-4543-ab69-b23f4343b46d", "value": "12288:gMrGy90ua3U+wLNT2iz6DRY9EvW0vELKDsV:2yN86siURYq92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675978153, "uuid": "9f05c7dd-258e-48e1-ae9b-36a8948def4b", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675978153, "uuid": "be484a4a-9bcc-4d29-a190-9c0080172aa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978153, "uuid": "6afb0c7e-258a-40c0-ad9a-4ffb4c6a3010", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74830305-a866-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675939351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939351, "uuid": "b21e7601-2469-4c35-ad13-007f87194d43", "comment": "Malware payload (Vidar)", "value": "b57f210e5cc5a837428e875730351869", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939351, "uuid": "ed30919c-94d3-43f6-9638-9d97f52f3457", "comment": "Malware payload (Vidar)", "value": "2a0e3a1a6d6bad4374a6cb4a81eedb71c62851794570e6c1a34a50934da503fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939351, "uuid": "388749a5-ed05-46a2-aec7-089aec2501d8", "comment": "Malware payload (Vidar)", "value": "5260fc6290c4db2d9b7db3f7870630fa992e9f84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939351, "uuid": "b3967cf0-e8f3-49af-b532-e6d8b8228441", "comment": "Malware payload (Vidar)", "value": "9efc69e80f6d7589ce52e7b61315f385b60aa725666c66d44ff494ab9e00c0311dfab00d7e659bd1559d163ecda9f329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939351, "uuid": "6e2e85ad-c54e-42af-8808-c75c4e04a3da", "value": "T11B14E0323590C072C42B24349875EBB56F7EB83096798E5B7B981BBE5F306D1A732346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939351, "uuid": "82b1284a-c9f6-4a2d-bc21-649c70facbbc", "value": "83d1b8095e33f74e23ddae505b88bb37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939351, "uuid": "73400e2a-6591-4c38-8c15-15c48fb2bff7", "value": "3072:vhOORNBlU2tQFLE0kWoh5KIauA9BhQFHoD1TuN6pLIzdUjcgW0z:vhO2iFLnkmaFHsuN6pLiPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675939351, "uuid": "26d703eb-72d7-455b-bc11-7b9d922862bd", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675939351, "uuid": "5877d6cb-5231-4c9d-a534-8307acc4d5cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939351, "uuid": "7b12297a-1646-4861-b102-02b5ce383cd4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54288b09-a858-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675933284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933284, "uuid": "aae7a34e-3d46-4b68-8b7d-361032d4624a", "comment": "Malware payload (Amadey)", "value": "1b9742985e82c2a22b1e1128f43a0884", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933284, "uuid": "dd425c12-6008-4afc-9d41-03c0c9f02e35", "comment": "Malware payload (Amadey)", "value": "2a174808a1302b87c1c934cf4d85cffc3aeda4bf1bf4142a10fb02cc06a7031e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933284, "uuid": "0c9d6577-35c9-495e-9ccd-79c89aabc7b6", "comment": "Malware payload (Amadey)", "value": "b2aed863a5e2dc24181936e57fae3592c7ad383a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933284, "uuid": "8b52b619-845c-4205-bac9-11c122e936d9", "comment": "Malware payload (Amadey)", "value": "f2bb52d07ccc2f4b5384acdb4e4a673f031a34c6eed82e7f60fd8d6e488dd5359b04a03b973a7812c5f14ce5c302abbc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933284, "uuid": "ca13c318-33f0-46a3-bac9-e01a53278f18", "value": "T1CFB40107F7FC8032E8A55BB048F747C71A32BE616B35825B234A599A18735A0F63177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933284, "uuid": "1787f55b-5c7d-444a-9585-9d0fef0ba9e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933284, "uuid": "163eecd4-c280-4e73-aca6-2388d1ee5d72", "value": "12288:MMrTy90zcRPNVmzhN7h5oGos4pg1f3VJrS8:Xycc3VQPFh4S1fVJrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675933284, "uuid": "bab1ddc3-2ff4-434b-8458-2e176f4e436e", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675933284, "uuid": "66bc8b4e-0b72-4e02-9505-e38969c227b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933284, "uuid": "d9ddfb64-939d-4733-b0f0-c4a0223b0a93", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88b5739-a8ad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675969959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969959, "uuid": "404f3493-0dd0-44f3-9ab1-1fa23e52efb1", "comment": "Malware payload", "value": "3626ac1650be6760e78b74a020497af1", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969959, "uuid": "038e8a40-5576-4752-8f57-9e9c114feba5", "comment": "Malware payload", "value": "2a4524ca5890d27b697850d6dfdd9fc90bce87b471f95855ced8a7308fb8e5cb", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969959, "uuid": "b51f8962-ac23-41fb-9607-0fa00221e710", "comment": "Malware payload", "value": "81d935580f02ea3cb9f183cdf119a71f2ca8029c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969959, "uuid": "338ee7eb-35a9-4511-896c-549be8234a2e", "comment": "Malware payload", "value": "42b5837044b843111775e64eba3feac42317d112abd05e37104d3b5a937464dcb200e6543253b266abd6e480a45a4abf", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969959, "uuid": "154a5b3d-e56d-4f5a-bcce-b8818dd9d370", "value": "T11CE16EDEADCB601B571662E66DA23D0CBE222634E8905424BFF4E78EA364F1351406BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969959, "uuid": "c6e0adf7-3377-49db-9102-e3424dad3340", "value": "96:SPL+gIPNEbJPl0EJjAr3BZE5S4dwatCu2WJ3f2Wgw9RKUzVj5q4NaM+12AVoolF1:ST3FF6r/TC0u2W37V5q0aM0wqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675969959, "uuid": "4d02c48c-8b29-4f46-9912-1a2a247a3e0e", "value": 7194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675969959, "uuid": "00f7838e-9d99-4fe3-ba6d-17e515a43e5f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969959, "uuid": "584c563a-8fdb-415d-8564-97f426ff0545", "value": "Agenzia_E2.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca0eefb-a8ad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675969886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969886, "uuid": "1f3832fa-c794-43bc-93e7-4e5d93425e64", "comment": "Malware payload", "value": "c0ff1859cb7789febe070d751b171908", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969886, "uuid": "a18e3ad9-3a38-4164-81ef-308209a34291", "comment": "Malware payload", "value": "2a911b4aff37a74ddde633f2bef4c347c32d671bba25259399c9e7ffda118628", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969886, "uuid": "40730963-b0a2-4200-abf9-bf2aa1324755", "comment": "Malware payload", "value": "126e684277539b17ede5d4ea38fd2bf15dccc720", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969886, "uuid": "55767e49-953c-41bd-adc6-68e21a871def", "comment": "Malware payload", "value": "17cd984ff7bf7de3b5b797e21b62b2501a942e2253e06492c93c7191422af400f47b161d0f8e724960c6d80a9a67eb5d", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969886, "uuid": "b5869f85-c3c3-49e3-aebe-7ab4d29f97ec", "value": "T19CB16D5552A91538D8C6C23D09C38FDEC1DB1229D0126FE5AF2BF7C6240C66A4CD3299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969886, "uuid": "b4c8d151-f2a3-4db3-93ae-155b0f625d90", "value": "96:yZfxpTGTTdXGMBh6q7daFSP7W48qbj3g2mJ8S:yZJ9KTdWSASzW/qf3cJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675969886, "uuid": "0b0e21e7-8984-4bf0-ab2d-a1e139cf70c5", "value": 5147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675969886, "uuid": "c8f1f5c9-f6bf-4d66-8835-96a743c2cb9b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969886, "uuid": "41103520-dbac-48ed-afaf-1354d844df9d", "value": "Agenzia_E5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41528bec-a820-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675909200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909200, "uuid": "d5ec972f-7a74-49ac-8067-a14e4afb7b6a", "comment": "Malware payload (Amadey)", "value": "8f09b9f8804a2f1bf187bc3c0a9b88df", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909200, "uuid": "4cddfcfd-ddae-4335-aeae-a892958b3a17", "comment": "Malware payload (Amadey)", "value": "2aa0ab4499a001adf98f920870a72309fa51c06479e7474000a1944680787094", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909200, "uuid": "909faea7-c765-4de5-a9b9-22eebedc4a67", "comment": "Malware payload (Amadey)", "value": "5699fd20500dc3a3eb27ba5d56df4432c5b9fe08", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909200, "uuid": "d6cd9238-18f8-47bd-a684-a8dd50c6b308", "comment": "Malware payload (Amadey)", "value": "d48d7ff84a36e95d3e7402cb70b7628eaecc81f71cee91e38ad99c5417d94a6fe94ef20a06d70e1574a79d125a21e9cd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909200, "uuid": "29683410-7736-4a0d-aafb-2016036848d7", "value": "T1D7C4120BE6F88432EC652B705DF143D3063ABD614B38925B678F5C6A08736E4A236377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909200, "uuid": "43672cae-38d7-48d5-996a-847950816bca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909200, "uuid": "885c1ebe-7f15-417a-b945-b08edc21e8ef", "value": "12288:7Mrdy90IZC9fQh7FvElepzed8Uq49iYA6mBwIjkzW5LB:+yFC9fQHSI6eyb6w9zW5LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675909200, "uuid": "ff699b63-22c0-4ac6-88a7-f53b67912c4e", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675909200, "uuid": "67ff2ebd-27de-44cc-b940-15a7e7e38c3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909200, "uuid": "736aa045-bdd2-4d7e-8809-b2810d2e8986", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa96e7e-a88f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675956917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956917, "uuid": "74601e0f-5d8a-4bbf-9c88-4486f76c939b", "comment": "Malware payload (Amadey)", "value": "9635e47ca2c231bb2e7d331828069c47", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956917, "uuid": "3c6ae00c-9af2-44d4-9671-8aa7af06480d", "comment": "Malware payload (Amadey)", "value": "2ac112b89fe1c01cd322056008141b06de7ec61cf1316c7d4ea39d36b6844278", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956917, "uuid": "d4ed2df3-7bb3-435e-9604-dd10ae4c9d7b", "comment": "Malware payload (Amadey)", "value": "14ba9b6887fb73cbebc8a2534c21823f90eab3f1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956917, "uuid": "384c5599-3987-4c73-ab4b-1d4399c1b4f3", "comment": "Malware payload (Amadey)", "value": "a850ed7226687b383366c02988fc54d288cf33a567548c4c9884909da389801cdaed6ce9d8b6023276b874df1f65098c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956917, "uuid": "bd5bfe10-b261-4fe3-8e09-82fe4e5e522b", "value": "T153B40217F7ED5032D9B5537019FA02D31A36BDA12B38925B234E6C9A1C736B4723272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956917, "uuid": "6163906b-3a71-47eb-88c8-eb42111a6afe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956917, "uuid": "d250e8fd-74e5-41ed-8c81-19c2f5df7c2b", "value": "12288:IMrfy906YsMVKRKwLLy+vDJ02FzD06aFKAj:nyOFVYLG+Le2FzD0NFKAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675956917, "uuid": "f0e09377-c956-4394-8e69-db7a5e3b6355", "value": 531456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675956917, "uuid": "201c39e1-43fb-400a-9c93-38df66d838e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956917, "uuid": "80534b9d-23ed-42b2-9b19-e2839e1d4b65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4158d507-a856-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675932393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932393, "uuid": "b985e016-4e24-4945-bc4b-bb9b51f52336", "comment": "Malware payload (GCleaner)", "value": "910fb997010d80fa819c51dceee46ebe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932393, "uuid": "eefcbd32-f664-49a2-aaed-132a938beb48", "comment": "Malware payload (GCleaner)", "value": "2b0f23f86da23c1d86ab4c6428f3412fdf5dadad98b6eac7dbafb92fe145eca7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932393, "uuid": "07e316ff-0d07-4d44-b0d0-905037a8e6c7", "comment": "Malware payload (GCleaner)", "value": "9b080e617159c74c0c78cb4acbfd143025c524dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932393, "uuid": "53e06246-c605-4236-8d36-f98fbd64933d", "comment": "Malware payload (GCleaner)", "value": "75c4f5e350a8910c10f60b7dc873e833ffaecb7c4c672afe4e3cf3bf07d7d81f3f7c956545a6a2992b54a648d98d4434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932393, "uuid": "25558403-91c1-4887-af9e-94b8bf95a6e1", "value": "T109C512BC7245D46DC280FE788D3A94EB5CE76DE3E9A8942370D97F3F9279188460A143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932393, "uuid": "e9dc471d-8a7e-49d7-a3c2-efddb36533c2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932393, "uuid": "35393aee-b8bf-4b49-95af-aa20c35f7353", "value": "49152:rdHZiLoSMlYF5epv1Napat5p+z1QAzCqubf+/jTOF3guNw6ISpbIHOcLCgv2MR:JHZnNYo1NaoYz1UquL6eF3gSwTSpncvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675932393, "uuid": "17d0f031-742d-4318-8b4b-fa2714e5ce57", "value": 2714763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675932393, "uuid": "ceb3faeb-23e8-4f18-bf2e-128e25f4f386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932393, "uuid": "ec30de85-8609-49fe-ba10-6868b63cf94b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75065503-a86f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675943217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943217, "uuid": "0daed47e-c6b1-40cb-8b22-e2f3287cb19d", "comment": "Malware payload (RemcosRAT)", "value": "92d263da49fac63239968c2d3ccdf1cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943217, "uuid": "23039510-b119-40a7-9782-3c3522b1423a", "comment": "Malware payload (RemcosRAT)", "value": "2b15cca7549feeb9015dc13eaa7d6aa7042afbc254798965444f1190b4453b10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943217, "uuid": "fa151292-8129-4287-a8c2-6bed26672acd", "comment": "Malware payload (RemcosRAT)", "value": "062473d89992d5ab46809def8a60e54a766b8cb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943217, "uuid": "afc3c94b-c177-4b8e-8d35-bc7a6685ba91", "comment": "Malware payload (RemcosRAT)", "value": "325674206d7349d6f45b5506f8a0b3eb2227c7c2708e7c572f372e0b6337dbf5b5cc69766d4afb02511688b41dacf92c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943217, "uuid": "cb9ba904-18a5-4efd-99bd-513f62245020", "value": "T1FCB4231F72F1C462C90607720EF5B67A2DA5B88734E8D14B27732E267471682361DFB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943217, "uuid": "7e8ff913-f2bb-4f76-bc30-08b628ca02d2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943217, "uuid": "6a86ccb8-f8d6-42df-846a-eac2976cd1de", "value": "12288:/YJavaCJvUrQQR6YTtdyfcGjjLu2AqeTN:/YJGTJoQQRRTGTjLJEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675943217, "uuid": "99b86f8e-54ab-4d19-832e-3ca5628f2de6", "value": 542659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675943217, "uuid": "87eb105b-058a-4b11-be7a-0ef42acf9462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943217, "uuid": "16df9fa6-6ba0-4d28-8ade-588b93cc1ebc", "value": "BL-SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cde58b6-a8ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675970154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970154, "uuid": "2065e9a4-6ec0-4317-af84-4b2f6fcd23ec", "comment": "Malware payload (Amadey)", "value": "4627b6e9c3dab3e65de8fcb46708436f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970154, "uuid": "1f3da907-dbfe-4bb8-81a3-579e6a577f68", "comment": "Malware payload (Amadey)", "value": "2b7714dce5b85b138a37033718ee8e8ac5198110746cf1fdd9377fbe835c1529", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970154, "uuid": "702d4877-2ccc-4dcb-b63a-86218ef77b9c", "comment": "Malware payload (Amadey)", "value": "5eed125a12d4265ade879f9c18f357912004c434", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970154, "uuid": "99b79a13-37e2-4a50-aaec-e9322e282c43", "comment": "Malware payload (Amadey)", "value": "975616ca2ff6c2f84b3fa286c3349ab9f7111b2fe41b20369320c0e80137366eb4afa1860dd7a11ce7397b9151d22e70", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970154, "uuid": "56ee9e5b-e6ff-4221-8efd-e23898d44dd6", "value": "T1E8B40247B7FC8062E8B41B7068F603D30632BEA16E388397274B6C5E1D725E4663576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970154, "uuid": "45e8dd66-d1b2-461e-a397-7d96e9d7b9d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970154, "uuid": "06186153-924f-4988-8e5c-24f944b823d9", "value": "12288:2MrRy90W0HXTanV1qhP6+JbaxxjaGTOoNv77aeV2h4H:LyGHjuVsnJaxxjapoxZa4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675970154, "uuid": "6d245253-9fce-4e3d-93d4-f0c0ea2a8157", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675970154, "uuid": "09b0d42b-cd96-430f-8ebd-552d0a7c8b3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970154, "uuid": "7843708b-6a38-4391-9bcb-73258315d921", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db531ae-a85d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675935393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935393, "uuid": "b042e902-eba4-46ff-a270-7b98eece39df", "comment": "Malware payload", "value": "b791d7f4851cf8fe87dd17d200b4a302", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935393, "uuid": "cb80b163-498a-4750-9948-e8095331b0d8", "comment": "Malware payload", "value": "2baeadb917998200be9cc6561903dbfe4807d288a103df8ead3a4400c4cde19f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935393, "uuid": "b495f2c8-6ba0-4cd0-81cb-ba8d7dfc4e11", "comment": "Malware payload", "value": "8a791a21ea2461528f171132fbda934b52fbf406", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935393, "uuid": "99555838-9dfe-4144-93f2-9bab047cda75", "comment": "Malware payload", "value": "741fc5359da45925727e7e66c87348e0d7eaec5d5834b174be720db7d06488ee136928f1652bec35f498ad6f0d95ed5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935393, "uuid": "80009d40-dc87-4582-b66f-dfe273539a15", "value": "T1B6473322B193807CE9B70D7699F398410D7A7C2708F01582ACB4E5FEA839EC89D75797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935393, "uuid": "35ad5db7-218e-4993-a4e3-3c811927ba5d", "value": "48aa5c8931746a9655524f67b25a47ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935393, "uuid": "9068ebfa-111c-4fa8-88d8-2c8a98d9886a", "value": "786432:zKbAoJdnz3Bk0tgDH6aLUE/Rtusl3M2qy1:GbPPzBk04j/RtJc25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675935393, "uuid": "5253bd07-39a0-4858-9e95-0bd41d3a7d00", "value": 26396728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675935393, "uuid": "a6b3ccd3-9daf-424b-bc87-0e28cb86a53e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935393, "uuid": "6468d4ac-7654-4439-bd2c-6c4f14531adc", "value": "iTopVPN_enseo_hp_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95eb727-a8cd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675983705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983705, "uuid": "9f223e66-1c51-4734-bf18-821678385957", "comment": "Malware payload", "value": "0a1ef0c1a56c3713aa7a262328d480eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983705, "uuid": "6401a0d4-b499-4965-af3e-3efe9c6413b5", "comment": "Malware payload", "value": "2c8c55315135b674d65d15e7e4b8892b40bf0cd96249b775189bf25eac71db11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983705, "uuid": "20050cc4-d93b-4162-9f5c-c9bffca5125c", "comment": "Malware payload", "value": "948619ee8152ba91def5b363a96dbb0c726af2ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983705, "uuid": "8b5cd19b-fac6-43f9-b512-c57ea13485a4", "comment": "Malware payload", "value": "53662d893b7ee2e12d2e1a2035907e39c90d5a005e9f7b9d19f8287c752af3aa68438d5b34d181216df91fa7cb0c475c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983705, "uuid": "7235b158-eaa9-4015-84fc-da5632977e72", "value": "T1D454F12272D0D4B2C073A531A928C6A2267EB4308F7D6AAB37542B7F5EB32D1D775341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983705, "uuid": "653fe2ee-877d-4669-9e34-5d150a32e786", "value": "3ae714bb16df7ea6110fd4db3c856d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983705, "uuid": "8f2d5284-e972-4ff4-a790-0fe2e402df19", "value": "6144:NmO1h1R2S5tXWnUcAmZfzUFX+icKBXi0tlyvXLs2yYJGm1OUp:NmOv/2gXWnUtmtwFXRcK8M2kYJVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675983705, "uuid": "1a7ee48c-6c4d-401e-a896-d8c5b4efeda3", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675983705, "uuid": "af7015ba-1607-44db-88ca-6e9dea8fc0c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983705, "uuid": "c899cc64-2130-4601-9acf-9fb09234c6b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ea9cdc-a840-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675923135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923135, "uuid": "99182a15-c725-460a-936f-494af2702c1f", "comment": "Malware payload (Amadey)", "value": "62484c6b1a1478052b88f07f9148c607", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923135, "uuid": "b1b97afd-d352-4729-ba24-9bb24b61314c", "comment": "Malware payload (Amadey)", "value": "2c8d6b3aa595d60509713eb776d04b125746c5ac621d8630e826c1a327577070", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923135, "uuid": "2e047dfa-02ec-4765-b2dc-2b3e5a407377", "comment": "Malware payload (Amadey)", "value": "5a6081a1b3c55f01f2149a24b9a3ec25047f942e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923135, "uuid": "3819deca-9542-41b2-9971-094e7435065c", "comment": "Malware payload (Amadey)", "value": "9dbfa414ecbd9175a1f41418b0cff769c361d1e3228b5112cd3b56a326b0612a751e10b424fc3a6583c3fb49dcdd8fc6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923135, "uuid": "ffd5e6f5-01d9-400c-9bb1-36150aa1f644", "value": "T150B40207B7EC8123E8B457B019FA43D317367DA15A34939A235E6D2E18736B0B63139B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923135, "uuid": "49b16cf3-f6ee-4af3-b2a4-7f541281f073", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923135, "uuid": "4130ca7c-8ee4-4a35-b902-db3cf586fa76", "value": "12288:LMriy908DsOwwr0wViYXidm3skNXaFEiZbIIVJhS:tyrsO7r+YXidg6DnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675923135, "uuid": "4437d5d4-96cd-49d1-a169-c8cbbdfd6a3b", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675923135, "uuid": "9693afea-e66b-4c61-bd25-b5a7289ac2b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923135, "uuid": "e818a0a4-ae04-4057-b095-4c54af95d909", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a79989-a8ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675969359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969359, "uuid": "85a9e804-a60e-4a61-b5cf-b87610b3b834", "comment": "Malware payload (Amadey)", "value": "924ab3479db0820238ab7690987afa0c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969359, "uuid": "d177a6cf-3b53-4178-9170-1ba239e2621d", "comment": "Malware payload (Amadey)", "value": "2c94b38c6a1a0184e0f7b486cf36e6d19ad11ab2a0b1531e5efe66a921879f30", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969359, "uuid": "fe82e165-c3f6-48cf-bc4c-806515239714", "comment": "Malware payload (Amadey)", "value": "1e2e3c0c8145815c824eb0956e52f5bef3f3a946", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969359, "uuid": "d3835b92-c728-4cd4-bf5a-c8f7cd7fe149", "comment": "Malware payload (Amadey)", "value": "6ecfe6edc549c8efc7ef1483231d4e88229ec1f9c75f0ea9e1b993fb0e9489ffeb4e536d3d9336f3618e8ec491ba902f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969359, "uuid": "a3755a9a-f9dd-49f9-b26a-33533fc78716", "value": "T1A0B40243F7ED4022E8B817305CF703D31A36BE629B7887972A4B5D5A1D726A0763076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969359, "uuid": "70359c02-a8ac-48e1-b51d-555dde49224b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969359, "uuid": "58178431-1aa8-419e-a583-030b58ad15b9", "value": "12288:PMrHy90x0Fw10LJHIrYHBxua9TfuPDrYEwh:EyjFW0LJorMxuagDrYEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675969359, "uuid": "9a03ff6d-2cda-466c-8638-68b7abb59c4b", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675969359, "uuid": "d973d36e-419c-4c41-a764-b78a0f13a8f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969359, "uuid": "e5e57d62-545f-4ca9-bf7e-6fdfa9bc3fa2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f6624f-a863-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675938228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938228, "uuid": "8e915532-a85f-4bea-840c-c16095e27e6d", "comment": "Malware payload (Amadey)", "value": "5a97d21ce21f8cf22241a10e7694502f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938228, "uuid": "1e72c1b2-6dd6-41c8-88af-9696fc4a4991", "comment": "Malware payload (Amadey)", "value": "2ca99bbcfab544860c661e62e419ebfdfc7375a16d4f4d359743ef11f36b0a8a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938228, "uuid": "dc3f4cf2-868e-4c07-b4f3-56e49fce543a", "comment": "Malware payload (Amadey)", "value": "c2155e5f22a2115ff68fb372f83d1e5328caa04e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938228, "uuid": "e2d4c9c0-fc82-4ba4-9eef-74fc444f06b4", "comment": "Malware payload (Amadey)", "value": "b063ffc9068dc89ac7458834878e6ee70b9b036c2fc7a1461fd9cdcc25c6f8008d07be9cfbc37208b0d4e9ea11876f30", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938228, "uuid": "4007215b-21db-44c6-a675-067fe2d4f1da", "value": "T151B40207E3E88136E4B167B019F607D31A367E615B384B86769E7C5A1CB36B0A230377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938228, "uuid": "176f98e8-e03a-4cf8-8f19-a5f4594681ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938228, "uuid": "1d3cdf56-ab99-4990-b0a3-d50542d5696a", "value": "12288:bMrWy90d5hAcuHlJ7f9ACORw5elMPZz/yKwjTksAbxlbUmk:hyM5h7klJOSeGP9/ZwXz8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675938228, "uuid": "4e8db66b-75ae-42a7-8188-3f8ade303959", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675938228, "uuid": "c14799c7-b51e-40c0-82d5-0dd45bebc378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938228, "uuid": "df06d344-a139-4b6a-a58c-c2790c398aed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aaec061-a88a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675954823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954823, "uuid": "5a90b7ec-38e0-4752-9a23-98569596b14e", "comment": "Malware payload (RedLineStealer)", "value": "9c89a63889bdaf2bbcc92b91b65fdd6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954823, "uuid": "fe9382a5-15ac-4255-b9b0-68ce8260398a", "comment": "Malware payload (RedLineStealer)", "value": "2cde212b3f8a95fe2a1b2ddf659e3461b98cdb4fc9f7410850c5f06dee7cf03e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954823, "uuid": "d110bc15-643a-4f55-9cda-816ba8ec171f", "comment": "Malware payload (RedLineStealer)", "value": "7ab9aa382c65faadb5d0da4763be46ad390e6bea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954823, "uuid": "c8a9dc50-560f-4c56-82a3-70b8d01f915f", "comment": "Malware payload (RedLineStealer)", "value": "0fd94d6d9da9c149fb642ab15d647c39a6689ab4c562c6711ccc63a752aafbde75699dbdc1d9c6d7afd1a3e8b43856d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954823, "uuid": "8f33f172-a4c2-40e9-8e71-0ae011efce30", "value": "T12754E11232D0D8F1D476A632DD15C6B4AAFEF9214A758AA73718272F0FB42E0C67D385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954823, "uuid": "b161a3d6-e43b-4df9-a1af-90a2820250ec", "value": "910163c173a5611f34260e641a94d790", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954823, "uuid": "7d3439bb-5e1a-4a73-b0f5-be9e37931992", "value": "6144:5fctuOaHPBLu/u+z0XCTRLrwZFTVq0UIbT/8OsWLOyNsd:5fkaHJLQD0SlLrwDVBPbTbHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675954823, "uuid": "8275913b-c680-4901-aad1-b76002e7c0fb", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675954823, "uuid": "03f2de28-ba4b-4a45-9cea-2592a4d734ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954823, "uuid": "464f0a3b-f9b3-4dad-bedf-3a9f355e6608", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016fe31c-a840-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675922837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922837, "uuid": "3dd6cb7d-86ca-4e86-858a-0d3d4246a0f6", "comment": "Malware payload (SnakeKeylogger)", "value": "b8125b4c7019fd613788876a4dece005", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922837, "uuid": "9f972b88-dd1d-4f30-9e38-fcdba431a89d", "comment": "Malware payload (SnakeKeylogger)", "value": "2cee131ab571c6866a10be794fb02583f30c577d93ee9742845331294923c1e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922837, "uuid": "7c25d0c2-6982-4ca8-8c97-c67decf7df75", "comment": "Malware payload (SnakeKeylogger)", "value": "cbae87b32545eb897e3f14ad684f66438b5cc237", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922837, "uuid": "b9e58420-d7a0-4678-9e33-5714c58f4c71", "comment": "Malware payload (SnakeKeylogger)", "value": "fa1ccc153448ef2019b368eeca8af5e7dd989dca0c50157a55692e55bc4d5bc710e77dbadfc910c17ff0a3eb31221206", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922837, "uuid": "0b90b434-5549-4701-a25d-20938165e9ad", "value": "T127A57D3ED86C4137CEE8C36DE590842EF6E4A6633911BD3ED8D72384496B58278C616F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922837, "uuid": "84030928-2ea6-4e3d-9782-190b4b72b28d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922837, "uuid": "7e3d1ada-751a-42ae-8e10-817a10712062", "value": "6144:02EdiS6YNgFBZ/0uqNHEnr6SgtrA6LnjZRBLp7UCheB+VY+kgN3szIIhIdm:0/di8NKm9RpdtpCB+2TGwgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675922837, "uuid": "e88a100b-6dab-4d76-adf2-c4e77ccc5af9", "value": 2156544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675922837, "uuid": "b497c534-cb10-4364-b77d-28675f66a2df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922837, "uuid": "ae48888a-1720-4cc1-8efd-101da43d6213", "value": "b8125b4c7019fd613788876a4dece005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f32b8f-a8b0-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675971347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971347, "uuid": "a6f78f2c-9bcf-4cec-8e98-6300c9ce30fc", "comment": "Malware payload (NanoCore)", "value": "49e26af3329e45fae72debf204c0b1d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971347, "uuid": "20ceef85-8a5e-4235-9a3c-fe2d9380e9ad", "comment": "Malware payload (NanoCore)", "value": "2cfa6e2290e53959d5f6d2f9d8a4e714941735b750a710223df1db7a0758cf22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971347, "uuid": "337c0963-b177-4814-9782-75f55a29dd59", "comment": "Malware payload (NanoCore)", "value": "b7c7707fd4421f597092f963652bb37ef6946ad1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971347, "uuid": "b62bbe7d-6f84-4574-ac29-1b34fa1c495c", "comment": "Malware payload (NanoCore)", "value": "d6ccc8e753b2de19f4196ce40d1eb1dc7211669ac58255e94844fa9b0cafe6eb7f03bb2522d0d51e15ea266cd14d4b44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971347, "uuid": "6b08bff0-60f7-46c3-a938-84f299218310", "value": "T1A9C412993760D42BD55A0B300CB59B2C2A689E3569F0EA0FB3507FBEFB762512C0D761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971347, "uuid": "2f000bb0-a539-4cc5-a74a-4defa8e14298", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971347, "uuid": "2acbb2c6-c1da-4ae4-ae3b-8258624665c0", "value": "12288:UYlzjkqbUM445j0v/8BmeAWjQGEx77pD2JykzUfk471Y:UY1xUk0mmeAfPpD2ek471Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675971347, "uuid": "60dadd04-5311-415c-9464-4fcf979f3770", "value": 591512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675971347, "uuid": "5ab37959-b52f-40fc-9c71-ca0977c2de2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971347, "uuid": "86017a5a-a58a-4495-b19e-f5c74bf8f4ac", "value": "49e26af3329e45fae72debf204c0b1d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6624961c-a879-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675947487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947487, "uuid": "044ed210-2cd4-4617-adf9-e5a21430ac88", "comment": "Malware payload (Amadey)", "value": "93d1ad8ffd1e1f136563829680fb79da", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947487, "uuid": "1d755037-04af-4bcd-880d-c66d8de4fb14", "comment": "Malware payload (Amadey)", "value": "2d249d106be56938358151eb82418932b9b32d2c316dd2a5d36ff38b6aeada6f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947487, "uuid": "d453feb0-869f-4f5a-b7f4-cc3eb3cc09b3", "comment": "Malware payload (Amadey)", "value": "ae51346dd5a5ad91f6dbeac5193d59b25e4ee74a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947487, "uuid": "0cfc6246-7a86-453a-b01e-240f41b59ab6", "comment": "Malware payload (Amadey)", "value": "b76fd1a70cf9fd6e3998c893f345a1b8c9ad50f80fbd9f37f2a0f99b5ce451cf49abb2ac17be2dacc3332c27968ad5b5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947487, "uuid": "ef9bfa6b-5546-4ade-95d0-628ddb7cb0d6", "value": "T193B4020BB6E84576D8B0577408F246930B3A7E91AE3483DB674EAC5A0C72670F63573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947487, "uuid": "2f88f27b-ede6-4c9b-9588-6f68b9e8e8a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947487, "uuid": "f8882374-c1de-46f0-b275-043e67d79ef4", "value": "12288:RMruy90pvKDKW42pPs+nN3HaKxLvPLbFjX:PymodRmaNXpLbbFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675947487, "uuid": "cc1605b6-e998-4df9-9ab9-6345d13c97f8", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675947487, "uuid": "b38eb774-174f-4569-9273-1a8f07059ada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947487, "uuid": "cfaac476-0841-42a7-a768-b78aa5179efd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13fd2d3e-a8bf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675977414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675977414, "uuid": "326fc47b-1360-43e3-853f-9503ab64d6f5", "comment": "Malware payload", "value": "fb4e6546b3808502d4c5596a02704fce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675977414, "uuid": "fd869b4f-c52e-427b-81a0-beb4feb89df7", "comment": "Malware payload", "value": "2d921e3b16b6c6f13ff871cc1312f5f05fa1b952efff84713b208ea8ba5fa676", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675977414, "uuid": "64b2d23b-3cd8-4b82-91c6-c0697e46ba2c", "comment": "Malware payload", "value": "7f17c3f13000c2e4e933d3e4c7f0c47916b2a784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675977414, "uuid": "63f3b82c-7503-41bd-982e-d1a082d8ea74", "comment": "Malware payload", "value": "f54b2f4a61fcf509d6ccac2e0e2a8b02100eb93bf9e77c3e3e644856626e64f3d39aef0364461c2ac1a91f62a9b7a2c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675977414, "uuid": "c259fbdf-1d79-4070-a8b5-75de67b42215", "value": "T1E2C5127C7204C4ADD290FEB88C3A98E76CDB6ED3E9A4912270DDBF3F5179184961A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675977414, "uuid": "2288b428-7172-4d0b-80f9-3e9ee29f6c16", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675977414, "uuid": "ae158ae4-cc49-4f2b-a5b5-5c65e300d0c8", "value": "49152:rdHfc7ZOkqjz+RUyrYmKdkjhdBywV1g7brOEXyP8eWEl/NxBHURLCgv2MR:JH07Pqjz+pjKd8dBywP8f8PJWEl/NX0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675977414, "uuid": "2e63e7f1-3498-4a07-b166-ce49f154b8be", "value": 2637230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675977414, "uuid": "cb840f49-78a9-41e5-8e4b-72d56ccacd71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675977414, "uuid": "4fb36580-69fe-49ce-8a47-052b8cbdde44", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a19cd4-a827-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675912242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675912242, "uuid": "97448d6b-2417-466a-a2ac-fec005dc11db", "comment": "Malware payload (Amadey)", "value": "d501be1cd34de5b90363cd5903fa4882", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675912242, "uuid": "ecaa2402-80dd-4467-b6d7-a80ce99e6e61", "comment": "Malware payload (Amadey)", "value": "2d95ecc6eb9970d97b1b0cbdbb8aa694abac4a976647a185d91d25593caac047", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675912242, "uuid": "28c0c14f-d9d4-468f-bba8-1ba55c1b4923", "comment": "Malware payload (Amadey)", "value": "d4b56f7675ff5ca6837e0267ddc6f2f35a38add7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675912242, "uuid": "11e6b9ff-0c79-4a88-bf6c-5909363c9fe7", "comment": "Malware payload (Amadey)", "value": "6fa5899c83f799a8351126f0f19b9b7f6969f8e214a75abd810a104424dadf3a2af7e74dc3ee7f7d55d1f37e57023a4b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675912242, "uuid": "8ed3a101-f143-4dd4-addd-747a00b0dbb9", "value": "T1F2C40247F6DC8036E9B89F7018F202C31637BE515738825B128E6DAE09335B0D676B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675912242, "uuid": "23972578-8b5c-4e0a-ae8a-576475e95c16", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675912242, "uuid": "82e7c293-2b41-42d3-8155-cb9f7ed15392", "value": "12288:cMrEy90RYBIGCWKOdeBLFB37D/cQUV7qmc8ggsp/CXUQWW:4yfBIBWKOdgL7n/cQu5MKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675912242, "uuid": "93c2e984-e8bc-49cd-a70b-26e19d803758", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675912242, "uuid": "db4e0091-0ced-42bb-9fec-dab01f84bf7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675912242, "uuid": "49fd2975-7187-43c3-8596-5826d6a0de6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b4b4e1-a887-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675953528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953528, "uuid": "476a14f6-6ec9-46fa-8b59-1d5de6a1625f", "comment": "Malware payload (Amadey)", "value": "6aceca2b5dc212692d307aa30e1008fd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953528, "uuid": "8ac14e89-2a71-4975-baf4-ed9c91bb5a0b", "comment": "Malware payload (Amadey)", "value": "2da074373035de9f363c524ecab2ce96380b732a4c505b9ffaf9b5a6905faa35", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953528, "uuid": "4c574d10-9960-43eb-8a67-26ad8f2c2fb0", "comment": "Malware payload (Amadey)", "value": "efb540f368679fd7855bf626de5d1b9fde7a0506", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953528, "uuid": "d2a010c6-a8e1-435e-b298-49820540d595", "comment": "Malware payload (Amadey)", "value": "6dea2aedebfc1038fb52539600b39bc298f648b6566f130c223994a33ac1178e0ad0d1f2eb1aa78631430a0f42fda464", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953528, "uuid": "fbc4e1f0-3c2a-4bb0-8f86-23590ef673c0", "value": "T12CB4020BDBEC9022D9BA67B028F607C319367D515F38531B338A6C1A1CB22A5B53576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953528, "uuid": "0725711a-9a7c-474b-b617-7083e1ac7de1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953528, "uuid": "4702498f-96c3-4a81-ac23-a073782e6e3c", "value": "12288:MMrCy90Dp1eA+zZsYsjaV2LYUOqRUk20cQFhA:eyI/JjixHqRUk2+F6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953528, "uuid": "0500575a-7920-4faa-a402-a4baff47d593", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953528, "uuid": "fc59c0a1-c219-4716-a107-cae59fa35846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953528, "uuid": "b8fb4e86-6c14-40f3-b96c-6e286bd623cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82869f11-a886-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1675953118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953118, "uuid": "75d6a2ff-20f0-40eb-a10c-6c960dbbd5d8", "comment": "Malware payload (Gh0stRAT)", "value": "10d54267dc87cd165ed0c8c546e2bc3f", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953118, "uuid": "f194f7db-e8da-4c4c-8db5-a10db34cb2a3", "comment": "Malware payload (Gh0stRAT)", "value": "2e45f477488c99d5265e0bdd32e1e55f4e28491e0a25930127bc14f072aa0233", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953118, "uuid": "9376d133-912d-47a4-9bcf-f8f2a79fee26", "comment": "Malware payload (Gh0stRAT)", "value": "eb77c8afdfa9f742fba9512325023cc00d2fbff5", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953118, "uuid": "3d223165-5ba3-431d-98a2-d3f5c50e2509", "comment": "Malware payload (Gh0stRAT)", "value": "71248c88885f7b38eb75375dede28800e440800a4c50ab29c3e02d48e8e324e515ba9929559c768b8301f72ff065c8a1", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953118, "uuid": "d30057b6-1c33-4624-ae93-ba36d6558513", "value": "T179076C5A7A9841E4D0BBC17CC6C78A57F9B274455B31ABCB0295924E1F33EE88D3E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953118, "uuid": "eb30ae0d-4ebd-4727-886c-0d625f890f9d", "value": "eeac73be37480fd144f387e3563a0f14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953118, "uuid": "b640f9d5-3b5e-4612-bf6a-e216a6eea38b", "value": "196608:liINy2LkBNBN/O4dru11J8HqFK/Yg+QIC:ONB9dq1oKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953118, "uuid": "566ede7b-f490-47f2-9041-0aaeaf9e8833", "value": 16838422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953118, "uuid": "a305ac97-9d4b-4107-84e5-7e1c755cd301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953118, "uuid": "ce8c1562-0878-4cf2-b9a1-11f14f9d4c6d", "value": "2023-02-09_10d54267dc87cd165ed0c8c546e2bc3f_icedid", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3fed2f-a815-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675904472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904472, "uuid": "fed8be35-eccb-40c9-90dd-87c955258708", "comment": "Malware payload (Smoke Loader)", "value": "aa3f4b1dd4b58c664122fbb71fad3d23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904472, "uuid": "13596d31-9b79-4cae-a560-f2acb6d830f8", "comment": "Malware payload (Smoke Loader)", "value": "2e4e7fc72e7bdc3409bb25c80f37bbbdcec217597cca28e72694bc43555a7800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904472, "uuid": "8c8d951b-f854-4753-949b-1695b9bdb8d8", "comment": "Malware payload (Smoke Loader)", "value": "a4886cd03ea6d99c0d4fbe4c6b78426941ae7c16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904472, "uuid": "ca9b3f07-e637-426d-bf1b-fccb8b429f94", "comment": "Malware payload (Smoke Loader)", "value": "d31931f89d68c7ea228520898ec791823b961ffd1ace1afd35a9b76c843c7d7c03d79b2b1847cc01615ef4ad3679981a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904472, "uuid": "8757b360-ed1f-41d2-8fb1-74803161c713", "value": "T1F864090393917C80E62A8BF2DE1EE6E8B65DF5508F4BB77512189F1F34B1272C563A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904472, "uuid": "0acb09be-c0ed-4499-abed-d01604a0769a", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904472, "uuid": "d9335463-2d09-4372-b1a0-57511e69c39d", "value": "6144:zMagE+GAeuVM/i/EstkDaVwNOy6lQkeQGSM0e:zM3Gbi/EseDvWlQkeiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675904472, "uuid": "1bd83e05-5a28-4a1f-9167-d77918c2bd27", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675904472, "uuid": "148dbcbf-6e02-49af-b510-66d8f32018c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904472, "uuid": "7f18acd9-f575-49c1-81a5-404cfb04ca90", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ef0afc-a840-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675922950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922950, "uuid": "6d1fc1f3-499c-4d62-893e-382a0a7480d0", "comment": "Malware payload (CoinMiner)", "value": "091a8f237544900c884e852fee3810be", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922950, "uuid": "237881b7-eb4d-4130-8226-f74d6ca8c400", "comment": "Malware payload (CoinMiner)", "value": "2e5ae5db45f37a24893d17f612cedfd3f8919de5b24e8d5bf1511b2b328c401f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922950, "uuid": "5c6d57a1-ce1d-4b0a-a7ad-2378ee22d0f7", "comment": "Malware payload (CoinMiner)", "value": "791e2bbfb35a19bcb0365ad2f229d57c7a9a3c88", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922950, "uuid": "3c88330e-1a0b-4161-be13-6f0c18719ebf", "comment": "Malware payload (CoinMiner)", "value": "bb4cf5de1288b21a226d6910c53ac27f1cf53a37663e10a8b60e6943cf6c38e9b2b91a122c62a50dc8986d1147ced65f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922950, "uuid": "5d8c1c85-cdc6-4129-9f5d-c434cd193a28", "value": "T1E914D0323690C4B2C56A11719864EAA9EFBEB83046758D4B77681FBE8F303D06737257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922950, "uuid": "dc292798-69b4-4ef5-bd54-ab13cacb94b1", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922950, "uuid": "ce81632c-5f48-4502-90cb-f96cf576a946", "value": "3072:+Hq0OklM6iywj+LVj/sWWd5SYYuQaDig3g4/++0scayzHTgzQhF7zl3TOrVMw:Sq03IqL1/sQYYP2w4GZscaRQhe5Mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675922950, "uuid": "9a4e171a-834e-4434-89d2-12e4829fbb10", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675922950, "uuid": "0801c439-1591-499f-96d2-10827c715a4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922950, "uuid": "024c4671-5054-4a62-b484-c99b076e0344", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608ca285-a853-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675931157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931157, "uuid": "01087923-08c5-4040-8840-186d987ab1fa", "comment": "Malware payload (RedLineStealer)", "value": "c26df75405e0f5c7a34f003c25c4d15f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931157, "uuid": "5b59fd92-8c5f-41f7-84e5-e99ba052a336", "comment": "Malware payload (RedLineStealer)", "value": "2f60f2f40518a6f2831be0830df86284522d6d4eb67ec1c1675375a0896acaaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931157, "uuid": "bc9fd3fc-5396-49f2-9ea7-2bfce95b277a", "comment": "Malware payload (RedLineStealer)", "value": "86d9c97e64986364bc164f9c22e3f1acf92bff16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931157, "uuid": "5bd71955-2c4c-479e-ab13-6b4ee9589725", "comment": "Malware payload (RedLineStealer)", "value": "aaefbbd816932fb2e5f685d878a0b0d36adc494016dc9d0325b756a50f4820c04d27f060c431ee7186af55782982ff09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931157, "uuid": "5cc8c1db-72a2-485a-8b39-413fef59d872", "value": "T18DB4025BA7EC8432E8B1177018F706C31A37BEA05B35C367224E69561D727A0F23576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931157, "uuid": "9061125c-35e3-46de-a2bd-84adee22010a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931157, "uuid": "91ac80e7-544d-44bd-b098-01990a69ca60", "value": "12288:/Mr3y906acvXBWcLH+Q5GurJ5TsidhSHuJhgzcQ/F89FVshP:8y0oxFH51JWuM1FKKhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675931157, "uuid": "fcb8eed6-4a7e-4983-b47b-a4f0858ed5e0", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675931157, "uuid": "f734e078-aaa0-4857-9e72-097ed81c419d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931157, "uuid": "fd1f822d-4cab-4cc9-95b5-749cc21204ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00dc92c-a844-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675924955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924955, "uuid": "464c2052-7adc-4d43-872c-08e16ef7dbf4", "comment": "Malware payload (CoinMiner)", "value": "75230889aa7c6e86eb93699b8f36b373", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924955, "uuid": "aa4a49df-10e9-4024-8f7c-8ca6b10947c7", "comment": "Malware payload (CoinMiner)", "value": "2fa22ecb9fea871579ccbaf1e9f9e307b4767e5a7077cf16738aad1c88ac46e7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924955, "uuid": "4a8640a0-e1ab-4d0f-af20-c930298e97c6", "comment": "Malware payload (CoinMiner)", "value": "a6ec666869f03bf7672ca96592771b784e210acb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924955, "uuid": "4d305edc-a933-49fd-99f8-dfc0e1461182", "comment": "Malware payload (CoinMiner)", "value": "b1c02fa5a60cbd0b3179874fe80e7fc78c4dd503708935886d8dbc84542dbb973153e2cca49d4426fbc8fb64d23e7163", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924955, "uuid": "f5c0263a-b056-40a4-8a76-be597baaf696", "value": "T1DD8623FE614C375CC46684744873FD2A71F2951E0EE9E9AA74CBFE90BBA6401E907B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924955, "uuid": "a00de66f-16db-4662-bd03-09fb1286cf5a", "value": "5d92ae5c85df45b698eb8cb62ab35a7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924955, "uuid": "a6ec11ea-9750-4496-9639-bdeb082ee7bc", "value": "196608:NRcgM4Q+QqYdakmlWZtHBp21kKOO8y5GTgI1rRYqnBbjDAH:chgYd/mcZDqJUqNw/BbjkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675924955, "uuid": "c4710e3f-5f4c-4fb1-84ca-71411b3b4d7e", "value": 8484680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675924955, "uuid": "ea1f90ce-88ca-459a-bfe9-e350eaae1703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924955, "uuid": "32feb484-ba8c-4b90-b10b-d7e4ba724cdc", "value": "75230889aa7c6e86eb93699b8f36b373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27b250c-a84e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675929120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929120, "uuid": "2ce41a0d-98e0-4fa1-82b7-0db093dedd7e", "comment": "Malware payload (Amadey)", "value": "e76dc3d08f4d7fbe3993159591cb7b5e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929120, "uuid": "e6939fff-6b57-4541-86ee-bda594afb426", "comment": "Malware payload (Amadey)", "value": "3069f40b90127b6f129d7b6718cea6355db6c3075b143bc91b6406aee07145ea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929120, "uuid": "5747dd4c-9c83-498f-9686-249ce51771b4", "comment": "Malware payload (Amadey)", "value": "91a522986ced6635a9d1ce28e4680453249489ac", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929120, "uuid": "6b5df873-e2fc-41c2-97ab-75db46080132", "comment": "Malware payload (Amadey)", "value": "f91ff3f950e5efffd2929941291d67abbb71b214b71278364caccb4f084a82c5aaf8c083a1b4bf0f111d051073e1b403", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929120, "uuid": "c5923397-ccfa-4722-986b-9ac765d501db", "value": "T198B4020BB7FD9132E9751B700CF603C30636BE916B7C939B568E6C1A18725A0B531B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929120, "uuid": "afbec234-9246-4be4-bb9f-ced672360717", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929120, "uuid": "29d99705-81bd-42e8-a41f-fc5b74108aba", "value": "12288:VMr0y901sB7QDeZ6YbhA7f+7JqSPrAPs8shWtcFiIY:tyJ7FZ6+h4W4SEiEtck7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929120, "uuid": "2e89abf5-cf18-4d42-b88c-67cdd68a4842", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929120, "uuid": "b370e17e-2621-4827-899c-e92b89169870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929120, "uuid": "aaf6fdd3-125b-409b-a16d-7f03dabf9d65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ba3991-a8ca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675982220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675982220, "uuid": "4428ed33-b8e6-4bad-842d-016e2f67d3d3", "comment": "Malware payload", "value": "14e3e1675e6be10b760d65836776eeb1", "object_relation": "md5", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675982220, "uuid": "587b7cab-7619-404c-88b7-a548d8d43c4b", "comment": "Malware payload", "value": "3096fc663f6ad5bc36aa4cb7ee5cb8d4755321c0af145ec4831d053ca45d0248", "object_relation": "sha256", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675982220, "uuid": "80495363-90d8-4f2c-a3f6-e4f62aef6073", "comment": "Malware payload", "value": "3f194bd49add35dd0c673d0d6152d85c28674000", "object_relation": "sha1", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675982220, "uuid": "cfe704ea-6dc5-49b0-a2ee-127b56bf470a", "comment": "Malware payload", "value": "a1ed8d037c0b3f3ba67e06fbbdfe3ee9d41cfd6477669f07ec631ba27ed77ace5ff2c1a8fa0fdbb63d15a5fd2b235efe", "object_relation": "sha3-384", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675982220, "uuid": "2aba61ce-f230-4bba-861a-fde53c4c9de6", "value": "T159E3AE12F42680B3CA33843451D96F6B6B7EB11C03A7A8C7B798E94129755D1AF3B2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675982220, "uuid": "72ca7415-1e6f-457b-bb4e-dd07cfd3f654", "value": "e419533373a94b3c023370375f89de58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675982220, "uuid": "f69c06fa-0531-4f86-9249-f4a14f0d7a1a", "value": "3072:ZgeCJjUDtMvJRj8b4KwneMEAvJJgLAfTBfPOKs:4UDtMRF8b4KJMRvJqLAfTBHOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675982220, "uuid": "3eb48d3e-b4eb-4dd8-acd7-a234b6a0321d", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675982220, "uuid": "0094113f-fe38-4a76-8a62-7c5d36896e31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675982220, "uuid": "92d71b06-f5e8-4105-8f51-0227c46d8b1a", "value": "wermgr_exe_PID6fa4_hiddenmodule_2A20000_x86.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60aa637-a851-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675930549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930549, "uuid": "7ddf997c-39ac-45a5-80e6-3fa049bea8db", "comment": "Malware payload (Tofsee)", "value": "8b173528c3898a7eae4a4a5ba4f89d2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930549, "uuid": "605565e7-5d0c-4772-bccc-d312d2c9fac4", "comment": "Malware payload (Tofsee)", "value": "312fe513c318398d3035efc292abed7259b716bb908341a9f7c47d91b04053de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930549, "uuid": "3f1ae038-0e4c-4495-a680-f0f784276869", "comment": "Malware payload (Tofsee)", "value": "fccf9625c98c70806b900986bc2faffecf6e4589", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930549, "uuid": "c503fc5d-b4c3-4590-97a1-143d0545e369", "comment": "Malware payload (Tofsee)", "value": "5ab6fad191bd3123bbe97f2b6ca9336fb58c0abef18d2a69a98f06f3066c0f0a1868ae7ba0428d2f5bb0d8d2093de76d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930549, "uuid": "fdf0fec5-cb9e-4f64-9fd5-490b51fd4b9c", "value": "T16B14D1333A90C432C57F11305860DAB57BBEB83146758A9777A42BAE5F313D0673A29B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930549, "uuid": "098c7028-c189-4969-a9fb-5158062422e0", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930549, "uuid": "9915aeba-2fe2-4a25-bf51-fe3937b15eec", "value": "3072:8GMOuNbKEBP1LrKZwWczd57B8RpEaYFvQSJjfulVvPRH8jQMt:8GMnD9LGG1vQSJalVHRcjQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930549, "uuid": "fdc1e38b-9243-4717-a27f-b3afd8f0aa2e", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930549, "uuid": "ff4feb26-024e-4787-b82c-c8d0a852488f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930549, "uuid": "e8c2d694-0606-4f5f-81d0-877fdb1e7023", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1452e0ab-a83b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675920721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920721, "uuid": "14f4b96c-64e9-4072-be29-093691565f51", "comment": "Malware payload (Formbook)", "value": "b6673ec379f1a7f0e19b514b6557c8ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920721, "uuid": "6a04ca6c-83de-4e16-83c7-4e773db49e4d", "comment": "Malware payload (Formbook)", "value": "32603d6c0a84eeb638434c8f7e351dd062d88a5da3d4fd659a8ae6570339845c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920721, "uuid": "a0efd0ff-4a84-46d5-b464-4f1193c0768b", "comment": "Malware payload (Formbook)", "value": "fc708e6847077d66796aef385b259a82804743fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920721, "uuid": "68338cf2-4dc9-44ac-ace6-32ba847bda36", "comment": "Malware payload (Formbook)", "value": "ae41ef5396b2b7effd6c35eb11141655e88727191de682965f7c5e4e1ac7b0ba9d65e195b018c31af2604b8b28ce896c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920721, "uuid": "e4dba477-07fc-4e15-a8ac-209cce975d59", "value": "T1E852296462DC6423F87E5BB98CB65200577CB6E3AC22DB6F21C951CEADC27414891B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920721, "uuid": "bd30c0b9-de7d-4978-a5dc-efd82aafcffa", "value": "384:kYVYVMIL/FNczMIbE37bk+zZK/6wzbaZv:rYVtL/DfIao+z66SbSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675920721, "uuid": "85d041a9-5813-4680-8648-9375965bca6e", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675920721, "uuid": "5fd3dbd6-f19a-427b-9bbb-a3df3a9a315f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920721, "uuid": "a736e170-bdaa-4cc3-bc59-3e75da807d63", "value": "00987654334567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d935933a-a8a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675966578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675966578, "uuid": "a9a0f878-c8a3-4030-96bf-eb629ad5f145", "comment": "Malware payload (GCleaner)", "value": "78e86a7e0117d90e5c8e60b5181a991f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675966578, "uuid": "243bfe59-a5b5-4e70-81ae-c18b6d7a6e7c", "comment": "Malware payload (GCleaner)", "value": "32d12f569dae30d1301853779051828d8ee452d05e912b8307f84062c7e5759f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675966578, "uuid": "1819ddcb-108f-49e6-9d72-a2dac87189fe", "comment": "Malware payload (GCleaner)", "value": "a1988287d7df3ee922321f7a5416b72be1cee1da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675966578, "uuid": "81f31e7c-b3c0-442f-a495-c74c1d5fbd78", "comment": "Malware payload (GCleaner)", "value": "83ce942fc69a8dfe96724794389cf35cc6aed6273d2bbe2019239aa05b57ee4718868ccac2b84345f2f0f221dded0e8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675966578, "uuid": "0556c47c-4e64-422a-894f-f55103425054", "value": "T15FB5127C7105C5ADD280BEB88D3A98E71CDA6EE3E9E4A06270CD7F3F917D1854A0A507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675966578, "uuid": "6a88f7b7-284a-4fe1-b5b8-23a4973b3388", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675966578, "uuid": "98a53e86-87df-4c25-ae75-f88629e95bcf", "value": "49152:rdHDZ3prOBiLOZfgNKBFBQkwduErGlkSWLCgv2MR:JHDZJMfQYFBzwdHrqZGv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675966578, "uuid": "1d008734-f917-4043-97a3-8a40401f64b1", "value": 2463291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675966578, "uuid": "9c9f8993-c46f-480f-b867-55ffc82fd105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675966578, "uuid": "59d9ce06-631c-4bea-8e6b-e89acc9e5e86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fb63f2-a881-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675951003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951003, "uuid": "49335d4e-76c1-479e-9765-7ef40ea953ea", "comment": "Malware payload (Tofsee)", "value": "ad0494798aa2d7f3fc8b92ef40a8733c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951003, "uuid": "f5b04ceb-78f3-4291-a552-c160f14f2e6c", "comment": "Malware payload (Tofsee)", "value": "32de2876099186d249a38f6a62cb5f3e75aeec48b8d2a76cb8c644a5941c5455", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951003, "uuid": "4e5f70df-bc4f-419b-959f-98609c5558ec", "comment": "Malware payload (Tofsee)", "value": "fa7eac5b6f683501d49d836a2c6c0350cd98e61d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951003, "uuid": "2c83ac19-8082-4258-8a08-66f4ea1da38b", "comment": "Malware payload (Tofsee)", "value": "5f31a6dade475c7576e60f1877ce835b86a775fce8baaf809227bd6be4046fe5a05e67a805c91c980f97afee590648c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951003, "uuid": "da9632cd-2103-45ff-a82f-018e2c177620", "value": "T1D204CF2232E0E471D436B6709D25C9F1677EF8204B749A9B3768273FCEB02D19AB5385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951003, "uuid": "48f8575f-4bef-49e9-a702-d146f90eb30f", "value": "910163c173a5611f34260e641a94d790", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951003, "uuid": "7d7ef981-74f8-4034-9680-a32d7ec2318f", "value": "3072:DbsbqugaMWjoA1rhoxR9A+bkKe2PK5bw0vDtz0etpgfJ9+Y2Dq5Ac:DbvzUoirhwy1Dz08gf3+Vq5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675951003, "uuid": "b88659ec-9cfb-407b-80d7-cc28a3f83ed9", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675951003, "uuid": "4992da8e-efb7-4c80-b5dd-0973c5b16f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951003, "uuid": "02c7331e-3640-4cee-8929-000a0ae91e87", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278cc516-a866-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675939222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939222, "uuid": "fa1cf4f4-6088-44b2-b785-fd4e8efa7e35", "comment": "Malware payload (GuLoader)", "value": "b16bf8830d1842d2f9e78b2fe210849d", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939222, "uuid": "c74f510b-ab91-400d-a6cd-f19aecd96fc1", "comment": "Malware payload (GuLoader)", "value": "32e9175d0fc07dae4adf478b8edaa68aba6f8cee81880b2c67ddaf23acd282cb", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939222, "uuid": "22cb3c32-477d-43ff-a9ba-c78c98d7785d", "comment": "Malware payload (GuLoader)", "value": "e512bcdb0141ce758c161d414286b250f9a3d8c9", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939222, "uuid": "3628cbb5-3212-40d9-a5ac-ebc2ee45c79f", "comment": "Malware payload (GuLoader)", "value": "b751a718bfa240ee62da5dae008dc3d82161f5bedb5cec41359ad35972cc13daa73e6b03ae3fae719998301e23eb3460", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939222, "uuid": "5843f85b-270f-4e28-bfb6-100d894b2f8a", "value": "T1A69423A3BB4E43375E1A9610CF0FAC5EDB81B0916452FE874C522ED4B0608F62D5D2BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939222, "uuid": "11132d62-e8a1-4173-930c-755a56e973af", "value": "12288:S5kw7Duc3oeAeW+THjpzaqXOZlOjVV/34F:auc39NXRXOZlOZV/34F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675939222, "uuid": "32e4ca39-b12b-4997-adbe-f776d3910c8a", "value": 429004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675939222, "uuid": "83c08e2e-026d-4c9d-853b-188c09a8d34d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939222, "uuid": "eb5e9107-4219-4c5d-8859-9cc539cfc782", "value": "Statement of Account.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976b87fe-a86f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675943275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943275, "uuid": "500322b5-c9ab-4470-b357-cced73cd95ce", "comment": "Malware payload (Amadey)", "value": "17d997ec5726e16d168d1f02e7772c29", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943275, "uuid": "6cef6f9b-a948-4e60-88f7-c37d037fb157", "comment": "Malware payload (Amadey)", "value": "3345bedda70ff3e06f8f7b352b3bc244803f90134de12fef4090b1eaeae047ff", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943275, "uuid": "2b988edf-aee0-4785-84cb-1519f84ce4ee", "comment": "Malware payload (Amadey)", "value": "8da5e683493e8286b7444f48095697ec03dcea60", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943275, "uuid": "b93e81a4-127e-4687-9d6c-6c557c636094", "comment": "Malware payload (Amadey)", "value": "445d67ad4b2946a0d1d64adca11d93448731f82ad0c916ac490dce20d3250b023dbe08f48e51c8edc9e51e3a71e3ae16", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943275, "uuid": "45efd0e0-9028-4a46-8e5b-e287bb85afdb", "value": "T1B9B40207FBF84172E9B1577009F607D30936BEA1AB3483DB178E5C4A0CB2564A63676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943275, "uuid": "488bfb3b-5c55-49f3-a0d5-4cf4ab19a26a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943275, "uuid": "6664d56e-73bd-4abc-bf02-5d13b3dc7133", "value": "12288:kMruy90tsF+VdYnFvsDHaTxLvsLbFRDgty/w/:ayescVkN4qLIbFRDgtyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675943275, "uuid": "9cb8ca34-9294-4411-aa4d-f6c0e5d338af", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675943275, "uuid": "8a91a6d1-b5f9-4f9f-be7b-dc605fb81f90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943275, "uuid": "71a71101-2540-4aca-a554-483e7cdac57f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fa3f54-a810-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675902418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902418, "uuid": "f07cba85-849d-4908-94d2-2a2306480965", "comment": "Malware payload (Gafgyt)", "value": "192162139970832f745fd7be2de8888f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902418, "uuid": "a9a0d927-37d3-4fb9-be78-2ab322409ee4", "comment": "Malware payload (Gafgyt)", "value": "33a5ce033a8dae456019faba024e1bef0b89bfdc8cc21f41cfadbb6fa79b1a72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902418, "uuid": "5887b1a9-7ec1-4b1f-a714-a1fcf88a9ea7", "comment": "Malware payload (Gafgyt)", "value": "39898787ec09540a8e8565ab1b88b10e98b16093", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902418, "uuid": "28759ab6-7d80-4005-b74c-3d89504b99ae", "comment": "Malware payload (Gafgyt)", "value": "b54a46cfb12ea0ce4bcd659b73d2caaa1537b5b301ee8b2af916125ff8d6524e453f407c803b130e144e9fdf635594d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902418, "uuid": "f446b5d1-d96d-4d63-bbdb-7a8e448de54f", "value": "T14AA33A41F841871BC3D327BAEB8E479D3B39569467D733116A386EB42BC27C82E29521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902418, "uuid": "3de313bd-de8e-49b8-92d5-0351533081f8", "value": "3072:YhDJsL+PzGznVTzPmt9TmZRqQmDPRXXkQX:GAkzGzRzPOmZRqQmDPRXXkQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902418, "uuid": "fb48678d-d784-41a8-ba7e-e389cc2ceba2", "value": 101980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902418, "uuid": "7c95e439-e97f-4a46-a637-9e5799dd0d55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902418, "uuid": "25272ce3-b68b-4736-b6f9-88bea0f8bf90", "value": "192162139970832f745fd7be2de8888f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce555d23-a83c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675921463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675921463, "uuid": "1cbc669d-bbb9-4b01-b978-587d381d9b15", "comment": "Malware payload (Amadey)", "value": "9479b5d084bbae7f6b84fd5e8974c5c8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675921463, "uuid": "9b467e3e-78f2-4b50-b945-a6e46e5d1420", "comment": "Malware payload (Amadey)", "value": "33af1ed84427bbd96092ef6e6478f59a1fa94f41425955af14ae1fed45f96178", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675921463, "uuid": "246bb54e-c85c-4f87-a2fa-607c4edf5d25", "comment": "Malware payload (Amadey)", "value": "87e0c33ba4a02d46f0318e8681bfbcf5bc70d32d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675921463, "uuid": "82f576c0-cd75-46bb-b1b5-02194c330713", "comment": "Malware payload (Amadey)", "value": "b0caf99811319f2d4b9b94ed63015b335a7ed8da17e87563510eca55520c69b59db88894b1bfd48846af2e248a16b0fb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675921463, "uuid": "6b7f83a5-2f51-4aa2-8281-44094ecbcf05", "value": "T168C4010BA6FD8032E8B5477018F917C31A36BE606B39D397170F9C5A1D72670A236B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675921463, "uuid": "53946a82-07a7-4e6d-8801-56701e5a61ff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675921463, "uuid": "550b08bc-4a5e-4bf1-a044-a452656764d7", "value": "12288:lMrUy90EujSxB3kfov1aV6uqrXiWp57x5UkR6YUw:Vy+GT3kfYa4PrFj7skz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675921463, "uuid": "b4f8e9ca-bff0-46d5-86ed-73aa0bfe3615", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675921463, "uuid": "294eca2e-5f0b-4732-8b58-959cb3341a29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675921463, "uuid": "5fd3f5ec-b90e-4d97-a02a-a5ba9884f2e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1110a818-a8b2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675971826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971826, "uuid": "2dce4389-aca8-4a40-8b41-8967dddaff50", "comment": "Malware payload", "value": "36834cec386ef46903b2f94eeb7fdb47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971826, "uuid": "e2b77195-d874-4e01-9c69-ea3a8d7aa203", "comment": "Malware payload", "value": "33e407f6b1d048fedcea86216ea622e819498c933fb839f2a19fc88058701c85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971826, "uuid": "6a4f5642-8a94-4786-a825-5632df8a5502", "comment": "Malware payload", "value": "93e9f7656b6deae8774c55a2746029fb99a6f18e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971826, "uuid": "3ca851df-e757-4da8-9db6-76cdfd0de7ac", "comment": "Malware payload", "value": "7145d2b1fce490e861c8505617b1852439d9cc5bf1c7e3a3ae4ae4c6a64b3740ed0687161b14598a808640ac6fee5d24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971826, "uuid": "17129a8f-c5f0-48dd-99e1-a32680c69955", "value": "T1F3B40217D7E88433E4B417B01CF702C31A3ABD619B34829B375EAD5A15726B4A63237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971826, "uuid": "0b67369c-f35a-4ad5-857a-24b612d69879", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971826, "uuid": "b2568568-9666-4132-a6d1-f4cd1e3e8d88", "value": "12288:2MrYy90cNGMeVhUBsM+B2sXBF18PxV+OY0:SyGMAhnM+B2sXDgfY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675971826, "uuid": "f9d8807c-6bb7-49bd-81d2-70acd7f47792", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675971826, "uuid": "6935806c-495b-4642-80d0-728298ad5e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971826, "uuid": "e8e32d14-b94c-4fe2-86fc-26ec32341751", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ce510f-a8c2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675978783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978783, "uuid": "b87662ec-d8c9-478e-830c-380afd0cafaf", "comment": "Malware payload", "value": "1d216cde6602e7ce805d122cd95d58ff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978783, "uuid": "32cc76fd-b79d-49fd-b820-d990836bae6c", "comment": "Malware payload", "value": "33f653a9cca8714c15f297954e6249072aebe81c61fbc3ed967e3847c601b4da", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978783, "uuid": "7a20fe17-a26d-4856-ae5c-b68c7ac7fb69", "comment": "Malware payload", "value": "494cc71a2379f28da5cd7a3fccb64727f20ef6fb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978783, "uuid": "7a100a48-3445-4d74-b925-291627d2ab41", "comment": "Malware payload", "value": "50060c7d0090f030c7793629e0c15612539aff6cbcb6dfbf0cd9e1dd8839e3b2a87342856598100f8221555bd6d389f7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978783, "uuid": "f3112e76-f48f-4bd5-aac9-d9c16e66b46d", "value": "T14F53CFF62551441FFECB643CDEEBA3E0571C021F851E3386DADFA256222F262CC25899", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978783, "uuid": "2fb603e4-16a1-4a9c-a5fa-478fc572618e", "value": "1536:lGD9cwOU1hhYQts2+BIB4BNv9CqZXYAQjUbBBBBBzeFB+BCX+yi:wyTKhy2BqBhee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675978783, "uuid": "a725e2ed-d346-46d1-b6c9-70189b17b1b7", "value": 66540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675978783, "uuid": "7db535ba-1c65-4efc-a4f3-2f72e6a29eab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978783, "uuid": "7fc6c98a-6260-4428-8873-6f3a71af9b98", "value": "(\ubd99\uc7842) \ud658\uacbd\uc601\ud5a5\ud3c9\uac00 \ud611\uc758\ub0b4\uc6a9 \uc774\ud589\uc2e4\ud0dc \uc790\uc728\uc810\uac80\ud45c(\uc11c\uc2dd).hwpx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa53ed7c-a852-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675930851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930851, "uuid": "974fd84c-b93a-402c-9ee5-c11c1fc50495", "comment": "Malware payload", "value": "a24342d42a6c61391b6670584627b59c", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930851, "uuid": "9af66d4d-711b-4b67-975f-624486269a43", "comment": "Malware payload", "value": "34000abaac50ac84d493d2e55b6fb002fe06920b344f02ee55ff77e725793981", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930851, "uuid": "8b45168c-dcfa-4104-8a91-9800c9285b4c", "comment": "Malware payload", "value": "a38689a4a8908317dee7c7d1865cffafb2fc631f", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930851, "uuid": "10023915-9142-4dc9-951d-d8a7d8ea37cc", "comment": "Malware payload", "value": "af00bbd1f04abc68f931846f4ac2d740fb79dd41c747669fd1db7700434368bd959df454ad1be6e1e59230aef837403a", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930851, "uuid": "c53603d4-8e49-41f0-a654-94844d4eb2fa", "value": "T13D435C61D1BE94694A63323CE50E8255757DF132503D0025BEFC66B82BA2827A3F4FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930851, "uuid": "e6e1afbc-318b-46a6-bd40-0f5d5d625d55", "value": "1536:CHtEwrsdrehPBxaxJPrMwSc8kQox/OEIecpZVYpaZJFWC2JQkS7s20:CG1rVrnSrOQZKS7s20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930851, "uuid": "772181fc-7349-4029-b28f-7741a805a338", "value": 58638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930851, "uuid": "5eebe246-b8f0-44b2-b910-7e13378f4ef9", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930851, "uuid": "0e0ae521-1c33-46d0-b951-324abb1154fb", "value": "34000abaac50ac84d493d2e55b6fb002fe06920b344f02ee55ff77e725793981.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb0f3c2-a83a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675920629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920629, "uuid": "f7476095-a084-4154-8940-b44adab88346", "comment": "Malware payload (Smoke Loader)", "value": "447292952e31eff034c13bad1b136a40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920629, "uuid": "bbea9f9e-edd3-4a46-a3a5-dd93e220ea87", "comment": "Malware payload (Smoke Loader)", "value": "3450a9ad5b52ea51e0abef7e5c42913473857cd84c4601ffef175ddb284b0a33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920629, "uuid": "c4eb6faf-be53-4ef4-a6f6-7fb0f4003a81", "comment": "Malware payload (Smoke Loader)", "value": "60345786b96c9d0b94f9cebeb38d0f7766c4231a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920629, "uuid": "66bb8424-f698-4399-9122-b832e9546704", "comment": "Malware payload (Smoke Loader)", "value": "9bca82a6f5cc8fc13bd84f2ffbfdcb508e8bcaca0d59478bc3df066cd916a682508465feaa5cdaf7fe4263b095f92a72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920629, "uuid": "9b6d2d65-f48e-4071-97b1-f637ce115a09", "value": "T1F414DF3235C0F272C16704349C75EA656BFEB83056B69A4B77A827AE4F302D1673634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920629, "uuid": "53202bb8-af35-4444-981e-805fb79c0c8c", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920629, "uuid": "810b3e2f-3c33-4c0d-8287-f76eed28fa55", "value": "6144:7GUaYxLAGqu+7EJr0gI/0NRucwhBIOl8:7GUaYx8GqN7EJr0gI/Y4csyOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675920629, "uuid": "f3b21a17-a536-4788-853a-aadda6a8b473", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675920629, "uuid": "36959f74-9837-40d4-bc7a-e8ecf06b44e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920629, "uuid": "ae6cc3b4-286b-4094-8665-b526280138d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b85ed9-a846-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675925471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925471, "uuid": "abee1f09-fd4d-43b7-99be-06e53ed06e29", "comment": "Malware payload (AgentTesla)", "value": "a8a22127328207e5ec19054c9e0ba2aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925471, "uuid": "787d515d-d8f0-46fb-8a4e-e3773ce04260", "comment": "Malware payload (AgentTesla)", "value": "348b029e61cf6f2e09cbf867cabe0f4bb9377b913acffeb8d9b264784a3828e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925471, "uuid": "81a0c9e5-f745-40be-8138-40496aa563d1", "comment": "Malware payload (AgentTesla)", "value": "399c14010b576bd37aef0350ba8b1eadc35bdfc8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925471, "uuid": "132da67e-2cf4-4918-a2b0-85589d8af420", "comment": "Malware payload (AgentTesla)", "value": "82e7adbf167799cd6b322ce94afaf13b6ab7125a1fda5d86a70f1a3304873dd360a16683f3d2a7aa97104abafcbd96ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925471, "uuid": "8a371e06-c48a-4fd2-a34e-e934b9f60934", "value": "T1A3E4023965FC4E1EE2BE47BE16E1034253F6B582B192F71D4F4834E50EB6BC04226A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925471, "uuid": "395a44b8-a9f6-4e5a-a0ec-13124105f66b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925471, "uuid": "58473322-3588-4c38-bb7b-632a8f9d95c3", "value": "12288:K5xa6Yk2J8iKDxCqnw+fUdNxCbheQu7wedjrjS76A10lMEQlQX:eok2iuqqskQDetS91mQlQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675925471, "uuid": "bf6e347d-6036-42e7-b87d-8f4cc99a42d6", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675925471, "uuid": "51989571-f516-41d0-b175-4b1da08ed5bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925471, "uuid": "d07617cb-d697-4a75-b7ba-e054143b3ef4", "value": "FedEx Shipping Documentations.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33dc8bf-a886-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sodinokibi)", "timestamp": 1675953254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953254, "uuid": "9fb6e89e-a445-4902-8de3-e4f3026b2841", "comment": "Malware payload (Sodinokibi)", "value": "69d6f75b8cfd52216a6ff4b0861655ef", "object_relation": "md5", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953254, "uuid": "d1b3912b-3c47-45d8-805c-a7b145da9404", "comment": "Malware payload (Sodinokibi)", "value": "349bdb12a75fbfc2803f988862764ba6058b371728930f8dcb248f105ce607f7", "object_relation": "sha256", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953254, "uuid": "7ad69f19-a611-40ed-b08a-ae6dfc31b920", "comment": "Malware payload (Sodinokibi)", "value": "2c644dac27af557bc1a8329baf943e8b81170b2e", "object_relation": "sha1", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953254, "uuid": "9ffd8cc7-b64f-4071-b38e-f9f611ec23a8", "comment": "Malware payload (Sodinokibi)", "value": "1df856249401a5e53c3c6e8f721efc45dcb40dc4736845cec076e0d76d100940ce927ca9ecb3e1b8f88e38f6a92e0ac1", "object_relation": "sha3-384", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953254, "uuid": "bf39f081-48d6-4350-aaef-efa36df4092d", "value": "T1CE24E1A7FED08072E16305F95A3A7F35AD7FBD301835256AE7640C4D8C692C1AA2D387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953254, "uuid": "edcc9049-0866-4936-bfa0-78278b4d81a4", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953254, "uuid": "0af42f15-1aac-4e87-80d3-d422e368019a", "value": "3072:ur85Ce8F63VETed7/kBazzFbULpC15RM4ENKQ4JTBg0D:u9eS63VE6F/M4qE15NENn4FD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953254, "uuid": "f1865ce9-1a6a-4147-9b9e-1fcbc535e176", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953254, "uuid": "d01d8ca3-5ff9-41f3-8086-bf1179c55245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953254, "uuid": "965e5f6f-55c7-4a9a-9d33-e5559cf5e79d", "value": "2023-02-08_69d6f75b8cfd52216a6ff4b0861655ef_neshta_revil_sodinokibi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23125978-a898-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675960689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960689, "uuid": "64553a18-2588-4e5d-ac88-70053fe8229f", "comment": "Malware payload (Amadey)", "value": "ef943b1c51f9309a853ad1e08af202eb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960689, "uuid": "60c25c98-32e3-4a24-bb71-297fa0281d54", "comment": "Malware payload (Amadey)", "value": "34f903cbbb73ce45fb473d4129f8372cff33be2b71f625315c3c573f8ea97acd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960689, "uuid": "4d3d7356-98ce-4dc4-b756-33198ce5c1e0", "comment": "Malware payload (Amadey)", "value": "442aa79b1c1b2287090848e8ed3620d9cbcd2767", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960689, "uuid": "ad4bdc64-f28a-4e90-983e-25a8b7ea3d62", "comment": "Malware payload (Amadey)", "value": "454e37e59d77bb2262ca10f03309089107d21c219286ffa70e788a6d225010f424c310622fa0028680d70b89269e14cf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960689, "uuid": "8bafeae8-5a1d-4986-8966-bc36cea2db13", "value": "T19EB40217EBFD9063E8B1177069F703C31A367D6129781386268B6D2A18372A4F13677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960689, "uuid": "c2c93ea6-4f38-4460-a1ea-ba31364a59f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960689, "uuid": "9b6b3c1a-b8ef-404e-9a3b-47f925cb4d67", "value": "12288:zMryy90RkLnpUTowgZHY+/weNkJtXh5OFhrp:hygk0sHH/wemtx4Lp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675960689, "uuid": "ae0e1d7c-d9a0-4d5c-b383-b4c259c5ce8b", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675960689, "uuid": "4ea9dd06-e438-41f7-ac2a-e75838629ae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960689, "uuid": "75065388-2f15-4ed4-8b41-7cb7f05f3027", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f4c5f4-a871-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675944138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944138, "uuid": "2b62d20f-c8cb-43e4-af61-9b83bf851f1d", "comment": "Malware payload (Amadey)", "value": "fcbf21d7dc95ca3c387261448ce513e7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944138, "uuid": "56b86a13-6420-40a5-b02e-fb938fe6d25e", "comment": "Malware payload (Amadey)", "value": "3537bfbaaeb18ad5db2269ae68d0b61c08361e5fcb5656342625be2d4ed865c6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944138, "uuid": "8a323f84-e5ab-4814-855e-4298aa2378e4", "comment": "Malware payload (Amadey)", "value": "eb02f78103e240e3205a696f408f0df285abe333", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944138, "uuid": "670e8936-b05d-4fc3-96cb-6de8775901ef", "comment": "Malware payload (Amadey)", "value": "7d51a50fa512f451b50f738b2fc7e76acfac6ce03900aea12beeae6e975a8b8dd68b5b8ff9d99eda61003f5749e1ccf6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944138, "uuid": "bc2ed067-8507-4496-a9e2-ddadc2f261ad", "value": "T128B40107F6E85132E9A117B008F7479309357E906A3983DB668F6C0E1CB25A5F63673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944138, "uuid": "8976e5c1-75a7-44ee-93fa-88fd9712aa0c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944138, "uuid": "4ade5ddd-0d63-46be-b4e2-cc2bf3d17946", "value": "12288:SMr+y907SR7XGYMjSJYevHatxLv2LbFO41h9fJ0:QyXR7XnYO8LCbFD1h9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675944138, "uuid": "87529abc-bed2-4586-808f-2b5dee49e55c", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675944138, "uuid": "c74e1777-7064-4ee1-b353-97988cfaa0fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944138, "uuid": "3d146234-79b5-4dd9-9d3c-b1ef6fcfcf72", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0517d0-a899-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675961296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961296, "uuid": "c8df39c7-99ab-4c65-b082-fdb272b78ec9", "comment": "Malware payload (Amadey)", "value": "8ac3da0a5cb00c398a1fee01585e5809", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961296, "uuid": "7048d477-ce8b-43df-852e-50497c7f0f74", "comment": "Malware payload (Amadey)", "value": "35fc407836e61a7569c3b6b9778b12a1cd04f8a9a2676c98b3483256835e5546", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961296, "uuid": "8903a394-2572-4dcd-86cc-1d5a868a7b1a", "comment": "Malware payload (Amadey)", "value": "6a995027f62e65f2f00d429cf3e2a3dc9c2907c4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961296, "uuid": "d2c0539f-5fa5-488d-aac5-266bc7a09a85", "comment": "Malware payload (Amadey)", "value": "2642211e186461da99c95ce9cd86fb66a1b0469d01e6a7f2afccc5805fe37d9e416362852dd993af7b0d179b070a4356", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961296, "uuid": "e41772f4-de18-42d8-8422-b0737a7022e1", "value": "T13FB4021BF7EC8472E8B0277058F603C71A357DA16A34539A278E585A48326B4F235B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961296, "uuid": "792d2570-52b2-4ecd-93f5-8e4fe615791c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961296, "uuid": "f5499954-dcdf-4e91-a021-ccc7c80f8dab", "value": "12288:EMrny907IBIKpJ4U+IoeFyXCN+J+XhtwwRL07:zyMI+KpJL+d0yXCg+xjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675961296, "uuid": "8aa27f0e-516e-4c65-a79d-fd2aa15bd270", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675961296, "uuid": "14c5c835-7a74-49bf-acd7-a72e1ea7d7e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961296, "uuid": "a63499b4-40cb-4df3-a47a-2b7c8c0262e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14e8944-a8a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675964364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964364, "uuid": "b789b734-af8a-4f31-a865-197254a7279c", "comment": "Malware payload (AgentTesla)", "value": "f8912d26918fc5e127e3acda50f39076", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964364, "uuid": "d98e5bca-a87d-48c4-9efc-e0e6e0ff04b2", "comment": "Malware payload (AgentTesla)", "value": "361034f14b8e3519b58ed13287495211c533f2d393accd4e198640aa6c98fc48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964364, "uuid": "164a3c96-b75e-4e4d-a6ca-a2d70bab9e2e", "comment": "Malware payload (AgentTesla)", "value": "63ff2e152923ab79dc87ede7807b4a5e1cc246bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964364, "uuid": "4feafc59-d75d-44ad-bc3b-9f63c3418f56", "comment": "Malware payload (AgentTesla)", "value": "0a12dbdbf9529626a7558b6f3942834fc46ba5b1cf3ac168a4a740984e04f0b8d9a2627412d652e0eede4ac0fb2e5602", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964364, "uuid": "5704aa9e-8c7e-40a0-b40d-5b28655e7d8b", "value": "T10EF4E43939B627E2C138F66A46E78620BAFD52437313D859ECEE07F10F855412E8B91D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964364, "uuid": "5f5ed9f1-418f-492b-addf-e5b264718fae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964364, "uuid": "e31b7f2e-8ad0-43c1-8690-9d88288be707", "value": "12288:BsyhVe5d6U6sRg9db30NOQA+/7lqMtEwcU3gZ+D3AksC/9eZiHU7pms9Peom1vht:Bs8LsRg9db30NOQA+/7lq6AAgZAAHjZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675964364, "uuid": "da24d555-b704-4b0a-994a-41bf31bfaa1b", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675964364, "uuid": "0177d1e4-5276-4352-9e52-1bfe344806fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964364, "uuid": "7f7a4c51-803c-4031-8053-3264c7ffba1f", "value": "invocie.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcec713e-a817-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675905649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905649, "uuid": "dd56635c-b3ca-4860-a33b-83e83c0eaa67", "comment": "Malware payload (Mirai)", "value": "cf76619f511260221e254c70eefbbf59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905649, "uuid": "fc58def6-f8ee-4c68-b89e-9affb203e97a", "comment": "Malware payload (Mirai)", "value": "362bbb590d5be85e9e12b33bea59a845a8396cf32faab2602057278cb792fa1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905649, "uuid": "a4baea7f-a059-4f56-b3fd-7cf7e1cfc011", "comment": "Malware payload (Mirai)", "value": "d1840bdf04215f132c88d2cbac97cd212dd5fb58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905649, "uuid": "228051cb-1b78-4b53-9846-1da875d2c82b", "comment": "Malware payload (Mirai)", "value": "520eb09c95d051bd76d7eef6ea2c84124fd23d057250d539032c6b9bcebd3a8ced4d8f0346144d343aa59d4e41ef14ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905649, "uuid": "b6060441-d424-4e10-8d28-087b7d81e73d", "value": "T1993302543637F2AAE0F214786861E3D955A32F70F6D730E2A030452576EA73E1A776C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905649, "uuid": "5f65cf1f-48fe-47cd-81c8-c873afdbe74e", "value": "1536:U4BvbLVfmc/tUS3vcSg+LBVk+iTNuuyXTsy3WR8bbQ+:XLxN/CSESg+LBVkBTNuuGlWRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905649, "uuid": "e60771a9-6147-4cc0-b773-3204b313e932", "value": 55084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905649, "uuid": "0910d758-e756-4225-9574-f8608cb73d76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905649, "uuid": "3672a897-737c-425a-af05-982d36c2e2e9", "value": "cf76619f511260221e254c70eefbbf59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23755e2a-a84a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675927189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927189, "uuid": "dd0fdc26-4ae5-493c-a7ae-9b183a02d03a", "comment": "Malware payload (RemcosRAT)", "value": "e06988af907d78472d833b0a8959bc30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927189, "uuid": "bba5793a-1e2a-45d8-a811-ba49479b9fcf", "comment": "Malware payload (RemcosRAT)", "value": "36acbb3de6fa034e076a9779197e2ba3367e67e668a93961b183c3e812dbd989", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927189, "uuid": "857dca7d-89db-4da2-bbe8-9a0b40bb453a", "comment": "Malware payload (RemcosRAT)", "value": "720be3755551f3d10ff1dc22d10a257b7a3bb384", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927189, "uuid": "bfae2a28-35ba-4fcd-90cd-db02e335e904", "comment": "Malware payload (RemcosRAT)", "value": "48b2c8f5a83ca6eae7084c7906a7aa2fdfc5298511778d4221c730cbccfc9145c316ddb9cbd87adcd1bdbdc891f5456d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927189, "uuid": "a5c04022-815b-4d8d-81af-f4aba4dbd1ac", "value": "T171C42394218FD013D8B64A70293A16AB9FC3BE161E59834B3315333936702A7D97E7B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927189, "uuid": "79757db1-d7b7-4367-a3cf-64071d6bd792", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927189, "uuid": "bcbf9c58-2287-4da9-ae2c-38f9640389ec", "value": "12288:yY9QfrUDJJP2ZUneYI616Wls6w5K3Qis9dyhd1RA3ixLDhMP:yY9ir0JJOWnj6Wls2Qis9dy31REtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675927189, "uuid": "912831ac-43e9-45c9-b118-8c824f88db5c", "value": 562094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675927189, "uuid": "a53a7dd8-2494-4574-b0c2-124b7f8ca6ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927189, "uuid": "4979fc42-e778-4d58-ae46-bb9655da1377", "value": "SWIFT20230208999900001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1fbbb2-a865-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675938961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938961, "uuid": "530713c4-ce2e-4f5e-bbcc-a77c0c75b389", "comment": "Malware payload (Tofsee)", "value": "c1acb830c12edb89936e76db4b4e6a08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938961, "uuid": "19a4c70e-e77e-44af-9790-e8e432387fdf", "comment": "Malware payload (Tofsee)", "value": "36f7bf332a0278c97090f2885938f20c3f77932bd4461a61f0ef57ad2d52f9e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938961, "uuid": "9326c347-f2cf-4941-802c-66aac6772613", "comment": "Malware payload (Tofsee)", "value": "ab4985bfae8eab2f573413a5d2499594748c57c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938961, "uuid": "ac8b7e44-c867-4972-aae7-10c406670efc", "comment": "Malware payload (Tofsee)", "value": "9eabfe6a531919d0e5e7de5d454a716c08396f1d297c0f2bd4b976078ee402808fb4686b68b3f5f0a194816eeb1f8ef6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938961, "uuid": "778a5d32-f98b-41ab-8964-e456ef166b02", "value": "T1EA14D0323AE0C072C46F14304824DFA1ABBEB8215A759A477B681BBE5F307D16B76357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938961, "uuid": "5ca2b022-69ae-48f4-a0a5-dc92943f73cf", "value": "83d1b8095e33f74e23ddae505b88bb37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938961, "uuid": "42b726b7-3da6-43ef-95d8-6970218dd984", "value": "3072:S1OOKo79HgdtL3K04vWSh52PcWz1s9obif3pZ+8sUymB:S1OcStL3yv0Vgobif3zsU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675938961, "uuid": "1581614f-6b69-48cc-9fff-1c88dc3cb55c", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675938961, "uuid": "b975a4be-80de-4938-ade2-aaea45935eb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938961, "uuid": "7ff063e0-a4e4-4986-b40e-79dc3033ba0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3214467-a8c1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675978621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978621, "uuid": "61814546-0b77-4db0-90cf-b5d5049c91fa", "comment": "Malware payload", "value": "9cc83d5ed58706971d52555a6d51576c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978621, "uuid": "08c6e089-e3fe-4af9-bb8f-af879fd88378", "comment": "Malware payload", "value": "375de7d18e2a92b69fad883683ab0cb44e8f601fef7093d48c271f23b8959297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978621, "uuid": "0643f100-a302-447f-8bad-1478b96244da", "comment": "Malware payload", "value": "bfe8863181d45f7aea54641878166e947bae1af7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675978621, "uuid": "6c114d07-0265-4370-bfdd-11362ff8acde", "comment": "Malware payload", "value": "059d9382272f5ca5a16368dd3473fc4a115cd2988a2eeebae768acb02910fa199129ce32c89659e7d0bfa3c7fde29e12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978621, "uuid": "caac5ca8-410f-4710-8406-3a26288df6e6", "value": "T1D7B4020BE6EC4533E8641B701DF603C30A36BD50AA788757578EAD5A1CB35A0BA743B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978621, "uuid": "b0e7af3c-2303-4ce0-be38-446ed76f1abc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978621, "uuid": "f7f394c7-a4e3-4b27-a425-6cd9e828b9f2", "value": "12288:dMrUy900j6R0aiz6DaYeEvWfvRSBsoSzaH9:py8R0aiUaY4Mtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675978621, "uuid": "c8a2eb81-f536-428b-b0a1-034dacd42ab9", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675978621, "uuid": "7d7336a5-73ff-4ff3-a87e-32292bf174ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675978621, "uuid": "b78737f5-3c6c-43e9-ba43-5410ea96055f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4488f6e5-a818-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675905770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905770, "uuid": "a4f3ef08-ba35-4b21-957f-65d11e7e7b84", "comment": "Malware payload (Mirai)", "value": "bc9394dee3de22f9e24a13d125f2795f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905770, "uuid": "978e9f24-fb7e-4630-ac14-7b73335d8c76", "comment": "Malware payload (Mirai)", "value": "37d51bc85c3df1de1a5b8605acfaee2e13a24217a2fa72f987a63586ada20760", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905770, "uuid": "20790609-7d53-4281-be70-12aec29710d3", "comment": "Malware payload (Mirai)", "value": "864ef5db499461920fbe52f6112654464116b120", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905770, "uuid": "ce9112b7-2170-4773-86c8-76b0fa4700eb", "comment": "Malware payload (Mirai)", "value": "0d7fba049b8f630d0435931d2d972e2d4157b0e32412782900cbbda0b8aeb22e3da44656ab4b7a42c54de978ab6c1080", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905770, "uuid": "cf716e84-a431-421d-9b14-357179e72822", "value": "T1B4E2D05111C0A5B2C3B00FB9741CA2E1A8F917F4F1B3262244395FD68A5B312F6F4BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905770, "uuid": "3ada8867-07b5-432d-96b4-5428ad5132cd", "value": "768:88rbldQQMySZBdcYVxDGubYPJahmGxFQI5A0LNG43UQe5:d5CHNBMPJaEKFLAq9e5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905770, "uuid": "a4c2fa8d-1591-441c-8616-006bd1de9635", "value": 31308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905770, "uuid": "5e0b6497-53e5-4751-913c-bd695e94ffa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905770, "uuid": "a0c07240-537c-42d3-82e4-98ba1942e7d5", "value": "bc9394dee3de22f9e24a13d125f2795f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb117cb-a8ad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675969830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969830, "uuid": "037c9157-11a6-48d2-b286-984756ede8a1", "comment": "Malware payload", "value": "9ee99ebb3b839361d97f4fc5b4c0502f", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969830, "uuid": "8dc1dc68-3d8f-4401-b36b-4f5f95ed8ae9", "comment": "Malware payload", "value": "37fb495e7f79c42f220eac28ad0e935be64bf861415e4c4006303623ac4aa798", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969830, "uuid": "91e8eed2-4e32-4d82-9b62-12678f7f1749", "comment": "Malware payload", "value": "47b01f602c8003c18ad785498828941090faf4ed", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969830, "uuid": "663410c3-823b-44d6-bffc-5022f2b193a4", "comment": "Malware payload", "value": "dc436eb2b65d905d40264efc0b3e2d776da2bcfc7a34e908cb45543773f46d58d66219d19bcd51590dce93da052aec6f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969830, "uuid": "328595c7-1f74-4eb7-8f59-b5763fc6fed5", "value": "T10BB19E6140CF2319E8D19C31EE8390163DFD465DDB629DE5EDC2E1DA069011CFD86AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969830, "uuid": "1d23d6ae-f472-408b-a200-b02bf7177d9f", "value": "96:zpm+Cg8IZZnnRE3Bpgw1JyOW5sY0wxUK5/Vb9wFCod8bgvAPDJFpe8:tCgFZZnRExyw1En5r0wxUKpKCngviRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675969830, "uuid": "e7f0b2dd-c7fe-487f-9b3a-21cafc8d3d07", "value": 5177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675969830, "uuid": "2f856cac-0004-4ade-9ba9-d581f6416e16", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969830, "uuid": "f0c81645-c807-4187-8132-db1807099e32", "value": "Agenzia_E8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadbef24-a877-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675946878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946878, "uuid": "98feff02-2568-4df3-8d87-9cad4a3ee466", "comment": "Malware payload", "value": "a19b06b13014ea9748d9cb67a06a2b90", "object_relation": "md5", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946878, "uuid": "1ac24779-341e-4eef-ad37-e6688c7ce92b", "comment": "Malware payload", "value": "3814629034ceaf16f9fe3e5feb09a92573e51207316f1718c0ef89a4a841063c", "object_relation": "sha256", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946878, "uuid": "3e58589e-96cb-4aa8-bf38-be1e3e109378", "comment": "Malware payload", "value": "97f5139ba29ab0d84471b4c9ce7c8ffa653e5965", "object_relation": "sha1", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946878, "uuid": "d2080e83-00f3-4b46-928e-54e31c2e9d4b", "comment": "Malware payload", "value": "9407d5c63bbe8b07ae875b9d72387755904a77a5914de42f18c9debf07bf3596066375c8331d47b2fec12e7fec770aa4", "object_relation": "sha3-384", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946878, "uuid": "bcb22955-1ed6-484f-9367-19081686d86c", "value": "T10F43B8A7C9F114A2172658E88ABF620572664073A508DC54FB8CD19C2F4F47FE2B6BCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946878, "uuid": "b64eed7f-9810-47cd-a1bd-db2508296c24", "value": "1536:BrQuZCkji+cJ7FFlkoaeAFlkojh6eUeb16SSW5d:5fL5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675946878, "uuid": "9a734956-947d-4e19-8e9d-c60cca0ea0b4", "value": 59003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675946878, "uuid": "69c59ad4-134d-42be-a17e-b692302c6cee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946878, "uuid": "6ad225f3-5c44-4a53-a063-caff5551379a", "value": "index.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5a05ba-a896-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675959874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675959874, "uuid": "800f39fc-eb96-4782-a6b8-2a4bac623ef2", "comment": "Malware payload (Tofsee)", "value": "141359f4b3bd6bd1ec634f67408aa74b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675959874, "uuid": "5e1a732b-8bd6-4f67-af7e-1350b4a2cf69", "comment": "Malware payload (Tofsee)", "value": "38208d790e448fa4df63395c23dcb533dce491e0432a2870b335a8d66810fecc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675959874, "uuid": "663e94ef-851c-45a5-b6d2-83b6c455a084", "comment": "Malware payload (Tofsee)", "value": "aa1fea38076eee0e61db520cf11d61008fcc8504", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675959874, "uuid": "1fa5c2ee-7f92-417d-ae51-6a0927955ab1", "comment": "Malware payload (Tofsee)", "value": "ee7fb5d5f0881cc0de9357589c5bc82a30f7ff9e935e489a715f4fb0b432cddeaf93151c1128c223eeaacb3f4586ccaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675959874, "uuid": "1291d89c-81da-467f-92e3-9be118d839dd", "value": "T12504CF1233D2D471D472BA319C78C6F17A3EB8204A785A9B37682B3F4EB05E19A77351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675959874, "uuid": "f770ddf1-2687-4271-8105-1e86d74675ca", "value": "910163c173a5611f34260e641a94d790", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675959874, "uuid": "326fe8e9-34c8-480e-928b-f2b79f0e8e56", "value": "3072:UfQyLPGWT40o4ZEy67k+YSVDdM1q3ZHAYl+V34BabNA:UfLd+4j67BDCHjzbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675959874, "uuid": "8cd1fc51-c3b5-4760-9542-433b1f18a3af", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675959874, "uuid": "7dd35aad-b990-4ea2-8315-6b4c0b8f8ea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675959874, "uuid": "5c8b1f68-cdf7-4ead-851b-f11b4bbaf79e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758ee587-a89a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675961686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961686, "uuid": "916015f5-ce27-4340-a83d-49c7d1e82d4f", "comment": "Malware payload (AveMariaRAT)", "value": "8c06588ecd86390ef04ebc5b014f39fd", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961686, "uuid": "9da7bf49-ab98-4369-8224-2ef56ad3c2ec", "comment": "Malware payload (AveMariaRAT)", "value": "382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961686, "uuid": "5b51457c-c229-4501-88ab-78c0735df9e5", "comment": "Malware payload (AveMariaRAT)", "value": "7f499ce7ed8c8d7db6778605d9a6882caf504e42", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961686, "uuid": "fce523b6-3876-4419-88fc-b1b1e498e150", "comment": "Malware payload (AveMariaRAT)", "value": "2594edf5c0e85ed57169bb5268b15d3a34f24ef63df6929e9171bc6274f9ea171e0d2b94adcf7e672095e99833ca727a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961686, "uuid": "fddcbfef-53d6-46c1-a6aa-a54de8520390", "value": "T170F422210264C730EDBB4A71F8A15B1013FAAA9DF325EB1D9E4834ECAD12F19D781797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961686, "uuid": "e4c3994a-e790-4fe6-938a-c6aa1d8a2899", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961686, "uuid": "b6152369-d419-476f-b499-28d2b33b0094", "value": "12288:VZrPA3yOrx7p58lCrd4gyQapWMs3Y8Rd04PsSiEvADcMRahDHBZKaOKVUPAZmFzo:HA3nrxN5IC54TWM6RyYvvA/ahFQaOKVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675961686, "uuid": "d9028dea-d550-4e24-b03f-5da187583485", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675961686, "uuid": "8990dd43-569c-4301-8483-2a64833a8c50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961686, "uuid": "348814cf-82f0-418c-9ea9-83db4c48862a", "value": "RFQ SPECIFICATION 20220393.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b508941d-a8a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675965229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965229, "uuid": "405984d3-6f6c-49fd-ae53-7821b921bb03", "comment": "Malware payload (Tofsee)", "value": "e6e49272be55f3740505c9b8e7b4ace5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965229, "uuid": "e672f05d-8943-4daa-8801-c1827aadc62f", "comment": "Malware payload (Tofsee)", "value": "385f5f4495f4dc6884f0f323500bd49202bb688d651b910f1990dcf0c80bcf51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965229, "uuid": "042043ed-4090-46fd-a50b-03e758323ac5", "comment": "Malware payload (Tofsee)", "value": "e2cf6ee2d1532c40a5870270b41f978dd8e6b54f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965229, "uuid": "4ba1d92f-5cdb-4eca-8685-bb2c09f38215", "comment": "Malware payload (Tofsee)", "value": "b4afb6bb1e869e57d4f03596cee4bb1a1c9dda521cdfed15c273f97d13047c1111fb09337f0afee8dc7ef1f643c2ab77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965229, "uuid": "5cc1565a-76c6-4b2c-bbc3-0ede5e038fef", "value": "T11204BF2373A0E872D036B6304C69C5F5673EF9214A78AA9B7758273FCE702E19672351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965229, "uuid": "e35f74f1-1c2d-474b-be86-c625317cb145", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965229, "uuid": "f2d45be9-727e-4381-8ea2-b683e9ba3ea1", "value": "3072:ZFgHBIKAYeVUI4iKdy4MgqZ+YGMH4KEs3G4QV/TctXxqz9LFeWrThA9w:ZFMr0U0KdU+0ks3uVGh2BFeUThC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675965229, "uuid": "ad740652-6f7d-4f5d-9d90-113a3d8580ee", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675965229, "uuid": "2c35b9e2-266a-4872-8368-f7fd00ec1dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965229, "uuid": "9b9fa136-28b8-4414-bccf-cb4b4ee977db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f556ab30-a810-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675902630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902630, "uuid": "2f91aa26-ec16-41c5-b6f8-7b1d08188a61", "comment": "Malware payload (RedLineStealer)", "value": "0651bcd78c3021782ba882f6a1b721f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902630, "uuid": "79bf4585-fb4a-49e9-8ab1-10a1f9e8676d", "comment": "Malware payload (RedLineStealer)", "value": "3877fd76143aaf2e4d8a64c26acfb6e3c538bd6bef9942cf081bbfc6263cb273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902630, "uuid": "33685ea0-99d1-45f8-8820-1076aed6820e", "comment": "Malware payload (RedLineStealer)", "value": "971e51e04a901792aa356f2fef1081fa6210f7a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902630, "uuid": "cc9a990b-e31f-4fa0-9cbd-7d5171c2b4a3", "comment": "Malware payload (RedLineStealer)", "value": "92816cae29244bdac5a3c5467a513f7841e6ae13810cada6b500c16d7c75bc75d0999fd626d7d7becf1951348e9d88ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902630, "uuid": "e2679ebd-7c4b-42ee-adaa-b2e83b649d94", "value": "T1D944D8EE7FBA45DAF268053397DCCC6403626CB3A8D4B2471988B6C90A30ACD51BFD55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902630, "uuid": "ccdaed5f-4635-4509-bce5-f8f616c5011a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902630, "uuid": "07700c01-8a56-445b-b83c-4aa2156aa693", "value": "3072:TELz01KoO9pszqJfTupJkDV/MIclW7/V/ADSkAru:TELz01qpGqR5hrkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902630, "uuid": "0c8bee4a-2e91-4627-9f17-2eee85dcb192", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902630, "uuid": "e36fdcee-2180-4006-96e3-b870ef5d7a01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902630, "uuid": "9578e651-5119-4c5c-bf01-907a549b56de", "value": "0651bcd78c3021782ba882f6a1b721f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3116755-a83f-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675922732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922732, "uuid": "4a7eb41a-12af-4599-a8f8-fd8b5450e82f", "comment": "Malware payload (NanoCore)", "value": "7a9949bf6158372778e5ef287b34dfb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922732, "uuid": "50f3a9c3-eb59-4cae-b032-211dda0d9a5e", "comment": "Malware payload (NanoCore)", "value": "38aeffdbbd7dc10a0527c8f0b33f100b50e70d41434258b969d1cf7fe57e946b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922732, "uuid": "7b8c73eb-ea40-4d8d-adcc-82c305a20873", "comment": "Malware payload (NanoCore)", "value": "77c12565c1d0fb6533ef263326e8b556df9951b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922732, "uuid": "407689d3-a83c-4bfb-ada9-222f6d61a7b6", "comment": "Malware payload (NanoCore)", "value": "240a2752a933a7749a4c12fe648dd05ed26526727c4e40622e7f41d0a77a6d2080cb2d73751b6c4a83dbe704514c2cef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922732, "uuid": "c40c15e1-61af-483a-83a8-22dfd5bc8d03", "value": "T1AFF4D01077ED4B08FAFB5B36E97181284AF5BC8A6439E20E2DD070DD5D78F01AB11B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922732, "uuid": "63ce2726-1a4f-4a4b-9db8-5aa659bd2ef7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922732, "uuid": "79be4cf8-a05f-494a-8dc5-16c9b24b8d0d", "value": "12288:ZAGLhKnQfkT/0e5hz9biN/nFH8+e6HF4ypM2SpVYyUl1bEQAKBkEWd:jLhKQfkT/0shbiN/n98+NpMqyUTNVkEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675922732, "uuid": "05dbff44-324a-4f4b-87c7-7716da5dc778", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675922732, "uuid": "daa95b8e-57ba-41c0-94a6-95e24af127cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922732, "uuid": "0b71cbc0-32fe-4f88-8a24-a388becc055c", "value": "38AEFFDBBD7DC10A0527C8F0B33F100B50E70D4143425.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eaee1ac-a8ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675969245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969245, "uuid": "422a22d5-d131-487e-b97e-1b39b491c70a", "comment": "Malware payload (RecordBreaker)", "value": "5c013fd2313bdfbd7893ffd07cc6b77c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969245, "uuid": "6b4fb67c-2e33-4f64-b66a-fd7f797f0ad8", "comment": "Malware payload (RecordBreaker)", "value": "3910c3dac8f94db398f09ee992042850f96a28b27bd6617ebeb18ea73406be09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969245, "uuid": "8fec5255-cd5e-464f-b610-e5fd21b5444d", "comment": "Malware payload (RecordBreaker)", "value": "71baef9fc75524966f5abde67df57b88df880280", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969245, "uuid": "1732ef43-7416-4add-86d4-c705e80d67ec", "comment": "Malware payload (RecordBreaker)", "value": "8393796f36de622c383dbb597d7db39ac37d48b5bbb1129ceb9c798dc1fb9c4fa0ad1ea3453629902164ad5e4f938203", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969245, "uuid": "9b871659-593c-47e9-ba5c-4ec8994f8ea1", "value": "T1E114CF1332E0E4B1D437B6319C66F7B0366EF8210E789A977758272F0EB02D056B6355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969245, "uuid": "036d89c9-3bd2-40ef-960a-e00147f50785", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969245, "uuid": "fc3799b3-4fd7-47cc-82ac-9f0f61d44937", "value": "3072:TFgFQVlHhoMtJTLWKyswMNJD22stxVbTpAvojD7ClfpOlbtA:TFTVtC8TqKywD22stjpqnlfpOlbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675969245, "uuid": "3da479ac-9e75-4e97-870d-4e7054f36edd", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675969245, "uuid": "67761928-704f-4b4d-a7c7-59b72c2c99fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969245, "uuid": "20113396-fb47-43c5-8f19-29536b32d78e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc908980-a88a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675954960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954960, "uuid": "cedcbb3b-5edf-498e-8f49-33a0ec621013", "comment": "Malware payload (GCleaner)", "value": "f696213483b0afd31834484883fd9af4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954960, "uuid": "b09a9bd0-d274-471c-8b7a-90ee610ea082", "comment": "Malware payload (GCleaner)", "value": "3937ac7fe052728e52a02823aa9a20c84527fd483bce84b3571958ae813d2522", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954960, "uuid": "57ab8f51-356e-4e3c-959e-14e9a5f1b91e", "comment": "Malware payload (GCleaner)", "value": "aadbfcf7c25f1f3c8b88482f88dcfeb81007b374", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954960, "uuid": "301fcc85-49f0-45b4-bcf5-3ebf9db7e018", "comment": "Malware payload (GCleaner)", "value": "79260ce73a0a871d9d572c13dcf5b4a05b4992425dab3f775df265d804d9e767bd6ddd99c3cd5d9711c4366a79210b12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954960, "uuid": "2e1643f0-fbe9-4e31-ad28-d8003dd34e25", "value": "T141B5027C7209C86DC280FEB48D2A98F71CDA6EE3E5A4A06370DD7F3F51792855A0A147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954960, "uuid": "7ecb1d9a-b1fd-469b-be51-7cc7d7695987", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954960, "uuid": "116c49c5-e148-4530-8af6-d51d18ced60a", "value": "49152:rdHqM29ZOQXKKchXC3Iba+nvALkZh8Bgx3+LCgv2MR:JHAPqhX3a+nvALkZ3ev2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675954960, "uuid": "bac65785-5cad-4146-a794-d516fd6d8e3b", "value": 2478712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675954960, "uuid": "b3fbd4f5-aea0-4cb2-8483-28d51abeed19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954960, "uuid": "18f8df77-e756-4bc4-90d5-f902a0e3de0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0dcb783-a89f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675964014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964014, "uuid": "a9650015-ef28-4a14-9748-9a338bc89b75", "comment": "Malware payload (GCleaner)", "value": "c47cb65d21554730bb17b816448ba53e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964014, "uuid": "f55a9cc9-6dc2-4b0f-85c9-c52c1ccad0da", "comment": "Malware payload (GCleaner)", "value": "3a0bfda2752e26424b2fcba1a9bbf0d062769ad238f6e66db2e941290dde2511", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964014, "uuid": "90add20b-95df-423d-88cd-01c159deb11a", "comment": "Malware payload (GCleaner)", "value": "bc6db7ad782616a5c8480c16399444bdf114fa35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964014, "uuid": "f658f826-5b0a-469f-aba2-453e28b4f6f5", "comment": "Malware payload (GCleaner)", "value": "55b91cc8f23608485f98a38ec8c677705312da9c49cc71d8b3d8d5e2460dd27edb619ee8cc53264ad4388873daa351e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964014, "uuid": "dbfcf743-315a-4322-9261-fd45fac882ee", "value": "T1F3C5013C7505C86DC2C0FEB48C3A84E75CDA6EE3E8A4946270DDBF3F92792845A19257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964014, "uuid": "56ca803a-ee1e-49b4-8a3e-7cb59fa6d399", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964014, "uuid": "7a19aa6a-3ee1-4f74-85c0-d620fbb807ee", "value": "49152:rdH3yRBFe1ph3PNMg7eC/ZARDWgjukHtxjnVW99gfi8TqLCgv2MR:JH32BFwb2LUSDxtBG9+iTv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675964014, "uuid": "7a546801-7790-4f77-b44e-cfa6c926d34f", "value": 2648331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675964014, "uuid": "8cb83979-0149-459b-8e84-9c8df845b290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964014, "uuid": "2d0b1af3-e9a0-4bb1-b02b-1e0c87df739b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9251bf-a8be-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675976970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976970, "uuid": "1c5baee6-8b64-4e4f-aa99-934795b6df67", "comment": "Malware payload", "value": "2e0d6bdfba3cb9bb742f4b939cb25313", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976970, "uuid": "9a4c2be4-28d1-490e-b1b1-5d931215decc", "comment": "Malware payload", "value": "3a156d1223d2420acadac6e2b8e9f27c4724515b4bf456fd34b4ad3aff36a8c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976970, "uuid": "10f14a9d-f84e-4c69-b3b6-9eb098e5eca3", "comment": "Malware payload", "value": "20698810e2b0c3a42535d7ae30e59b5b27db53a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976970, "uuid": "3a061747-7ac7-4654-96cf-b36a52267764", "comment": "Malware payload", "value": "fa4a12528c5f2810d610065c663c3c7cceb50983471a49efe30a51c482a2612910ba5d85656d98beccc139300b2ab8f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976970, "uuid": "43a848a5-39cf-4dbc-a072-794b72e400ea", "value": "T1B885B0007712F318EA5BA03FDD99A34F5AE61F44053CF1C562E4FC54BCA99BA7AA0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976970, "uuid": "b1b541cb-ee25-4219-a212-41ed82d85610", "value": "935778709500381f823bab6e7acae23f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976970, "uuid": "61f9bc07-c84c-4a59-a645-718d8b86caae", "value": "24576:F/1f4xC/km03getEAy41Q/LkobRN8c/NXYYARkCdvJNBRvT3SW9z55xqq2AoI:F8m03geBobRrRYt3vTF52Ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675976970, "uuid": "4c978968-1be1-41bc-b676-5c190f5a0b6e", "value": 1706128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675976970, "uuid": "96b00007-8226-40eb-930e-230eba3c1820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976970, "uuid": "5338c685-eb85-4990-a8ec-ea3cb06bc5ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d99042-a867-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675939912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939912, "uuid": "6a9f674d-2a8e-472e-bb47-6a18a4a31b34", "comment": "Malware payload (Amadey)", "value": "e38a0ab0e5f904a3b0a920d209a08fd9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939912, "uuid": "5bfce0fd-1934-4121-8db6-554732441144", "comment": "Malware payload (Amadey)", "value": "3a310f462b2bd31944f3a8fe409e7e5bfb58bfdccd3e5a5751ce2f2f1d7a6a04", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939912, "uuid": "50b60216-b8b0-4ff6-9247-77a1de93a321", "comment": "Malware payload (Amadey)", "value": "a93359a1101495c016774cb04c38e0438833ff41", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939912, "uuid": "f53a9bad-af76-4d50-a030-833aeac77117", "comment": "Malware payload (Amadey)", "value": "dc6fa40f10e6c5ae222ee511fcafe7d9f615320e56c48db1c02a3d8b373fd90a5fea6b3e01be2f79f966fbca53ab8db8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939912, "uuid": "5d33ad4b-0a07-443b-b55a-1efba49ab7d5", "value": "T13FB40207E6FC9031E9B55B7008FB03D309367D92173882AB735EAD5A58721B47A3672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939912, "uuid": "151d9298-011d-47f0-b72e-949dd0236bba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939912, "uuid": "61f4d80b-9d61-4a54-bd67-9cff90a184b3", "value": "12288:yMryy90p2XCV/JYz5dPSmn0uxVyHb/R1PgO:0yKV/qzSm09R5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675939912, "uuid": "d303164e-52eb-425a-92e1-98f75945ad76", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675939912, "uuid": "b51495e1-f32b-4ba5-b3e1-57a993fc82d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939912, "uuid": "17dce9e5-674b-4ac4-b066-c330d4eb93a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7ce3ce-a80d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675901278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675901278, "uuid": "8fe5eefd-9f2a-4e76-9823-c8ff54f7df5f", "comment": "Malware payload (Amadey)", "value": "1ad231e51a28adffa73c89b516fd9919", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675901278, "uuid": "0c5c925b-54db-4760-be95-f61f0fe1e7f8", "comment": "Malware payload (Amadey)", "value": "3a6a1e16581653bf5ee13b01db9f995d65a3cad63ad63d1ae05df48fcb286b4b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675901278, "uuid": "aacb0944-9bb2-414c-9e7f-ecb6a7994775", "comment": "Malware payload (Amadey)", "value": "a0fd8d7e0278a61f17fa8235f5d89d1b2a73ac2f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675901278, "uuid": "2e114a36-043b-4176-912f-2cdc48710de3", "comment": "Malware payload (Amadey)", "value": "538527189f47a8ba2cd7cfb9895c7c92f163843a240f1c9a57eab70145750ca9e47440252b9059d919c3f8d7798b63ec", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675901278, "uuid": "e58ad086-4dd2-447e-81a9-bb11c19b1ef0", "value": "T184C40207AAE88473D9B557B019F203C30736BE515B38829B778FAD5A08725B0B635B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675901278, "uuid": "03563d31-95d4-4112-9035-bcb9d56cd6b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675901278, "uuid": "6b989288-d884-4574-a534-e37af6c3ad7c", "value": "12288:QMrHy900f/mkTxjmKrFOymDDuppONWewtma1nuX8tQum:Hy1Fxr5VeEeauX8tQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675901278, "uuid": "0f73cd53-b0a8-442b-8fb9-1d67d5d833c3", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675901278, "uuid": "bfc517c8-ef99-46eb-97c1-06ecbd964c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675901278, "uuid": "8b44cf46-1fb8-44a8-a108-f841bd761aeb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a747c84-a832-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675916839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916839, "uuid": "13558599-c45f-4fd3-a6c7-9650edfcfb52", "comment": "Malware payload", "value": "862dce3bc4cddbcb2adc99b6058351f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916839, "uuid": "bbbf0549-1a2f-4e3a-96c0-8ddc2c419db6", "comment": "Malware payload", "value": "3ac15ea69a6616ae2a46179b12c5c7eb56864db904014f1534524dd08a17500b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916839, "uuid": "70c81b78-a310-46a0-a07a-1a7b592b51e1", "comment": "Malware payload", "value": "d30fb8aaf81d1eeaa582933e0078e17c783671e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916839, "uuid": "661ff056-62f5-4f3e-be0f-e9ee3d20741d", "comment": "Malware payload", "value": "d34a7a75eb3f72ef43584d8c7b834dc7efe868b235b9edd454567caf8fb330f985d96d269983387d58a3ea4694496707", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916839, "uuid": "d1c97550-d961-426f-a15e-63dcbe8382df", "value": "T1BB65122172C58471E97319390AFA9631AB3E7D702B398FDB63847A1D8E311C19E357A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916839, "uuid": "e70f35e3-183c-4e75-a738-869653e0aa94", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916839, "uuid": "02493757-31ab-4f2c-9f97-46f9a1970cd7", "value": "24576:WBqaS/LEMlP8NK5MBiyuYnCG/d/SUCxCsFSxkWaCMJoDwV9PBValqf7cqRBZlN1a:WBqaalPP6iyuwCSd/DsknkoDwV9PBwQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675916839, "uuid": "dcc56631-a485-4853-aef1-cc5952fcff95", "value": 1469336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675916839, "uuid": "eaadd117-b19e-4d12-8d98-2bd360cea5bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916839, "uuid": "95f1323a-ebcf-421b-8682-0c6a389640ec", "value": "862dce3bc4cddbcb2adc99b6058351f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901ecfd5-a849-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675926942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926942, "uuid": "ae9fba6b-008b-4fbf-90dd-710b27da312e", "comment": "Malware payload (Formbook)", "value": "7a7e1fdc019017623308a788e4950392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926942, "uuid": "2574aeeb-3086-40ba-a7ae-77da7312c4bc", "comment": "Malware payload (Formbook)", "value": "3bafde54ba687060ac7b17a4d377f368d27cf7c21fb369915065ee4995d2c01e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926942, "uuid": "faa247cd-e959-4aee-8dc4-700486f109a7", "comment": "Malware payload (Formbook)", "value": "1c189b88e848d4f43e0b91f79c415a7081727e45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926942, "uuid": "997240d4-bdd4-4888-806d-cbe1a57fda40", "comment": "Malware payload (Formbook)", "value": "690c8059b9f223f18367336be69fa91dbd18502c6211884fde3fa779b706ce5e251f0ce61b2839cddbcb67872dfc36af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926942, "uuid": "dd9e2358-337c-466e-9a68-4845d8d7ab7d", "value": "T138522A6063EC6523F8BE5BB988FA5510477CB6D3AC22DB6E21C551CE6AC23404991B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926942, "uuid": "2927ef76-924a-4090-b7ab-39644abe61c6", "value": "384:kYVYVMIE/FlaknIbE3lROzZK06wzbaZv:rYVtE/rI8Ozt6SbSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926942, "uuid": "8bc06e0d-727c-44cc-b57a-4cfaf854bcda", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926942, "uuid": "f71899d2-3530-4b1b-a363-5215f766148e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926942, "uuid": "c4024896-35e3-4027-846d-9d696589ed4d", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce5dab9-a84f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675929460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929460, "uuid": "705bd0f1-602f-4ea3-8358-83fec77278a4", "comment": "Malware payload (Amadey)", "value": "6adde2fe2d8d79b237e259c9c9145e32", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929460, "uuid": "3fa464ab-5c21-4f88-984b-f03288d49757", "comment": "Malware payload (Amadey)", "value": "3bbb0171508da6b87bfd30f4a06bb81b91dd11a8e9678052172574db2c257adc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929460, "uuid": "ecfb2ed9-612c-4280-bc6f-4c7584e567fc", "comment": "Malware payload (Amadey)", "value": "20075ef5048c02204d3bffa309a446574a1c9b2b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929460, "uuid": "f43f772b-befa-4f67-99da-ef512c7b73b0", "comment": "Malware payload (Amadey)", "value": "6032c447a0cd222c0524851c6190c05578580a6bb51ed59b662d7aa7662e99df5ca537501466125fc631b658bf016a7f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929460, "uuid": "b67779cd-c817-4817-92a4-82892a68cc9e", "value": "T1E5B40147BAEC4036E975577058F603C30A36BEE06B38C65B138E9C1A1CB3674A63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929460, "uuid": "47072078-c06f-4dcf-a3a1-2f128349310d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929460, "uuid": "d6499db6-9cdf-4b99-958e-d571e7f6a674", "value": "12288:9Mrty90LBQokn4USiRK2f+7JqhP8APsk8wJuHVHRAt:wyik4USQK2W4pJawJoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929460, "uuid": "c5f43734-665d-4eab-8430-3ccbbde50ac5", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929460, "uuid": "f6af07f8-7553-41e5-a41a-8a61055e6314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929460, "uuid": "9549da71-8a4b-4971-a2cf-dbf1b589249b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1995092-a859-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675933924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933924, "uuid": "42ec5e1f-5030-4390-98cd-f64adab6544a", "comment": "Malware payload (Quakbot)", "value": "4c39cdd2bfb2c7dde761a6e5b8c01321", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933924, "uuid": "ae8f051a-29c2-4758-91c5-8d000fcbaf6c", "comment": "Malware payload (Quakbot)", "value": "3bf1e10ec328ccd9d99e88e2767686851c501426c946ba4e86248d409e880b35", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933924, "uuid": "f203fcb1-3217-499b-ba11-4d513acb550a", "comment": "Malware payload (Quakbot)", "value": "5c092b3dfb2f3bda5cec1566762c9d4a01e43ec9", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933924, "uuid": "8cf6f62b-baa5-472e-b94c-0fe5d2f59396", "comment": "Malware payload (Quakbot)", "value": "649ab0add291f2be5b981f2ded5ebca722dbfecf23ffc8554771e500f34bb7f6e8b5c2e8f6c1174853241facd56b64c2", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933924, "uuid": "e794c672-2d9b-4d36-8f84-ddd2e39c55ab", "value": "T158112B101FF70B28F3F29A39ECBBA71144767956DE11E39E021556085832220D2B5FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933924, "uuid": "6a3481aa-995f-465e-bd58-16474a5a98b8", "value": "24:8dwj/erlZygbDhEKG2+svsfzkyHLrDOSDVdda:8s/6lZGsrikKL/OuVdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675933924, "uuid": "4413663d-2a0f-47db-94f2-adaf6854e058", "value": 1038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675933924, "uuid": "030bcac8-38d5-4e29-af57-95a4f3207f0b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933924, "uuid": "64f73e3a-b545-45c8-bf0a-d8d9f18c0f49", "value": "Revised_Order_Quotation.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ef97a9-a878-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675946903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946903, "uuid": "8dbf4a4c-41c2-4a04-abe8-4986d8339498", "comment": "Malware payload (Formbook)", "value": "1d920aa56457a163c9ede013081ae820", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946903, "uuid": "83d3a84d-5cea-466c-8f08-f214dd5fac52", "comment": "Malware payload (Formbook)", "value": "3d269d34d687979b0d73960f880ef5eaf5cd4bf4b90129ce5d6c0c5f8ec58995", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946903, "uuid": "a2dfc8ce-fe42-4af0-a111-218cb632fa36", "comment": "Malware payload (Formbook)", "value": "9e9ed8cf1341aaba3c6e32609a3780dff407a2ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946903, "uuid": "a8825e7b-9adc-4539-9483-b5b4e7954523", "comment": "Malware payload (Formbook)", "value": "0b84252c941a46d0fafdeea51cce0966be9fe360135f950586b0a0e76780fbdae8563172fb620a6c012ac2a5b24a170c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946903, "uuid": "961c596e-f4d0-4646-84b8-a93d1753fbd2", "value": "T15D541264B795C0D2F4330A721C3E771B2B79781A44BC868B13615D8D7A62246AECF73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946903, "uuid": "0c34141e-4c49-44ce-bba7-9de041838d49", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946903, "uuid": "6d607341-3063-4c6e-810e-a1c6593a643d", "value": "6144:/Ya60IJrcLmPyG1twMNr1GX1Iius7CCeEhMNUPLegtfSdtyQ:/YaIeOyG/slB7CCPQULid0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675946903, "uuid": "b2e9351f-800a-4deb-b79b-aeef4a2b1af7", "value": 303690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675946903, "uuid": "0eb44109-789f-4e7b-83fd-f2ab7d96f3ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946903, "uuid": "9c7c8bef-9884-45a5-ad45-42d6c0e4fecb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5782ed-a8ad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675969836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969836, "uuid": "7be1dbca-0b97-4fbd-b0a9-661340ed9356", "comment": "Malware payload", "value": "7edd32babaee23053cc67a098b0d7250", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969836, "uuid": "a181feea-abf4-4f0c-8374-d3b1c3ea5783", "comment": "Malware payload", "value": "3ddb2793a0fce8fdc39593515d0ef5923b14840502e4ea3c5b2051d190d34be3", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969836, "uuid": "d5208635-c598-44a8-b108-f2852040ff90", "comment": "Malware payload", "value": "5c5f86a6fa0e305c2b1d7e911ceb5fb07a13fc32", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969836, "uuid": "0876c2f5-be9e-4381-b7c9-951d41732a15", "comment": "Malware payload", "value": "075241dc3724bf395d325a1c899c65f56894fd2753b071f08d34580afdb7a19833d80b79053d4b6e6bb63566866ddac4", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969836, "uuid": "4754f661-3bfc-429c-a5f7-ca54404dfd59", "value": "T151B18EF966663914E181C83E765AB1EC97A324AD320858508F0BD331C4CEE8861E12DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969836, "uuid": "c77fd0e0-8b62-43ce-b9cc-9e9298743080", "value": "96:ABptYn9ihACtsTeHMENrciirHTTIJIctoZSzfxEDDR9uxA/9W80fw6s458dJ/YJF:AJE9i+CuT6JciirmnoZSzfxEPTWAVW8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675969836, "uuid": "7651c1e9-40f0-42a8-9a50-07a1c6de9cc0", "value": 5198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675969836, "uuid": "b9e02bac-92b0-49de-87b3-954165442ec4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969836, "uuid": "db7f9549-5ebf-47cc-bc8c-65f61d52031d", "value": "Agenzia_E6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4aef93e-a834-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675918091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918091, "uuid": "6fd88183-bd22-4761-b5b3-e4a5c745bd79", "comment": "Malware payload (GCleaner)", "value": "8c68610b9a49220f76d0b50271f586f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918091, "uuid": "bcd8f65b-f4a2-4cb5-a01a-d724895796fe", "comment": "Malware payload (GCleaner)", "value": "3e088221a520f2b8b185b32bcb69f0071b31b023c044f5c5a40067f225cea269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918091, "uuid": "0315a754-a50a-4d13-a84f-0a92cfc3ea00", "comment": "Malware payload (GCleaner)", "value": "cde08c9029c27917e1b93a31460fb7c4fe793495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918091, "uuid": "bbaa1f0e-ec0f-442d-9ea9-072cd38ea79e", "comment": "Malware payload (GCleaner)", "value": "8fed55db0903bb9e6c0c4a8b707bb9de4fcd4c377023a070d634882ffeb725859002c9c92424682d21373c1a50dc0808", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918091, "uuid": "5c25ab8d-412e-4ecc-8120-5b572db699db", "value": "T152C5123C7205C96ED280BEB88C3A94F75CDB6DE3E9D4906670D97F3F8678188960A507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918091, "uuid": "65840bb0-da20-4e02-8751-3c5be6194aab", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918091, "uuid": "c3671ae2-6b0b-45d5-8f2c-19bbec1aca6e", "value": "49152:rdHGqdWCmm9OtmYu5dv0asp6cXLLBI9JH1kEMaSoEfGQZQowMUTLCgv2MR:JHSCm7tmv5dvPzQi9JHeUHDQZQ3MUXvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675918091, "uuid": "74d3fc44-73c0-4bb6-862e-1152dc94e359", "value": 2722026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675918091, "uuid": "46c7811c-d6b1-4867-8e47-4892cb93c775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918091, "uuid": "ce6cde16-2bc9-406c-a2bd-619813dcdb60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0809756b-a88e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675956349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956349, "uuid": "393621b5-27f9-448e-aeeb-d986182f11cd", "comment": "Malware payload (AgentTesla)", "value": "1a6bbc71f60bd009845d74b68baa6279", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956349, "uuid": "da257eae-d0f8-4df2-812d-e8b1d22b111b", "comment": "Malware payload (AgentTesla)", "value": "3e0ea8f0b18b2923e2726ee49e39ddde2e641bda0398877f73a012efe9c41ca3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956349, "uuid": "9d5e1a17-27e2-42c8-b440-d461856da6e8", "comment": "Malware payload (AgentTesla)", "value": "013b2d6706b029e5da1eb042b81eee574ec2469e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956349, "uuid": "190fd919-929a-41a6-b4b1-20b42be56351", "comment": "Malware payload (AgentTesla)", "value": "110a0a67a348bf6be075737f2e051c8c1cba585db8f3ed26a7d9b2df1adedcb8843d0fb04e19842ae6d424ba01dd551a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956349, "uuid": "34153d88-ea3c-4657-81ae-ac62029ab49b", "value": "T187E412AE79BC4D99E2BD87BA29E1020413FBF156B052FB1D0F8434D11F7ABC0411AA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956349, "uuid": "a2f33851-6a9d-42e2-bdc5-5b6c4973aff7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956349, "uuid": "e244639f-5314-4945-b1a2-05c69788b414", "value": "12288:Hpg2d83U6mqvDK3L5q7h78vA7NY5gCICMpg9N85cWT7QeQlQX:J8Nmk8L8VNY5gZCMp1L3QeQlQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675956349, "uuid": "4033032b-db43-4c58-98b5-15fa000fd740", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675956349, "uuid": "7e3c4db3-b9a7-4392-be30-b72a3aadd483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956349, "uuid": "cd34c934-6b40-4127-b8dd-5bfdfc056e87", "value": "Curriculum Helton Admir CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eee3564-a8b0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675971124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971124, "uuid": "84872dc2-59d5-4b42-8617-6dc863cf4202", "comment": "Malware payload", "value": "cdad5532c2404f58c717bec4db3ad103", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971124, "uuid": "0b695c4d-80a4-4e03-b2db-5ec2092ff8bc", "comment": "Malware payload", "value": "3e5d10fb243fcd338cc881da3521e3e7f8e48bc10e29fc371dfc67cf67d407ef", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971124, "uuid": "c4c436c1-e73c-4085-9bbb-df9fd6f08d71", "comment": "Malware payload", "value": "1fd0ef3c865c9a513e6ebfb3cebc7dc01581e17d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971124, "uuid": "b7771e8f-c5c6-4f15-835c-7053df3b9f13", "comment": "Malware payload", "value": "8a7bc7244729f9f29082da1515612bd6cfc895a3ae28438dafd8a39c797faaa2092945ac0589e93a8c62b38bf98dbaa9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971124, "uuid": "acad691c-18a6-4f82-8291-2ffc3ae43c59", "value": "T1B116F1163DD5C53DD22F803B0182D62FA91EA1FCE94AA61B39F40A8B5C71D591B03BDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971124, "uuid": "6aa38c1c-09d8-4887-a57b-92cc3d12d7da", "value": "49152:g8fonajn6mLVJPELzOeOBWj2sL6NeTehg2AApit4AqvQc+aitUnbgRz4Y3vnU1sT:ypOeMa2I7Wg8X4cIUnbgH381W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675971124, "uuid": "d859ffe7-65fe-4cf2-8cdb-87c046bffe2b", "value": 4230974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675971124, "uuid": "ae6a54d6-8271-4b6b-84b4-f5b104313c95", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971124, "uuid": "b40afe18-a9d3-40b4-9a76-8219ca4b4fe6", "value": "minecraft.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d092098-a843-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675924145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924145, "uuid": "8c37230c-bbf5-4680-bdf3-d38eec0c8180", "comment": "Malware payload (Amadey)", "value": "dc8f97cab26fe40aedf727fb79a56498", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924145, "uuid": "51556cea-8cb5-4acf-8a89-280590755cc8", "comment": "Malware payload (Amadey)", "value": "3e90b9d6f8aac526b998958e1e1bafdaf34d1713b31ca2135272ee097b72ce00", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924145, "uuid": "15833c31-7327-4d33-9732-e0434de0a169", "comment": "Malware payload (Amadey)", "value": "04b4249a6b6b2d9ee8172fd5897d016a262e6c9e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924145, "uuid": "d22fcd5c-af3d-42a2-af63-5263c4201341", "comment": "Malware payload (Amadey)", "value": "18ad0f17b9b285d9fdbdbddaa91117529787ceb6cc11856e534fe7de829618210063011ea054ac9ab38d4888ddcd34ef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924145, "uuid": "85d72bc9-705e-4c61-bcf7-a78e89051954", "value": "T1BDB40203A7EC8127DDB457701CF603D31A367DA15E3487AA238EAC5919736B0B63636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924145, "uuid": "dcf0fc6c-c87d-4ee9-9d45-b939ec02db01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924145, "uuid": "d29ceede-258d-4944-b320-b1e3f1a2e641", "value": "12288:rMrJy90J/DFOYVTx1qg85ajP2N3N5idmBskNXaxEjoUA:qyWFnVdpV72D5idIqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675924145, "uuid": "98efc704-dbf6-4fbb-83f4-863c274e6452", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675924145, "uuid": "0f08eeab-61d3-4d1d-a574-bd8df70bb8f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924145, "uuid": "1db583a6-f7d5-40cf-ac97-0e9d7cfcd5fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1210d65f-a80d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675900960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900960, "uuid": "55a1a0eb-60f1-40ac-90da-7b18daa47236", "comment": "Malware payload (GCleaner)", "value": "b900973ca9ea771d0c8dcee8048fca68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900960, "uuid": "0ce7e194-224a-42e7-a878-9ec271e52d48", "comment": "Malware payload (GCleaner)", "value": "3e91155c0e9d384e9b5e09a01aa6695cc96120c73295ef2ea1fc92609ca0bea3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900960, "uuid": "2939e760-d1b5-48f3-95d8-7ead17c57025", "comment": "Malware payload (GCleaner)", "value": "25d472c56b48f8cb7dc8c11f0c5ec5529d5849a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900960, "uuid": "84ce74b5-4297-400f-a437-7af2a08eabfd", "comment": "Malware payload (GCleaner)", "value": "3a4c911563c41fb71ba188a9880e5222b20f1d3c30e81e8ebf852c2754bc0ba185c29fbb07411f34fa39f2db5d323636", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900960, "uuid": "53258dd1-5978-48e8-b074-39533c71e88f", "value": "T165C5127C7245C46DD6C0FEB48C2AD4E75CDA6EE3E9A4946270CA7F3F82BD1849A09107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900960, "uuid": "cb39efde-28e8-4a71-b0ce-b4f9f4895400", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900960, "uuid": "c2080073-ecac-4fc4-8a52-9d7304627e59", "value": "49152:rdHRA7WQmZZLDQvQrLJl7ruZ5HG5pCy3NxNsk455MSM8iuTOEGBXLCgv2MR:JHRsWVVDgQ3Jl7SOgqNxik4ZM8iui7vV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675900960, "uuid": "14508a27-dab4-4ac4-aece-82265b6582b9", "value": 2671600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675900960, "uuid": "4207b045-85e8-43f0-9b6c-c837e923e5ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900960, "uuid": "8c0100a6-3ca8-4677-9a26-712eaa17bbdf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0438b17b-a897-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675960208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960208, "uuid": "4fe29a10-4df0-4534-8831-d2aaf15f598a", "comment": "Malware payload (Tofsee)", "value": "58d86faeef3da94d86bac8dd7befcc0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960208, "uuid": "70eb11ff-f07c-47b5-a29e-416d3e4ae04a", "comment": "Malware payload (Tofsee)", "value": "3e931e9163964b02b6b15044bc8b3731f5160a88ad8a9257e1b31015a4e1ccce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960208, "uuid": "a7b1d442-91f6-45af-aee6-11c6073c9720", "comment": "Malware payload (Tofsee)", "value": "c87107ce8754c5bdcbe010b5423369b9e2e1c78b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960208, "uuid": "aa50c86e-87d9-438e-bf3b-d2a339ac29b3", "comment": "Malware payload (Tofsee)", "value": "8d98618f10644448df38bb0a49bdb39ecef6ac6866fa3c12b41cdd2471caf3c770b245af18a22025f91827788b6968eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960208, "uuid": "5bf2df15-665c-4ec9-be56-4ff6d9fe3956", "value": "T14614CF1336D0D871D436B231AC69C6F07B7EF8211E789AAB3B58273E0EB01D19676395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960208, "uuid": "2c9adf73-34f1-41c6-9d06-950f6e522704", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960208, "uuid": "9e08ac28-ca08-474c-9e16-4cae87ccd6b0", "value": "3072:qFgvAAmhyeIqlBF7rKaMTfdmuswWEHmXYXscwiFzuM2dHPpWBAv5:qF5vsqHlr2KREHmXYXsqNdKvpWBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675960208, "uuid": "d7bb48b1-b82d-42f6-b419-709f3eb8c632", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675960208, "uuid": "8b471316-44b2-4910-830d-bd2d0a1cf45b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960208, "uuid": "e1d29fc6-6fbb-4650-a3a6-fc0743a7c192", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b2f7ad-a847-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675926116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926116, "uuid": "ca07f556-08ee-437c-b695-ece788c6d7a6", "comment": "Malware payload (RecordBreaker)", "value": "f2c705a9d93ffc8c3f21e0e5c037e231", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926116, "uuid": "d17b61f5-16fd-4660-b4d7-963921130ee7", "comment": "Malware payload (RecordBreaker)", "value": "3ea36976172bbafbf4c64935cf228deb1955e539325738ad2ae50860e149d021", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926116, "uuid": "f1be3e19-6e86-4136-9da9-cd347d3c9eb7", "comment": "Malware payload (RecordBreaker)", "value": "1d01b4386b2a5ae887d7583e2af58ed5c704244b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926116, "uuid": "c653d900-6af5-4cf9-ae00-cc2a4723278c", "comment": "Malware payload (RecordBreaker)", "value": "b6af29f80cc5f479b77e8709d32d548465976442e5b7acd48755c633b6c1ac90b4808a8582bfa92b659c24873c5fd0ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926116, "uuid": "8173433c-ae74-46fb-8d17-4051fbe4d0c3", "value": "T19414D03236C0C072C47A34704874DAB57BBE7830D675DA5B7B682BBA9F302D1663A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926116, "uuid": "5d69784d-f40e-4f37-aebf-78d23c7c82c1", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926116, "uuid": "f039fb3b-6d68-42bb-96ed-f9957ad59b22", "value": "3072:eGAOvyMUiPCz+LYj5sW3zd5qlTFnBgLAWqi+eQVhWdu2iAj:eGAvV6Lc5sVjBgN+Lbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926116, "uuid": "64aa741c-4b22-4fec-a326-4b1b68b688ee", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926116, "uuid": "59afbac7-caff-473f-9e09-d4a1d44c00d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926116, "uuid": "8bbcd3eb-74c1-4685-bef9-926107865d24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0be91a-a897-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675960382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960382, "uuid": "0dee93eb-779b-4e8b-a0a7-49799e37bc77", "comment": "Malware payload (GCleaner)", "value": "ae11e7b529c220774fd48730e96e287a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960382, "uuid": "4277e506-9bd7-499b-8a7b-e8efa30aeb6b", "comment": "Malware payload (GCleaner)", "value": "3f407d4bd61fb256e5dff95a47c02c1ee739f21cec5573448977a28b933cb3e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960382, "uuid": "91e98e4a-d070-4433-b23a-c85b863077fc", "comment": "Malware payload (GCleaner)", "value": "c851c7ac62a35f8ff6a5437949c84eebac39008b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960382, "uuid": "7a53c34f-dc65-4925-ad35-9e43615e9108", "comment": "Malware payload (GCleaner)", "value": "6c9f15b29c7ec49cee3119e4e74dcf96a5c75b51feb8fe8ac56d7cc5e9c0da9f795798b731b69ac9329a86cd06487fb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960382, "uuid": "32fb5216-e64b-4664-9164-93badee874ba", "value": "T1E1B5127C7105C8ADC2D0BEB88D3A88E75CDA6DE3E9E0A02270DD7F3F52795849A19117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960382, "uuid": "415f5249-676e-4c04-94ea-86f192ea3dbb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960382, "uuid": "00a9dcc5-6fa7-4044-9eba-510cf8846586", "value": "24576:r3tHWkTGHanbbjGddDbjjotx+9KTSdrGOgXDzfaO851LFb1Tc1jXw0gxlLC15wvV:rdHPNGzTo7+9nMD7L851LFdwALCgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675960382, "uuid": "89e8cf47-382e-4598-b831-4752320ed716", "value": 2487487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675960382, "uuid": "248b39c4-248a-411d-aa95-c7b50534d184", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960382, "uuid": "2a23d939-593a-4ba7-94c4-75150399fe6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a3948f-a825-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675911303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911303, "uuid": "3d01d08c-9f0c-464a-ab74-c9a14efb3392", "comment": "Malware payload (AgentTesla)", "value": "6bca96125423b79fe048dcbc58624e5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911303, "uuid": "6f51ab62-a2df-42e7-89b2-ab9cf4ca7c7f", "comment": "Malware payload (AgentTesla)", "value": "3f726e7e27cab2febb3921fc3b4cd58312a7a394cb63fc5f59283654e27c88cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911303, "uuid": "8ffb2f21-a079-4095-9638-454929178cf8", "comment": "Malware payload (AgentTesla)", "value": "df9420a48516ed1b678705b13788b684e9eb7faf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911303, "uuid": "18458c71-4d9d-4a3c-8f2e-01a4e87402ce", "comment": "Malware payload (AgentTesla)", "value": "17a01b996d4720e83b7edaf7b9dc2f8637ba8f406402c4570a641a4a5310ed1edf068020cdf3645bddbb05e1c2a500b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911303, "uuid": "c0671d47-0ea4-4d5b-96c6-d2b7442722d2", "value": "T1F3C4A03D2D7656E2E1B8FB7186E28420B5AC8183330FC95AD9DADBC07F016826DCE55D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911303, "uuid": "b0b86ac4-6eab-4495-a2b5-ebf9d89f9d4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911303, "uuid": "e18ba28b-099b-4521-be91-163b82cb7a4e", "value": "12288:2KuPb+HT0qE8S6S7ztLHKNu+A+/1bILFv/uZb0MbVOboswfRaI1TQ/gYb:2Hb8vOztLHKNu+A+/1bM1/ibTOboT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675911303, "uuid": "871224ec-56be-432a-b820-dce78602db3c", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675911303, "uuid": "0ae19597-a2e1-4324-8fef-ff24e4944e25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911303, "uuid": "f23f4cfa-a32c-47fd-84bf-f326f00ec93e", "value": "Bank Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7c8393-a84e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675929003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929003, "uuid": "66c78e61-b6bb-4045-a3e2-b1de8ab9faae", "comment": "Malware payload", "value": "815cb82e9c7c2bef8bc8df2a73173c0e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929003, "uuid": "32501574-a2a3-48c4-9b2f-57f489857513", "comment": "Malware payload", "value": "3fe61d077a797986e6936506d93c441fd727baa9af8e3908f0b70135c475e493", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929003, "uuid": "60165e05-161c-4cd1-9519-1b0f8e309c4e", "comment": "Malware payload", "value": "a2cf0e1c232702ba74395e0f4ce4d92be78a5f6f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929003, "uuid": "8f747ffb-f8d1-46e3-b169-a7774267b611", "comment": "Malware payload", "value": "66b4e10cd18e306aa6cb87548a2f15b9b96acae0071eb07f6ce3bb1cf484b6c96db243a16b20e6fbba798a6d242b1961", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929003, "uuid": "c1e4eeaf-de15-409a-a60f-791b613f32e4", "value": "T1D5F42346A8561B8C47653C4ABB831D64AFD090C0DD72BE570C76AFEB8405E14EF9B31E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929003, "uuid": "b574a304-de3a-4b86-87d0-e148ad751623", "value": "12288:/BjVkDtlvEE5ygozi7aQsSqrqpZnb0nr+UX1jdmXeGPK5QPZDwVfm3bmz:ZjVkD8s7aQslWLE+UX1jPWK5QStmrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929003, "uuid": "9a1aba87-df1a-4911-b2c3-59f1eb1a9b13", "value": 787498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929003, "uuid": "a5d978c5-1a0f-4ae6-b816-4feeb2b5d3ed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929003, "uuid": "96005176-93d4-46cc-9861-da6eaa3b2111", "value": "Shipping Document_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c82447b-a882-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675951256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951256, "uuid": "0cd33b74-8b82-4a10-97a6-a8e7dd6e9fc0", "comment": "Malware payload (RedLineStealer)", "value": "424aa4b69afdf7a422f551f0cf3eddeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951256, "uuid": "857e8e8b-306e-4bae-adfa-2e072b871b8d", "comment": "Malware payload (RedLineStealer)", "value": "40c670bb50b4f05b3f9d45b23870927b8035598e6905afc55473925dcbd9a6cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951256, "uuid": "59f637e9-fc96-43ed-82b8-a0091823fae5", "comment": "Malware payload (RedLineStealer)", "value": "0bb38c9deb06d9c03b76b303872ab6c2613c3f35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951256, "uuid": "4fcec6ee-2b48-4b2d-a562-56619b0e53c7", "comment": "Malware payload (RedLineStealer)", "value": "4e9f015d42716c0ddc761c3f5f044972eb339f11e775da0879a19103d29ef360073cc108187c74702a8d1b5de81df377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951256, "uuid": "552cd612-2b49-467d-9877-a37811e4d775", "value": "T1EDB4323065F9E5E0E5C43636DC17BAF36160DD69E4A5AE0F3C853D0A3831264FA722AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951256, "uuid": "7c87bf39-c090-4875-8540-f5b93ab82859", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951256, "uuid": "d59150e3-3fa6-42f5-b8be-87e8026b975b", "value": "3072:3Y89W5Hon128oj0yjObfQ/lI/GwT2k/+Hvr8XpyZZWBG/Pa2tYpIQPqb:3Y8v128ow+oT2kmHv6CF3aU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675951256, "uuid": "53d08829-b782-4d57-8288-b26282a361ec", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675951256, "uuid": "82ee8ec5-e509-410c-a122-98fc11b738fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951256, "uuid": "e226177d-4993-42d4-8648-39f9f19a0699", "value": "424aa4b69afdf7a422f551f0cf3eddeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0774ba-a839-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675920251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920251, "uuid": "5c9ffa2d-c4ce-48a0-a499-3f3cedcc31aa", "comment": "Malware payload (AgentTesla)", "value": "a772fdac8dd71bd5bf0f599367246d90", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920251, "uuid": "97ff0bec-ad62-4c1f-af3d-05d5ac8b3091", "comment": "Malware payload (AgentTesla)", "value": "40fbdffc4c34a41a564d0863ed3563fb04f97b9325c1ec297a4477b15e6efbbc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920251, "uuid": "eda28bff-2b7e-4877-b1e3-d08765e3a73c", "comment": "Malware payload (AgentTesla)", "value": "3c11e9203f6c097266ec496c153760942ecf930e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920251, "uuid": "7a28494e-178f-4bf6-9195-f1cd3b35ca2b", "comment": "Malware payload (AgentTesla)", "value": "daa1b6d7c111b2e673ada165cb525a9c548fc4d30eeaba965981d65a69a8e7a5dbbb34ba2b3e82515c4efbf0dfa21fcf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920251, "uuid": "c1d0095d-b1d6-44f6-b7ae-3ffca2458584", "value": "T17D522A6063EC6123F8BE5FB98CFA9101477CB6D3BC22DB1E15C851CEAA823414991B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920251, "uuid": "6c6b131d-d69c-47dc-b293-8c88609bbd14", "value": "192:OzYVebFsga0ixbIbZ8It/F8jIi9N+ebEXn6BbZzeqKAohkUIu6wzyuaZN4M7:kYVYVMIL/F8jIIbE36tZzZKT6wzbaZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675920251, "uuid": "e766c788-3d71-4dc9-861a-067277ba2a94", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675920251, "uuid": "653548f8-69f9-4308-8705-5122f08ce916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920251, "uuid": "c1ad450f-1f05-48d1-933a-2d054a69dfc0", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b4f5a5-a88e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675956685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956685, "uuid": "47750381-e466-4bf7-b475-e80ccf4a6815", "comment": "Malware payload (RedLineStealer)", "value": "6e26fa1f9b8282cea01a809ee4686dce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956685, "uuid": "2eaccaa5-79ee-4cc7-ade8-d2053fef956b", "comment": "Malware payload (RedLineStealer)", "value": "41ea1e9b8d36d1b06d884dc4a5eba37f1b0922259bbf5d05ae6b2e9302424326", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956685, "uuid": "633a2fb3-79fe-4056-91dc-5a960bb2124b", "comment": "Malware payload (RedLineStealer)", "value": "68b9562d3ac93ea80ad4ed5ff69a6b1f207fe1fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956685, "uuid": "24ffc01e-c0c4-4bfd-8ff6-756acb4f8ced", "comment": "Malware payload (RedLineStealer)", "value": "751905418bdb632e50ee5165f629e9810b5feb8f9dd19d9d0151884bde4808c93cd4d35c8d376fe669073d3161281a5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956685, "uuid": "e7d3d086-383c-4789-a90c-54423be713c0", "value": "T11054F11233D0E831D862B6319C29C6B077AEB5E15B789B97779827BF1EF01D18A36701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956685, "uuid": "1865e2a1-8f55-452d-aae6-c1995d020e67", "value": "910163c173a5611f34260e641a94d790", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956685, "uuid": "fb6f6136-c0c8-46f2-a673-153d1552bd6f", "value": "6144:MzgteNOxYF1G7H2x4JifYipOVgxs7gNupT9:MznOxYGWxcg9pWgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675956685, "uuid": "4e05f1ce-1b9b-4082-ad9c-5449034b1d17", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675956685, "uuid": "d2f4f258-8a3b-4738-928c-f2be1bd7fd17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956685, "uuid": "c3157308-8955-4e70-93f8-52cccc483820", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707a6f60-a843-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675924312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924312, "uuid": "ad9f66e8-8a3b-4a0b-b857-09ecfc4042f2", "comment": "Malware payload", "value": "58a20e2fb5b26a20aba25907791dbbfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924312, "uuid": "52c19277-e323-4cba-8a67-9e7b74cde674", "comment": "Malware payload", "value": "41fe028ed7bb94b32284d4d701b86504067a8161f0bb9b9b0c394b595c7b604d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924312, "uuid": "92f0169a-ae1c-4bdc-bb92-eaf0b578c45f", "comment": "Malware payload", "value": "7203b41a60edefe035bc1b61a3bb2a8ee05bd614", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924312, "uuid": "bdd4b423-a050-4c15-93b1-498db1cee225", "comment": "Malware payload", "value": "f95b64770abd8699620964d26c5eca91a3a9adcc093e13791b0cd3a59e3b77a5fe65ead5783a3f26b2d9230fb51c9594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924312, "uuid": "894428d3-dcfa-4e9d-ab2e-de729335c9ee", "value": "T1D9C37C5178D0C072D46629314878DAB05E3EF9340E749EABB79C167E5F302C19A39EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924312, "uuid": "dcdc420a-78e9-4b56-bb82-327d788bf0af", "value": "975cca30fc6fc8cb327e3c61bc677b38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924312, "uuid": "15336f58-0692-423e-948f-f549b4ea2036", "value": "3072:LhfSAPbxJt8vSRbKc2lMn/ez7W1YyqDzkydo/8NiEXIgdKPvWaDAi:hJJtBYcpn/ez7pzkCifAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675924312, "uuid": "1d2b316c-1671-447d-afbd-ff9af68d8cfb", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675924312, "uuid": "e0fc046d-25a2-4608-92f0-007a14fca7fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924312, "uuid": "bb43006a-d690-4cf7-8fa8-8c445268fcb2", "value": "SecuriteInfo.com.Variant.Jaik.95172.20507.5971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f670519e-a84b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675927972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927972, "uuid": "0900c90a-67a1-4fea-9b7f-8d5ef54c07ea", "comment": "Malware payload (GCleaner)", "value": "e08b3eb34ec130ca933a54080402b49d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927972, "uuid": "e184a37e-dee6-42ae-81a7-26f35ace4bdf", "comment": "Malware payload (GCleaner)", "value": "425a31c3dbde472fb5fbf2890a129788a1ebfbfdac97b41df4cd049f575c5267", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927972, "uuid": "2589ceb6-7482-4c1e-bce8-6d22501f6b2b", "comment": "Malware payload (GCleaner)", "value": "b24cb3501ddb995ef9b352a907e6fea9c4ad1762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927972, "uuid": "c414089f-6e11-490c-8b75-5586f4560e46", "comment": "Malware payload (GCleaner)", "value": "2c8f5177d3e7cf3eed4b237f00aef47778b0d3b52991c1741e25211c1eb915105c0cf9cf67243a16453a422ac2f5c3ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927972, "uuid": "77dccbf9-6605-458d-bfa2-8102df74871d", "value": "T1AAC5123C7245C9ADC680BEB4CC2A94E75CD76DE3E9E4916270DDBF3F91782845A0A603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927972, "uuid": "8c150634-4844-46ea-96a1-1a37cd3d70f2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927972, "uuid": "b9895ae2-d791-48b2-ac6f-4d4ff9646591", "value": "49152:rdH0Nxo9aN8xNzERoD9niX3Duzkejx9A+40geFCsHpIpdXFHc5WLCgv2MR:JHKSaC+oViX3qQeFj/geFCsHpgFFc5Gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675927972, "uuid": "337e0b5a-7115-4da7-8b8a-0642c13cde20", "value": 2690974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675927972, "uuid": "32f4d12e-eff8-41ff-86ef-503d6120ad2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927972, "uuid": "0ea2ae59-63ac-4391-b05d-e8e6a150766c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81358ebc-a887-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675953546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953546, "uuid": "b1db9cd5-81de-40a1-9c60-015feb9039b3", "comment": "Malware payload (Formbook)", "value": "31ef7836de85721ee95454a48203312b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953546, "uuid": "244077a7-b39a-4aad-a71b-7834b197d5e1", "comment": "Malware payload (Formbook)", "value": "427b32faad1663fbe559c2044e382ad604e8df17b78e5450cb3dab2b55db5df3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953546, "uuid": "5017fb70-4b12-4788-9131-6aaa63bd17c3", "comment": "Malware payload (Formbook)", "value": "80160d4854a22c6d606599c600587c56a8d64ead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953546, "uuid": "670e0c36-9074-4707-a7e9-14af35217998", "comment": "Malware payload (Formbook)", "value": "0eb113e499880b360510cd64328fdf67969d6443209b56307af94ef68f40deae8df0c8ce53c726ae6a9c6d2cc14c7aaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953546, "uuid": "1462df94-32d3-4166-bbf5-c9aa11080b01", "value": "T165541254B2E0D133F7B71D310F7BE7AAABF5B01515A4028A23E44FA5BD729C1A60E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953546, "uuid": "71f18b0b-eb33-46b6-8afe-2a7e9ddb5ee7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953546, "uuid": "545fbc8d-1c1b-4b34-a6c1-3f08ba497970", "value": "6144:vYa65HL840K7tHcktnvHVZ6yFnzYe10XpN4FKHdDp8:vYXHLTTD64YA0XpN718", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953546, "uuid": "b8a4e300-f024-46b9-a488-1b86a522dc92", "value": 303685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953546, "uuid": "60ec29db-6991-485c-b4ad-cdb55a085f89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953546, "uuid": "c647415d-e48f-4177-8dd4-068d029de42f", "value": "bobolak2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0d73f7-a8b0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675971093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971093, "uuid": "7f4298b8-f70e-40a0-87d0-f35eb193d34b", "comment": "Malware payload", "value": "8d04300d69195d6983c6714ceb22f860", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971093, "uuid": "96ae6fcb-38f5-4d7e-b2c2-9cabeeb82e1a", "comment": "Malware payload", "value": "42f05f672edbc528ed7d1fafc5c48758a2ade1b5ba445c0d514ccd99fbdc17d3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971093, "uuid": "ea02a28f-7371-4e48-8088-711ac8c24d2f", "comment": "Malware payload", "value": "c5be4141217893dfb494295564c1cb429f532e12", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971093, "uuid": "0ae13dab-329f-4d2d-ae0d-5af1bec6e3be", "comment": "Malware payload", "value": "a0140450d87a5c536c3f9f691279b868bafab63f27710f2bb8717fa0a34f222c3f8b81a8415f3fbd2ebcaf0268cecca9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971093, "uuid": "47667926-f8ed-46c0-a2c9-318b1fc0bee1", "value": "T13793CF347D8DE9B0DF53C83A5870C937B50E10A9A717A3434FA584A5A4B8EE59E03FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971093, "uuid": "11a35c20-bc1e-4736-a829-f99ee37f526e", "value": "1536:ytkQdoq41UxuxjFvJYyyDuJz5t6se6s8j+7T9gN//VtwU0w/PoOv2cb33JYpK4z0:OoEcx5guJz/G8AghVt3T2cbZou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675971093, "uuid": "ff80ab62-d125-46a2-a205-739f4162352a", "value": 96654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675971093, "uuid": "f6fd160f-af36-413b-bca3-e5c977a06b46", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971093, "uuid": "5355fdd5-2391-4a92-a31f-605ff50030f8", "value": "jce.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c36aee-a87e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675949557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675949557, "uuid": "5189d100-634a-40c0-bd24-a3e9a66b8154", "comment": "Malware payload (Smoke Loader)", "value": "99ad5debe624a29d9377eb26f9dffe85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675949557, "uuid": "4c84c91c-1e8e-434f-b774-c792308940fe", "comment": "Malware payload (Smoke Loader)", "value": "4359e4a7a850f2315640011ea6ce9b5e1bf0eb2573c8764c87ebfc8fb3df5ddc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675949557, "uuid": "9e267429-2a60-45ba-b3f5-52a9d87b6989", "comment": "Malware payload (Smoke Loader)", "value": "7560b8ebd7f4f9282484ab2dd1bafd41f371f054", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675949557, "uuid": "6e3f404a-35c0-467d-92f6-36749004720c", "comment": "Malware payload (Smoke Loader)", "value": "625605ce96dd22aafffb3ddaa0146283581ac9f07ff4e1b51e36784efc6dad3642be0f803309ded646deab0cdda1c139", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675949557, "uuid": "204e4608-0bbe-49dc-a422-8e3f0bf9537e", "value": "T1FF14D0A636D0C47AC46A14308870EAA5777E78314175CA5777A82BBE5F703D062FE34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675949557, "uuid": "49bc9ea4-d86a-4140-bb1e-f5de49365d21", "value": "30b62189dd33bea0f552414113e8b2af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675949557, "uuid": "d4329c1b-bf3e-409c-a99c-a8312e748739", "value": "3072:v6gO8Sq0nl1hsLLrFWwVU54ootCeQYwS1Fvq33EOZzAOa8:v6ghWiLfF5GSvC33EO79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675949557, "uuid": "80750531-0bf2-4b25-abc2-84acca968164", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675949557, "uuid": "8051b059-b008-49bf-8645-1e7742af222b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675949557, "uuid": "1ce02934-46a1-4d8e-8418-44e2f14e4ea3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b30caf-a889-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675954219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954219, "uuid": "6d2ea1d8-68b2-44e6-acb7-926adad2d2a1", "comment": "Malware payload (RedLineStealer)", "value": "bf611e81e1b1823dd280169a3b92a8a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954219, "uuid": "43cd2280-5553-4abf-81ec-a06aa4dc8e8c", "comment": "Malware payload (RedLineStealer)", "value": "43b7343b5742434d77d8885692c06f686472bfdb2b8113c03cdc8341d7d96019", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954219, "uuid": "2026ccee-8648-439e-93a7-295ef3462c38", "comment": "Malware payload (RedLineStealer)", "value": "fe9220f6cbfcc59de43a9cdf0bb59256e7693b17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954219, "uuid": "0ce496a9-71c5-46cd-8a6e-c11e709f5826", "comment": "Malware payload (RedLineStealer)", "value": "2a136c6209d28819bf6f78400b643b0e309ad56b99b04e4f7a1254d8b2fd22fdc2d24ae92d843f68dd8c4f0358817f11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954219, "uuid": "5039c8de-24c7-4727-8999-92eaebab3e24", "value": "T15904C52437BCCD11D1BA1A3F6862501147BFA8029842F25B7BC767CD1E36B40F95BAA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954219, "uuid": "13123675-9205-4b61-9ba8-6344b30c63f1", "value": "3072:e+30JsUDva6bvyoTGPx1/PhIHxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+/:L30u3oa/hI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675954219, "uuid": "584f7bd8-cead-41f3-8c05-629b61823559", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675954219, "uuid": "382fce4a-ea92-451b-9c26-1076aaa6a263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954219, "uuid": "2c66fec3-ade1-44d5-869e-1d230c154211", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db38493a-a83a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675920625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920625, "uuid": "03b49d64-bc70-49dc-a4b2-54055195ea5d", "comment": "Malware payload (Tofsee)", "value": "7bdaac8ecc910ff0c4349d41990f21de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920625, "uuid": "d8cd688b-99d2-40fc-b3e7-4b5d765b821e", "comment": "Malware payload (Tofsee)", "value": "43c041df7a6ef6cf971b24f5a384c3ead9f3aba857184143a86ed97474bbd60a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920625, "uuid": "4e3f347d-c9bf-4a2c-921e-6eab09d4ced7", "comment": "Malware payload (Tofsee)", "value": "632c750e0a3c91cc0a0bad560535197020ce6319", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920625, "uuid": "67b2b57d-3be2-43a0-878c-8e7a9270f3d2", "comment": "Malware payload (Tofsee)", "value": "9dd6aeedd3336b930254e8d92d56a87b1ef06ac21bcf138379a52a473d2af9e5057e144617571934e172bdb5fefeda07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920625, "uuid": "0867e30c-a796-462c-9df1-c504384b30e4", "value": "T1CB14C03236C0C072C46B25705864DA616BBEB83076799A77B75B1BEECF303C16636386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920625, "uuid": "04c574b6-1847-406a-8fad-34ded5171478", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920625, "uuid": "3bd64935-85cb-4990-918d-d56422ff5d73", "value": "3072:dGgO3Vy4hpbTXLcOo4DWXzd5jcG4n6iHkUlQiChlNWAfDGz95:dGgXS7LLDacz6iPQiC0Afw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675920625, "uuid": "ffb4b688-f2ec-4e3b-acba-33c35c65157f", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675920625, "uuid": "0c1c39bd-6b59-40fa-95fc-6d9ff352f7e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920625, "uuid": "46736858-b8c7-4d34-9f70-a5f7133085a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0ede66-a861-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675937159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937159, "uuid": "0ed46249-2c42-4022-8a10-baed0f183d17", "comment": "Malware payload", "value": "fe01bf2bde5007ffd2a85556f55279f4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937159, "uuid": "794fe4f0-7d0d-49cc-ae76-6ca8d0fa47de", "comment": "Malware payload", "value": "44c188ae8683b47f35b1c5d17dfd89793c50c4000792cb6a3d061a8cbfdcf2e3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937159, "uuid": "0a5c8a55-fa7f-4167-84ac-f63ebceff8a1", "comment": "Malware payload", "value": "b8b269559ce9a49492be8e0d5b1f860cde3b168e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937159, "uuid": "15d503f3-b1c0-49cc-83ed-e51b04f2ad46", "comment": "Malware payload", "value": "f8bc7ad2b4e69de41b147b5fa1c880677ee463fb75ecbc97efa1a468fb5644afa3ba94f8a2144e0e02e463ab4b8e37e5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937159, "uuid": "ce84728d-b284-45dc-aa95-095e3a9f6f8e", "value": "T1C202BF9B57F4AA78CC987C8F659CAC6BFC5B96C9A7C2306B6034010F0D350623B56813", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937159, "uuid": "bef9c70f-cb95-403e-9ce9-82681ff42ea4", "value": "192:JiNMq5rDOp1BlVRwhcFyFjUhYJFFMPibrk692Ip6epDbo:JiNFXeRwhcQjZzIibYW2IpR/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675937159, "uuid": "7950d7ab-3450-4905-b1dd-1018b3fbac33", "value": 8273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675937159, "uuid": "c04ef0e2-eb26-4bde-a801-5bfffbaf33fb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937159, "uuid": "d3144575-ed7c-4103-89a4-98a319e7428f", "value": "SecureMessageAtt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d9d6f1-a84f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675929525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929525, "uuid": "9b591302-397e-4ee8-9991-54698d59221e", "comment": "Malware payload (Vidar)", "value": "d7d08069ca5131d2f153a3a9b60455ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929525, "uuid": "2f82ab54-8754-48dd-9918-8f301236e8b8", "comment": "Malware payload (Vidar)", "value": "44f6100a2d95f01fb7e692367928f9df629c556680bc74fe45011482184c8b61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929525, "uuid": "8ae86b3e-d1f1-4f2f-862f-9c158cee2c8b", "comment": "Malware payload (Vidar)", "value": "4655fd1d0ab47cd046a8043ed8c3dc2a87c0d5a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929525, "uuid": "219cd169-cd91-4a79-9727-7015657a7c97", "comment": "Malware payload (Vidar)", "value": "6c86b633bf0c33429266bade8a99b676295ae2aebb76ec4dea3caffb283bdbe1e08352dc60120e2e426eefd7a9edced6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929525, "uuid": "a3ef3181-3841-4411-9ab9-33d6ea8edc2f", "value": "T16FD5E042FCE764B1E501167209A7D2EF2335B9091F32DFC7DA40BFAAAD725E01932225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929525, "uuid": "a76a7f5b-473c-4246-9eb6-8ce111d3c930", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929525, "uuid": "52991f9b-c013-4bd0-8159-37b30a719296", "value": "49152:HCSHvx8vQiFUYisfslgff2KWF+xdguj67gOJLiQiHfsdbpB+oYa1+e:HCSHZy/UY1klTzF6dpXOgQi/a7+Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929525, "uuid": "7f7c5040-426a-43a1-99ba-cd5be5d28de0", "value": 2841200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929525, "uuid": "545a8d76-e113-4c8f-b440-c5cab17cd2bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929525, "uuid": "5d6a51b5-e728-4058-911c-50c9f4189ad6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ce891a-a8a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675967488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675967488, "uuid": "4c57a31d-9685-4be9-8899-376e2af0d1aa", "comment": "Malware payload (RedLineStealer)", "value": "56d0ad5ce7b9143e04ca339b3cca5c9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675967488, "uuid": "2a4cf7fe-8038-4980-af23-a0613f3e9960", "comment": "Malware payload (RedLineStealer)", "value": "450f987aacba8196554892ee73a8622511c280fd8975bde16b76357b26dead37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675967488, "uuid": "afc9c4d6-7ec6-4e76-bec8-39ff66ee4829", "comment": "Malware payload (RedLineStealer)", "value": "f27358ab7e420a00535b09c01c0eed67ec1088de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675967488, "uuid": "1196c3bc-24ab-4219-9770-c0856c40c5e4", "comment": "Malware payload (RedLineStealer)", "value": "06342e878eeded145d1adeefb85ca1925dcbb7969c7b9653a21165436ecb1f74c200a10aab17cae6579b4b695a139049", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675967488, "uuid": "d569c8f4-60fb-469e-9082-03f825084485", "value": "T11954F12232D8E8F0D432B6329C69D7B56B3EF4204A789B977B58133F8E711D29575342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675967488, "uuid": "21c7111c-e6d1-447d-9212-98fbb2e2de1c", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675967488, "uuid": "ab69f58f-0442-4a35-a7bc-8f35bef32df4", "value": "6144:RFz/lU0hwN+VveFtZuJAdDjmU+Mh+TCxXr1y8c3QbakrXY1n:RF+0hwN+VveGW/foTCJo8cgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675967488, "uuid": "fe21b181-f3ee-4c95-8b74-722029fd5818", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675967488, "uuid": "8e662999-029e-4f0e-abc8-48f2517beabf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675967488, "uuid": "5165efbc-0518-4ef2-83e4-3243fe7ed9c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1869e420-a854-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675931465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931465, "uuid": "3f0db88f-f90d-4c8a-9a2d-933e8286b329", "comment": "Malware payload (Loki)", "value": "dada3a7206cbc5bc068e0309b2a2a68d", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931465, "uuid": "b169b1b8-cf2c-4991-828a-fa40090d7c95", "comment": "Malware payload (Loki)", "value": "4516464ea0f1737577c1bef1720182cacdca6b3598b010cb0a8522bf393b6b0c", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931465, "uuid": "ec56d66e-d009-457f-8dd6-0468d1f517ff", "comment": "Malware payload (Loki)", "value": "83733f34e5d6c550a0c4b7a2c4c87cdc178be1b0", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931465, "uuid": "b6e03cef-004f-4b05-941e-3ab81b236393", "comment": "Malware payload (Loki)", "value": "73682792473380edb0cee3ec3683f53f36f4ee5d3ce4055bfd969e9491e6e4ef66805531467c9073a1846e1caf002b3e", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931465, "uuid": "adfe07ad-7258-4ab5-8ef9-bda036e14903", "value": "T11645703D1D7616E2E0B8FB7196E28420B5AC8183330FC95AE9DADBC17F016826DCE55D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931465, "uuid": "c2f563ae-a1f4-4f17-9370-6f0d961999b3", "value": "24576:2ub8vOztLHKNu+A+/1b9bupzrd8GrQk2SP8:2jupzrdV0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675931465, "uuid": "98870798-04c4-426c-91fa-9f0bda99766c", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675931465, "uuid": "6fb0b25c-3de6-4626-a661-d6a0246e36c7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931465, "uuid": "935d132b-7465-46dd-8de3-7f6b0e61cb4b", "value": "TRANSFERENCIA R\u00c1PIDA.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6d4a8c-a819-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675906373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906373, "uuid": "66909bbf-a3a0-4453-9dc4-02a34a457def", "comment": "Malware payload (LaplasClipper)", "value": "19f3d5109040aeec5b9fe96116403910", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906373, "uuid": "6a9905e2-ae66-4471-9120-9410aa629053", "comment": "Malware payload (LaplasClipper)", "value": "45cb3b8ce0c69ab5ea73e13589745a267830a38a19d9b0e08a260630aee9402d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906373, "uuid": "77d29aed-f1bc-4ea3-90c2-425ec9a8eba4", "comment": "Malware payload (LaplasClipper)", "value": "ac9ea722a80de63b6b734997b3def8b8dd3b0cb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906373, "uuid": "4c2e3ee6-a7e8-4e8d-8419-053bb587ad34", "comment": "Malware payload (LaplasClipper)", "value": "9a7f29d62bb6a7339243fcab8fd6c812e3d15a2cc8a620dbd32adc4ef5a4cdb380d0dec739a04d8d5cdd8c809ce9e7b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906373, "uuid": "e362a02e-9dfb-40e3-8053-6ca45122ec73", "value": "T19A95020393A1FCD1E9274BF2DE1EE6F8768DF9104F4AB7A512186A1B34B11B2C177611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906373, "uuid": "e12cf46e-68b5-4678-b1ab-74d2d9567636", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906373, "uuid": "282d4251-0e0b-4788-9272-aadcfc2a6411", "value": "49152:5E4OT84yxkVZgT9BShKqKK2uoGX0RXMF14z4h3JXaNXe:5P0PZgW/KK2u/XQXMFY4EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675906373, "uuid": "75dcefd2-c42a-46eb-82e1-1fd66c45437e", "value": 1991680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675906373, "uuid": "54e64af8-946c-4fee-b809-21000d2c6051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906373, "uuid": "f0f8c6af-69e7-4a4f-abc4-8a3b476afbb6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2871191e-a849-11ed-88f6-42010a9c006e", "comment": "Malware payload (Octo)", "timestamp": 1675926768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926768, "uuid": "27012c40-99f3-4a85-b0e6-2f60d61f4547", "comment": "Malware payload (Octo)", "value": "2a5a02a0efa3bb76f9547374ad2cadf5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Octo", "colour": "#C7ABB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926768, "uuid": "0c0e4d10-ccd6-4e76-a415-6782c4124ffa", "comment": "Malware payload (Octo)", "value": "45dbfe5c6e12786ec990276f88c3650c2aaa7776a2304813397f193660365413", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Octo", "colour": "#C7ABB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926768, "uuid": "6115a210-0687-489b-9700-a7b8c030a6fc", "comment": "Malware payload (Octo)", "value": "4ce71fa1a7866a98918223d84ab4d2ba88e2b757", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Octo", "colour": "#C7ABB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926768, "uuid": "9f7aa795-4056-4887-b6dc-8eb6a3652551", "comment": "Malware payload (Octo)", "value": "70a588228a5fece66c21fd5ee24c059939011804ed2ab89b98f7744bc577d422366b720a5e4df33590bd19ce526e6d20", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Octo", "colour": "#C7ABB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926768, "uuid": "d1e3a82d-efdd-4d85-a98f-da17526fe1f3", "value": "T1F5B423255D30B694D3420AB89D35584DF16253F02D31F23326E92B780FE849CBBA56EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926768, "uuid": "bb698e5e-c485-471c-8ae5-13e05c5c5129", "value": "12288:StRwfseyHt/2pTR0AYSOKKmmN01INjIGl/RDvqjtUJbz5VGpiy1kfAs:SIDy4pTZ9OKKmmmI1IUl+UHekf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926768, "uuid": "1fa1b9ae-0bbb-4f20-b981-e852833b205b", "value": 540229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926768, "uuid": "2530fd20-a8f2-4ba6-a637-13206749cebf", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926768, "uuid": "a0821e5e-d3bc-4a39-9a31-ef14267a9389", "value": "GooglePlay.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d8befe-a85e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675935806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935806, "uuid": "77ea7150-82e7-4410-9104-4e0ae229001d", "comment": "Malware payload (Amadey)", "value": "24e12b73cf9322cb96fa706d0973730c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935806, "uuid": "d482d9eb-be83-4e5f-bfa9-df8914b93bd7", "comment": "Malware payload (Amadey)", "value": "4629fd1be555bc6a226686a27e87867bad1dadbe4d2cd943f135c17cb0475a7a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935806, "uuid": "d8dce039-713f-4bbe-bcf2-7a76c2a5b848", "comment": "Malware payload (Amadey)", "value": "2c25ce7361104119d373817e8ac40683e3e1e228", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935806, "uuid": "3d9a0cbc-234d-4d66-b32d-e80ca07c1894", "comment": "Malware payload (Amadey)", "value": "6136cdc92c912724f9c8a301046e9d1e9b2b0b5fa1b335e21f30f1d0212cdf82dc779e40e92da919785bab5a883a0739", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935806, "uuid": "9ad9845d-4119-4f27-961b-f2f3a73b6f57", "value": "T10FB4020BE6E8C132E9B52B705DFB06C31A32BE605B35438B234A6D5A18736A1F535377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935806, "uuid": "321b4fd5-cac4-402b-8436-fcdad2b79f21", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935806, "uuid": "7266c94e-1e04-489a-a54a-9dd40ae89b1c", "value": "12288:gMrWy90oXhYeyUs3ZdVatmhd5oGoQ0FLDRPxMf:GyDTsJbatmpFR09DRxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675935806, "uuid": "0fb0d47f-2d88-4050-93a6-add659acd696", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675935806, "uuid": "a243a15f-dd40-4521-9860-95c7770f3eae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935806, "uuid": "e90482a5-5122-47cd-b594-d74714ac41dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5689859-a852-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675930897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930897, "uuid": "47edf10a-6dd8-4a1a-a0fd-a0c7cc8975ea", "comment": "Malware payload (Mirai)", "value": "5fac1bb5c1cf0f2eb77d66291136e9a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930897, "uuid": "ba42280b-b3e7-4c5c-98c0-39fdd4c26cae", "comment": "Malware payload (Mirai)", "value": "464e2f5739b92fe2809b0c0ebfb23bb1233403d22e93723ee7ebcc388b55ff9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930897, "uuid": "4eee265f-87af-4cc8-84a4-91335578d623", "comment": "Malware payload (Mirai)", "value": "39126df9b9b1e3602a29e37cc73d9ff6bca88a48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930897, "uuid": "3aae7297-95a6-4408-95fd-eabdd27ce0b9", "comment": "Malware payload (Mirai)", "value": "8f40f307197de871d2e4aba7aadfd5e77016a573aa2750eaef980eaaa7f0a32b49cb0054056f8e111e0466d3dfc8293f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930897, "uuid": "858958c5-ff25-47bc-ba52-134159272d88", "value": "T184F2F1B002E4D364E5BDD5377B1A79C71804B25C44C0AA7BF6C8282F6D12BDC3568F9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930897, "uuid": "75917c08-dfbe-4886-9f7e-b7b4987e9223", "value": "768:B7sq9DxX2YZCyZPltugq447cPqbcRka4/1ji1L9S7nbcuyD7UJLUR1w:B7l9dXL/47cibCkauBiNQnouy8JSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930897, "uuid": "fecaf144-b1ce-4018-9b35-3d6080390d13", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930897, "uuid": "59713d99-f516-4ecc-b12c-b96abb0503e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930897, "uuid": "0fc405b9-8d07-4572-ab01-11457e4fc6be", "value": "5fac1bb5c1cf0f2eb77d66291136e9a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327a841f-a884-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675952125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952125, "uuid": "45d45a29-3809-4183-85f0-4dcaa0da8e28", "comment": "Malware payload (GCleaner)", "value": "cdf8634bd3cb95f53146225b24fd550a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952125, "uuid": "d4cc9857-fe69-4858-a218-2a6d666c2db8", "comment": "Malware payload (GCleaner)", "value": "46bbee067f2d61332018f8f02ff923fffd5e1c6260df58afbfd0b020c7e22c29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952125, "uuid": "feaed142-545f-4abb-895b-3dfb931ccdc3", "comment": "Malware payload (GCleaner)", "value": "6347e3bc57312ee0fa196aaa369a98d8fd3e40f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952125, "uuid": "15bad738-3f29-49a1-b7aa-57f9c588f41e", "comment": "Malware payload (GCleaner)", "value": "cdac5111b5c7a830ee0af5068850ee66be6e29f9ff5502a9d4ec1b721a6200cb9074d39da80c8ed302d39c58d5407b85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952125, "uuid": "88c7fbf0-26d0-4760-b0d8-787ac385d722", "value": "T15EC5127C7215C86DC290FEB48C2A94E76CD76DE3EAE4902270DD7F3F51792899A0A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952125, "uuid": "033881d2-b6bc-4852-870b-a1300a66b2c2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952125, "uuid": "14bb9efc-8a3b-45c8-a74f-605b017b1017", "value": "49152:rdHDvAcqtN97hJmwHeeZNwIOXS76Pn5vvm30ql86YKUYTOdoi43QYLCgv2MR:JHDvAcs97zmwHJZO+6/hyjCNDYTOdoqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675952125, "uuid": "bf4512ef-78fa-4975-b1e3-0cbdc765f3bc", "value": 2561568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675952125, "uuid": "549004d2-34b8-46f7-9eac-ad0d99b80471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952125, "uuid": "561e5418-f906-4f42-ad34-2b13b42f90db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b500bf-a878-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675946948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946948, "uuid": "525c2342-dca9-461e-8d3d-3a74237e515a", "comment": "Malware payload (GuLoader)", "value": "7d8a0e790aa510d782dc26e392e059b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946948, "uuid": "207dd8db-a39b-4adb-adce-19362088fc6e", "comment": "Malware payload (GuLoader)", "value": "46cb28ba99ec877feb3fae26e33f934420fe8cc061d3dc06bfa660c25529f659", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946948, "uuid": "1f41a0a5-5842-48f4-af62-87c10919ed40", "comment": "Malware payload (GuLoader)", "value": "51cff6c25901887b9285db2a14bba6afecc1736b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946948, "uuid": "b1c343d2-58fe-460b-a72d-865c58af1676", "comment": "Malware payload (GuLoader)", "value": "36e86b6fe7112f1b1b16f11262395da4efceb43e8ea9f89f536413a5a1dd8e174cefda2e724fe813bd96da06bf095bd3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946948, "uuid": "0da99725-dc48-47b9-bbd7-86de878b689a", "value": "T1D494017DBF51A8260C1A2B66EC97CE6C4C64553760261C732C8821D639373B48FABDE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946948, "uuid": "5ec0c707-ab7f-462d-a4d8-dd7b689403d2", "value": "12288:Yaui1A78oYQaHzgcOk+dUzUwoPOP61WfR:ciqk7rgwoPM6AfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675946948, "uuid": "80e5773f-7234-42bf-86a4-60f841fdefc5", "value": 427913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675946948, "uuid": "fc807625-6d30-4d8b-9383-7d2db7717d75", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946948, "uuid": "88720aad-37d6-4618-9099-43de05646e78", "value": "oferta urgente GARMON ENERGIAS, S.L. 02.09.2023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e44ba0-a884-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1675952208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952208, "uuid": "a8413d7b-6f11-4f92-9c92-699e4d61b1fe", "comment": "Malware payload (Guildma)", "value": "b9e288075afe106a63a61ffccdcc999d", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952208, "uuid": "478730dd-48e7-41c0-99cd-60a75a0b470c", "comment": "Malware payload (Guildma)", "value": "46f94e720ce6f57fe4e58cb956f0948a4e806530e64f82a660b8de3c847a3762", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952208, "uuid": "6c9e5668-6e4c-4c30-9b58-0eff683c5c56", "comment": "Malware payload (Guildma)", "value": "5c48b7050f70f05579f4b66ec98e8b754ddbc2f7", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952208, "uuid": "2de4b434-998b-4995-a2f4-f12002f57bc7", "comment": "Malware payload (Guildma)", "value": "a99f1f57dfc214950fe77cac3d90eefa0b8e139cc705a51460e1f668e6303d22b306a771a8b18135ce877f95e182b421", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952208, "uuid": "157fd772-649b-40d3-b500-63ccab58bf4a", "value": "T1DA927F1E2129522AE4F33F18BFBF882DEB958C6D42505049F85C0D5F6DB24AAD9F1B1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952208, "uuid": "4d9c33a1-b557-474c-9a89-46662a004407", "value": "192:IDISWFAGeqLajNuChbg14yxzu4NQq4Mb/LqP5pAytFSqmWbk0Yp6jIjOr/G:IDEKGLrqt1Yp6jIjOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675952208, "uuid": "af391124-10ef-4af3-a318-b37882e0fcb2", "value": 20367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675952208, "uuid": "ae690f24-67d1-492f-8cd9-922a5fb6ab1e", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952208, "uuid": "ee2d85f2-90c3-45cc-a749-826137e9ccb3", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b96337-a8d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675985717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675985717, "uuid": "7cfe0dc6-e476-4e5a-a1f7-bafa4afedfd8", "comment": "Malware payload (AgentTesla)", "value": "96ca6b8264597ae04e22ddb94fa1e51d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675985717, "uuid": "41b98cb0-86d2-4426-8f27-52a94b8bf170", "comment": "Malware payload (AgentTesla)", "value": "4771ef53400b867c3f6c7344bffc1cb8c67ca393c42c684fcc0da75f0be7c9b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675985717, "uuid": "93be1674-c5e9-4cee-91c9-2c4a72326adb", "comment": "Malware payload (AgentTesla)", "value": "6c34cbe0ec1469479492861bdff2c82f75cae049", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675985717, "uuid": "e7626a85-17fb-44c1-85b9-af4e243a8515", "comment": "Malware payload (AgentTesla)", "value": "939d51faf3f14074f0a19e7ed0956f405e053e09fdfcebc332ab9adf74063dc1e51449d72656b811af105a408b826c14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675985717, "uuid": "0966bd4a-7a3d-4f3e-bcc7-3260ec9564d8", "value": "T19105231D2BE9AB04D8AD97BE28700F204376BC517162F32E5DC6B0DB2D77B688A10757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675985717, "uuid": "e018013e-5f04-483e-9927-dc74ce93de6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675985717, "uuid": "2f9e6d59-da21-4b71-a0b9-5c5dbc623990", "value": "24576:MiawxO5d+MnPuRliaM2siPvJVYT4fRuZ:nTso42se/YTWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675985717, "uuid": "96113a58-37e7-4b20-a5cb-c43e5a894a33", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675985717, "uuid": "d1f54d88-355b-4758-b4fd-d0171a57b626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675985717, "uuid": "1c72d3c9-da19-4031-8285-9f3e1ff159fe", "value": "%PO%_Valpar Order_TPO23010055-0058_Discount Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffd8354-a857-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675932954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932954, "uuid": "ccff311d-664e-4aab-a560-39c7c258452e", "comment": "Malware payload (Tofsee)", "value": "bfc215fa05d5f77943b9775722514c2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932954, "uuid": "69b404a9-d718-4fc0-a9cd-aae6938917b4", "comment": "Malware payload (Tofsee)", "value": "483c1d7e46ef96543d3f88041c0f1b37ef6db6466be29451c9921a5ebdd2b122", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932954, "uuid": "f3d20430-e1c6-4044-807f-5091a88f4a75", "comment": "Malware payload (Tofsee)", "value": "e998bbaa6ac82952066dbcd2c8b0f2d30c226c7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932954, "uuid": "e3eb9f7e-8e57-4e90-b1a6-e36f1a81e5ed", "comment": "Malware payload (Tofsee)", "value": "092154a0057e3af921722d7be257997539d21a36e954562c11ddf50851c0daf0db5eb018d31b6bede11cbcc46f41b440", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932954, "uuid": "b08f3db0-2797-4d20-bee6-a4a62ffa00de", "value": "T18514D0223280C072C16614709874EAB5BBBEB8301675C95B77E82BBE5F713D0B67A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932954, "uuid": "408d3a74-df68-4e93-bf90-5c253e9935b0", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932954, "uuid": "0092cc3f-38a1-463d-87bf-bd22fee68073", "value": "3072:/cqMOpfvgCauacLB+AEkWRd5XeWXJ5HY+6Leq3yNgF3jR1QEspo:0qM+gufLBRLJWXk+6ZMgZjR1QEQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675932954, "uuid": "76aa42f9-f6b7-41eb-927a-bcb696f5bf52", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675932954, "uuid": "be045b5a-7a53-4d4b-af46-2c64f9c5a2ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932954, "uuid": "58d53f03-18a5-4e84-bb6a-f2fe5d37db25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc50e77-a8c2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675979041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675979041, "uuid": "0cfcb7e0-98be-458b-833f-e2c81b704286", "comment": "Malware payload", "value": "ef9564d14e5fe1af86263eee2e1ab8f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675979041, "uuid": "58389da5-77f8-41a2-9a7e-6013b400af4c", "comment": "Malware payload", "value": "487c581cd882b2386377ce96dc707bc7877243523f5bfd47039ab8a5593cccda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675979041, "uuid": "b0e0cfe3-da81-4b9d-a7f0-cbb777493207", "comment": "Malware payload", "value": "a0e840a26d8f95407dc3bfda667926307c56ec9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675979041, "uuid": "f90e9475-cb07-47a1-8a8d-801e2aa45b24", "comment": "Malware payload", "value": "391ecc1e1e76764965a0c8ddaa5a693bdc85b661d0300366b30e9293351eadbd0cc2bce1af9238276dcf988459734e6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675979041, "uuid": "316a5ad8-52ec-4549-9fe1-8958403e02ee", "value": "T1A8B4024BA6EC8132ECB5173018F603D3093ABE515B34879A264F9D5E2DB21B0A73577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675979041, "uuid": "ecb5e025-fe99-4d5d-87b5-b35a1b1bfb4d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675979041, "uuid": "ffb3a7cb-3c52-4384-8c38-05ae9a0775b9", "value": "12288:yMr3y90xAMpQqSwPH1Fkiz6DTYNEvWgv0I+jg9XMS:JyVDqNH/kiUTY2M2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675979041, "uuid": "562abfd8-19d3-4a1f-9ea0-415b87b9a5d3", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675979041, "uuid": "28ece020-711f-47be-8782-b3532ac4ec74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675979041, "uuid": "290b1dac-de4a-45ef-97cc-18fb3b4ff855", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9450639e-a8cc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675983213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983213, "uuid": "67466b51-38eb-4e9e-a2cb-716ec0f0bdc1", "comment": "Malware payload", "value": "fb71e30f7cb497e8006aa4ec0356e20b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983213, "uuid": "98ebf870-db55-4a4b-9dda-2051214d5d35", "comment": "Malware payload", "value": "48d6e93d96f9a6399773136450e0103747c99faefc0df9378f57149ab605fc34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983213, "uuid": "5c57d116-3098-4039-9658-942ea966da40", "comment": "Malware payload", "value": "a270d58547edd3c75950d4a83beb363b64159769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983213, "uuid": "f631507d-0de5-4667-9430-4783b6454961", "comment": "Malware payload", "value": "a9c3e2a2bebbf717f5eb2d80112353237b100abd1fc1b7e8c1800a68674fdb40f5d7a18f94f29afdba0a63e87e447d9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983213, "uuid": "a9eca862-9474-483f-aaf0-a34942dcb630", "value": "T15BD1A611A38C473BDDFA47BA9CA2A7404738E753EC53CF9D68C8921FAD117A14662B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983213, "uuid": "b4fa4595-9662-4480-9cba-8298b874879f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983213, "uuid": "aab7a201-91e8-4334-8f14-4f68dea66b81", "value": "96:Bye0l8uEe8VrrABX/Yfer0gTtDtT6kcO9OKzNt:QXErWvYf5gZtTHPos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675983213, "uuid": "b6cb4bc3-990d-42c2-b01a-67946ea9f19c", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675983213, "uuid": "9a3cb419-b53c-4b0f-b0fe-0d17bcf48a2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983213, "uuid": "70f1d182-0371-4026-95f6-88686dcdef47", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986cb814-a841-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675923520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923520, "uuid": "450ed71c-8b6a-41e0-8a8b-eb286a90193c", "comment": "Malware payload (LaplasClipper)", "value": "a0da8483ba515cf977e01dcbdbe44b09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923520, "uuid": "b1f7d767-bdf8-4e0b-b58e-53e71b55f398", "comment": "Malware payload (LaplasClipper)", "value": "48e76ea09784f53c5d963a7edd2ca3a6d0999c3885772a5dc69f978e980c2261", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923520, "uuid": "4eb8ce6c-f77e-4b5d-b311-b2a1f7a3ad19", "comment": "Malware payload (LaplasClipper)", "value": "68cf59ccd02090f8c6314b7f03d7d1b8ef355690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923520, "uuid": "0290938a-8851-40c7-8388-8ed9ac0761fa", "comment": "Malware payload (LaplasClipper)", "value": "41971a50962ef4f601b00856cb7a2108b67b8d5ef03df2699ae5cbbcdd3ec8051038e58b10fc0006b53650a9c2ca0e6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923520, "uuid": "54ab87b8-8ca8-4b20-b82f-26f154ca676e", "value": "T11014E0263690C072C46B14705864EB796BBEB83046789D7B37AC1FBE9F702D0567A372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923520, "uuid": "e7a48816-f267-4971-be72-14728abe23bc", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923520, "uuid": "c844c9a3-a836-46ad-8298-31c875292add", "value": "3072:MaqVOfXhUGvel+tNLkgrWyd51r4TI7p06ogFOdPEdc/NtpMN6arn:xqV6dTLbrTsnTw49MMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675923520, "uuid": "a34aeffa-f5db-4b81-853f-109b451f9b09", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675923520, "uuid": "6e2a6ac8-0940-41be-9e1c-e17bd3ebe4ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923520, "uuid": "62372ad3-4df2-4f49-b8df-309abf011cdd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b408c04-a83f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675922639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922639, "uuid": "73357ea4-286d-45c0-b55f-0d5d454b5be3", "comment": "Malware payload (Amadey)", "value": "f73b9ca60c430fd8096edd82b909750b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922639, "uuid": "e02df601-c94f-49bd-9524-71ab7f927043", "comment": "Malware payload (Amadey)", "value": "496172d9dfd96b4114f5175f2c0fe6f7cd7bf107d58d22193899709a4dc5e3ab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922639, "uuid": "b8281a5b-2e12-433c-980b-05b2c665d81e", "comment": "Malware payload (Amadey)", "value": "34b5f4e5f64fbf04ff6b71814d2b986918bddc57", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922639, "uuid": "459019f8-15bc-4991-ad94-f44accd3ce3d", "comment": "Malware payload (Amadey)", "value": "9c139409afb1ff4d06f62c165929fbfcc1aec5494a6c9e35562578885fd501d534bb1c5f1e240c16e08b6a72a4dda88a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922639, "uuid": "483a6bee-b2a8-4b86-bd89-40095b595c56", "value": "T164B40207BBEC8022E9B1577019F643D31A367D619E7483DA638E6D9D19B3270B23076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922639, "uuid": "66d1fde9-05b6-4b49-9c0f-c17de54928cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922639, "uuid": "7f6e7521-06bd-4d3f-8c3e-33fb277c0b63", "value": "12288:pMrey90C5YVlKZ13aEo0CbikmkskNXaLEEfLF72Ms:HyCVM33aEvyik7wBzF72Ms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675922639, "uuid": "0d60a4e3-857b-4fd9-9ad5-89d90de5eba0", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675922639, "uuid": "bb5ac574-d421-4f80-9936-7ec2ad929779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922639, "uuid": "5ccf0ee1-11ab-496b-9b03-54c8f3a26b8d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05db80d7-a820-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675909100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909100, "uuid": "77ab290d-0ea6-4b59-821c-313a65b4acc6", "comment": "Malware payload (GCleaner)", "value": "119ce29a493317353daea202ce50e810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909100, "uuid": "88741f4e-d3e8-4d58-89f0-775209460e27", "comment": "Malware payload (GCleaner)", "value": "49a44a1fbc8e311bf09fb7c0a9feaa41e3ec7e39e8f78575b154488898e53b74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909100, "uuid": "83fccc96-6026-4b99-ba0e-008d963608e6", "comment": "Malware payload (GCleaner)", "value": "53a17e3970094b65c88e97310f7236298f3358a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909100, "uuid": "71722c42-15d9-46c9-a883-ec68a5c274f2", "comment": "Malware payload (GCleaner)", "value": "383a7b46e17d42852f4505edbf48313184ac1a195ef1bf177570eb23be18265cf56379cb5accf1e538e0bc4a28ff23ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909100, "uuid": "fb98c2db-bb81-465b-8976-69fac5b4b097", "value": "T1F6C5127C7145C86DD280FEB49C36D9E79CE62DE3E8A0A06270D97F3F51B92859B0A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909100, "uuid": "d54fa4d0-3007-4295-a10a-df10df867647", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909100, "uuid": "b69907d1-df32-486b-a86a-f234fdfbf301", "value": "49152:rdHDaOfeDfq7hrgZz9WEiXVjYqIp9mXVj7bhLCgv2MR:JHDky7hAMJFXvXVZv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675909100, "uuid": "1489a698-1cda-4379-92b7-b015c3c0ae86", "value": 2725502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675909100, "uuid": "04fb1f3b-04b0-483f-bc58-e113adaa7e45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909100, "uuid": "b984a071-d5f3-43fe-8c6b-5cf4949cf254", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17bd79a-a847-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675926192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926192, "uuid": "dd137659-f393-4a57-aed1-54ac5a6b453d", "comment": "Malware payload (LaplasClipper)", "value": "2690f34ee08588015afdbd06f11ae032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926192, "uuid": "730f08cf-9143-4fec-97af-65414cabe27e", "comment": "Malware payload (LaplasClipper)", "value": "4a3a02c7213cc5bc61ea59f83cbadb0c046c6a41f815840b1e02ab52fcca2734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926192, "uuid": "ea64af13-9466-484a-ab9f-479dbf191683", "comment": "Malware payload (LaplasClipper)", "value": "82905d6c1bf1d9dba33611dc833f4a67bd927ea6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926192, "uuid": "723bf786-dc2e-49c2-a1a0-cf79a5cdbdd3", "comment": "Malware payload (LaplasClipper)", "value": "5e2669b601a5a83e60d28c9c10d8243a87ec2ed8fceda45c22737b7367efe932f24ad2d2d827909d34ea354412cc79f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926192, "uuid": "944735f8-b3e9-4511-b429-ed148aa69c55", "value": "T16D14D0323DC8C072C46B11705824DAA56FBAB83176798E4B77A81BBDDF303D19772296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926192, "uuid": "e31bc707-b370-44b0-ab82-197771c29fd1", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926192, "uuid": "d753bfd0-94f9-46a1-9b00-a15717384824", "value": "3072:DQqTOnZFqtLIlSWLUe8W6d5VlZ66cGWpMcduzoxabHquio9Fy5A4JTyS:0qTcPl9L58PWMYuzoxAKrqFAA4Jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926192, "uuid": "68c5d583-8c60-48e8-8903-68cee5d1110e", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926192, "uuid": "0ef9e088-db54-4b60-a6e6-825c3cb09fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926192, "uuid": "cc58d03a-e0e5-4f79-bfe0-401ced6a31f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06da465a-a86e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675942603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942603, "uuid": "62f8b3b7-88f2-4c61-9c7f-865e099ae6ee", "comment": "Malware payload", "value": "9405b570c748ba245c630335becb091d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942603, "uuid": "aa8f67e7-af19-411c-92c5-d6f122685c28", "comment": "Malware payload", "value": "4a8a88e98e5330782ccf7aff16eb0b1f7e35c536b5f628158557358797141a59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942603, "uuid": "d6d85ccb-cc4b-4a07-9b65-144dfa8cc380", "comment": "Malware payload", "value": "05676d9892de08af51598c8b19f1684c8cfd9a65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942603, "uuid": "cbe746d8-a144-4fa5-9fcf-796d1b00624e", "comment": "Malware payload", "value": "aa0229d79add9a6abe8ee54b9cd7d6ac8a6c506273c28328366a1ec1127b96718b776007fcbfbdb77732c20db5faf0b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942603, "uuid": "99d1f968-c04d-45bb-b935-dda75420be33", "value": "T1BCC35B2032E5C032E25720354BA5C3B24A7A7C722AA6DECF7FD64A750F246D1D32935E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942603, "uuid": "cc8fe0fa-b4b4-4436-9431-8bca42683b7e", "value": "6611dc162030f0f44b54122ee9c79bbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942603, "uuid": "0d46b59b-9b46-4924-93e2-7529829269e9", "value": "1536:Y4GyOx0qu+1IGdwSEjPW7zr9iyQ641xIon1qbg5B85smnRlMz/sL+y4inSDb7GpC:lZSk+8SEDWPrEPrlfgl0st47D/G+aF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675942603, "uuid": "abbc2651-f88d-4dbe-b08a-47777c239372", "value": 123392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675942603, "uuid": "1df49ff8-d043-46c0-ae3e-ea22fc745628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942603, "uuid": "9bc18c35-cfca-40b8-8ff0-832629097e07", "value": "SecuriteInfo.com.Variant.Zusy.448947.703.8404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b34c18-a872-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675944634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944634, "uuid": "61935bb1-6887-4f17-90ed-7eb7e06683c0", "comment": "Malware payload (Amadey)", "value": "f0913573b8855729d1d1b85611159630", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944634, "uuid": "864b29c5-c7ff-424d-ae7a-6144be9c142b", "comment": "Malware payload (Amadey)", "value": "4b11cb52d4b052d4df0be762d98d3c23677602447c74ffdf31b0c0e7e0bd11e4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944634, "uuid": "21f6c3eb-dee7-4b08-bbf6-a963a6b89064", "comment": "Malware payload (Amadey)", "value": "530f5ca015aafee6b5514199782f790c883ebe11", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944634, "uuid": "3d831867-19ea-4c61-8daa-0744eeab40da", "comment": "Malware payload (Amadey)", "value": "875d7099a357b803d2b728afab00a7abc36ffd5bdba28cde296e514be11638addbb427bc99f678fbe09b3e45b7738299", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944634, "uuid": "9aa23e95-9b1e-4f93-bf0d-4216fe45b59f", "value": "T1CDB40207B6E88121F8B557B049F307D30A3A7E615B78839B768F5C4A18712A4E63277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944634, "uuid": "efbb0d1c-91d4-4723-a5bd-bacb6fa2c52a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944634, "uuid": "788c0222-17d0-44f0-b8e1-a9685808379e", "value": "12288:wMrgy90ccF9aITYkDHayxLvnLbFam7fbLX:Ayuhk0JLDbFb7XX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675944634, "uuid": "1dc3b50e-e1a4-42d9-a3b0-4d84ddda510d", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675944634, "uuid": "d85572c3-3ade-4fae-b89c-97817e262550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944634, "uuid": "bacb51d0-228d-4374-8012-8839e72c0e1c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7020d0-a839-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675920250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920250, "uuid": "061526e9-a0b2-481d-98c9-7c0dcca7d2f3", "comment": "Malware payload (Amadey)", "value": "b5123c27f979bf419b44a696572d3a35", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920250, "uuid": "1947c35e-7c75-48c7-bc31-96bf5a4977e9", "comment": "Malware payload (Amadey)", "value": "4b39c662067571fa538f5c2f66a6a8003110e5bad2cc96385894ecd998b3f693", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920250, "uuid": "6b66cd1c-ee64-4d28-93ea-e9d6fff740ee", "comment": "Malware payload (Amadey)", "value": "a2e14dc64c8722c6c21d876e87d176174364a58f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920250, "uuid": "89734d6f-251a-46e3-8202-b898959b6797", "comment": "Malware payload (Amadey)", "value": "f6db738f4d3302d6e5be2a04212856196b9a362170903b8ef3d113c5bab8416f9ed6c16b8054c18ce3907495bd570fcc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920250, "uuid": "a6288043-6265-4cf2-ba98-272a4f2bae3c", "value": "T1AFC4021BFAD89133E8F517B018F603D30A367E6057389297174FAC6D19B26A0A6317B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920250, "uuid": "825f707a-4337-40fe-a4f2-19642fd2e65b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920250, "uuid": "f130cc55-f0db-4a19-bebd-e1ecfcbc94e4", "value": "12288:RMrvy90pOJxj/tBfJ9JDAt6XiWp5rxZmFjzr7orA:uy9JxjlBhy6FjrG5zr8rA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675920250, "uuid": "fc81f618-ba0b-46e1-a36c-9df67d863b8f", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675920250, "uuid": "13d9a2d3-dca7-4e02-9d55-04f272e9d079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920250, "uuid": "ae04c2fb-a507-4db2-b913-5b6a19777a6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833e90d9-a8b2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675972017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972017, "uuid": "e222362e-41bd-4a0d-b0ec-a5557d5dab2f", "comment": "Malware payload", "value": "c6262257479c824411785d304e0d065a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972017, "uuid": "81404543-c412-4ab7-960b-eff2cfe6966d", "comment": "Malware payload", "value": "4b9a35e6e46f1ba9ae66800be7ffcfdb9f040a2474c1390905a3b298ca421dd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972017, "uuid": "838d4d78-6035-4326-911a-998f413054f7", "comment": "Malware payload", "value": "d1e7e1e01893535aa12114ca2eb80c8b96e37cb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972017, "uuid": "52f8588f-046f-4948-8cb2-9fb9975f95b5", "comment": "Malware payload", "value": "ef4d86e5d0c3ec0b6d1f134ef32450435e6be89690b8bbb5f7586ceb937e4577d7e7518b5bad634cef5238f2c22c93b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972017, "uuid": "569ee56d-207d-4275-b101-e8abd750aab9", "value": "T1DE150146F642DD96D40406B1CC8AC6BC0521BFADF837458739C53EAFF8B66B22C06979", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972017, "uuid": "4f7485ae-ebc2-4443-8d7c-28a8d162e2f7", "value": "ce55d910281f51de0e8f626585b992e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972017, "uuid": "dbda88b9-1b91-423f-a50c-306688745d5c", "value": "12288:/Eo92phKncZHgKhIYgrwCuQ4Hzc928rPYB/dIW47ZOy6eXk3oJm0oIw/M2/:99qQnsHdemJGAXIWSYb3oU0oIw02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675972017, "uuid": "ce2674c0-60ed-4888-ab08-ed7a5ef7453f", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675972017, "uuid": "77e5810c-e045-4cc1-9c0b-a81e022b3593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972017, "uuid": "a131e3d0-4b18-40e7-a9c7-c9bcec4d9292", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5acd3051-a828-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675912679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675912679, "uuid": "5cdb9856-cf9e-4f23-92fc-d4a5834b7ad9", "comment": "Malware payload (Amadey)", "value": "72dc6b6b449e524bec148bc2d8a90add", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675912679, "uuid": "66a57615-2bbf-425d-8c1e-bd2cfaeba332", "comment": "Malware payload (Amadey)", "value": "4bb7095f6db4774adea5ce33bfdb8c41ae0749958797fefa6e2d97c4905c8e68", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675912679, "uuid": "71c4b925-4ece-4452-b4a0-e1ba61d054e7", "comment": "Malware payload (Amadey)", "value": "46c82e79a3fb83e6d3d43364f65efde1acdccded", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675912679, "uuid": "33cb7260-5b77-43d6-8c6e-3f365912e921", "comment": "Malware payload (Amadey)", "value": "0730df16c1dd5a08e5af26cbd30136d946f9da06ca08bfe25b14e7f95334451b9cfa3be8c4425a35015c81516de97593", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675912679, "uuid": "75a206dd-d811-428d-8ece-2dc5117aea37", "value": "T104C41207A7EC8032E9B95F701CF602C31A36BDA04674835B668F2D5A0D335B46676B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675912679, "uuid": "8f4216e5-c9e2-464f-ba27-000bfadab6ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675912679, "uuid": "50a687d7-2dc3-4158-9559-f6b65dc9eacd", "value": "12288:IMruy90puoLVOqMqv+hMqiBLFB/7D/x1UYlNmbm7vqph:GyIuKVOOv+GxL7v/x1Ram7vqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675912679, "uuid": "63cffb1b-947c-4550-8690-80b6f951d029", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675912679, "uuid": "03b28ab6-2de7-4e28-b40e-83b7b2dc8851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675912679, "uuid": "9b8db6d1-be02-429d-bc69-80c3b64c70d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc995b9-a848-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675926428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926428, "uuid": "5ad87714-c8c8-4371-ab4e-c102ac99aab1", "comment": "Malware payload", "value": "6d51986673b8c8c71e1da556adc65bfd", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926428, "uuid": "4d1f5d5d-b2ef-410a-9f03-64eecd2b65da", "comment": "Malware payload", "value": "4c35631a9e1038d55b0f37aefa939ab81bf61de70b19fd3a182500212055fd1c", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926428, "uuid": "1250fe63-3b71-415d-b99d-d28c9060e2a6", "comment": "Malware payload", "value": "90326b56ba9365ba17a6080795b650ea81aa137d", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926428, "uuid": "169d193f-197d-4e43-9862-e17327d2fca8", "comment": "Malware payload", "value": "1021728437a05e2f2b12a6c6722c7662125bf9ba04de2d0b2df01f2bdc1bba6c6a9913e884a53de85942cad7d4c2985a", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926428, "uuid": "ad9bfe88-02e0-40bf-983c-b488d2aaae56", "value": "T1AF9423290D8457DC57F4323915E99C2EA893AB6B88D43ACB8AB37D019405F7F317A1B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926428, "uuid": "67ca6419-4d90-47af-95fa-4572f2347d50", "value": "12288:PBf1WT+Wxo885ndn9vs1SSXJDEDKed1q3U3y3:N1WT+Wxh857KwD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926428, "uuid": "43ccb1d0-a8ab-49b6-9c1f-f6af1a030c30", "value": 446888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926428, "uuid": "5ad68b0e-7a21-4ba4-9858-593c3c2673b7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926428, "uuid": "65b6a5d6-3cb8-45e8-8d24-a8af52979b9d", "value": "Statement of Account.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10215869-a82f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675915560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915560, "uuid": "758bbd41-d868-4dca-8edb-edea2db25dde", "comment": "Malware payload (RedLineStealer)", "value": "3a1695d3d3fa843ddefc2e9ce99fb5c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915560, "uuid": "cad18a59-8e7a-46fe-ae22-d2c0ca669b68", "comment": "Malware payload (RedLineStealer)", "value": "4c80863a191931f6ebad8b2a1d9b1e7729f80829e69f2ae00bc81205757563ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915560, "uuid": "9a550ac1-47fb-43c6-88fe-ff5db6adeb54", "comment": "Malware payload (RedLineStealer)", "value": "909b90289e5fb07ee0402f383457423804b8866f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915560, "uuid": "13393eff-901f-4c53-836e-a5190ac72585", "comment": "Malware payload (RedLineStealer)", "value": "9bf5b0219850428c78b731fa48d6486eedf06c9ed405f18cbb8d0fff99db866a236e54958f24d396fea097221a660ce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915560, "uuid": "90296adb-cdab-402b-bab1-c4e22b76efca", "value": "T1B7C40247B7E95432E8B157B029F503C309367EA01B7982A7229F2C5D5CB25B0B6317AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915560, "uuid": "09f27bc5-013f-41b8-95e4-aed628537e10", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915560, "uuid": "4e24579d-6e8e-4fa3-aa6b-8ae38c828ec4", "value": "12288:gMrsy90hWEipRO5grLxzCATOXtL06iISGCRDuoR0RMDGn8q/0Z:8yBrmcteT906PS0CM8cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675915560, "uuid": "230bc45a-5671-48e4-bb8e-c296e04b804f", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675915560, "uuid": "67c9e265-e45c-477d-89d5-1532684a751e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915560, "uuid": "b98d19c3-a127-418d-8136-bcaf8e75539b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558f7cfb-a85d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675935433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935433, "uuid": "ac72d87a-22fb-4e2c-987e-203654ab7831", "comment": "Malware payload", "value": "c526075b1a1e4ff19fdb6741111fa003", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935433, "uuid": "433d3d43-5813-4130-a0be-53c268a791e0", "comment": "Malware payload", "value": "4ce438aeb4811c9ec4d86e8fc2667dcf869c0ef54b9004ec66a78464fb095953", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935433, "uuid": "1067bda6-0caf-44df-8a2a-a3c81883351f", "comment": "Malware payload", "value": "102823d7b01db5060fafd4ae9c2c66d55334c753", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935433, "uuid": "846f6278-7d93-46e3-8179-b7fd847345a9", "comment": "Malware payload", "value": "f081537832ac6e70df5c3db935fd43e164166ef847da4c2ce4e58f2dad32be69b31fbc5713674de2815953d66011cab7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935433, "uuid": "f234b803-1410-4917-8d42-26f016177988", "value": "T1CD473322B193807CE9B70D7699F398410D7A7C2708F01582ACB4E5FEA839EC89D75797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935433, "uuid": "be52fd0f-a1e7-4f61-8601-42febee53254", "value": "48aa5c8931746a9655524f67b25a47ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935433, "uuid": "ad17d793-8328-4ce2-afab-7ddc5a97a6bf", "value": "786432:zKbAoJdnz3Bk0tgDH6aLUE/Rtusl3M2qyW:GbPPzBk04j/RtJc2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675935433, "uuid": "6a8da210-f828-4c25-acc7-7e0dce599c9d", "value": 26396728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675935433, "uuid": "ff40c1a2-74f1-4835-8765-b546a039b347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935433, "uuid": "4c5dad7b-c5be-4def-b63f-2b574d3c6cfc", "value": "iTopVPN_enseo_others_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32869cca-a820-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675909175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909175, "uuid": "9627741d-4484-4c1e-968f-c92372a73d0f", "comment": "Malware payload (AgentTesla)", "value": "7a24508ed89f7bb56684b3b208c69d92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909175, "uuid": "a67f3d95-4c26-4e50-a007-a45879d941cd", "comment": "Malware payload (AgentTesla)", "value": "4d265e6df24188d863cd6dee6439b264c2006dd9a203a6e47d72fdb398081015", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909175, "uuid": "b38eab4a-3f37-41ba-b135-2e9c482f9b98", "comment": "Malware payload (AgentTesla)", "value": "94c9c80206707d22897c4bfe537c456f3c641fd2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909175, "uuid": "d9cd273c-43ea-4081-a958-b5683672b462", "comment": "Malware payload (AgentTesla)", "value": "7126bda3dea186d6216a071b61580e546ba7510cdebaccb854576c3be34fc8be3daba909811138003a3aff683942603c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909175, "uuid": "8ffcf116-ce8c-4ece-bd6c-76d1e98aa2a3", "value": "T15B7412C6E2A4C497EC670630043F9F580DB7EE261DE4165637587F07AABB1A2DA5F302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909175, "uuid": "e34b0a86-5be4-4484-95a0-3df7c7ce5b23", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909175, "uuid": "0f9df97f-c66b-45f1-9d8a-aef7db24e015", "value": "6144:iYa6B3V25HkF+hUHZUW3kuRsgbacFc2EQGiPxz96EbbpZCHp2V7QQhTYGI9:iYLQHkF+hUeDu6gbzIax56ODCJ2VVEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675909175, "uuid": "0c149872-cb3f-4e70-b05a-719f87302c0b", "value": 352337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675909175, "uuid": "3335d8f6-f6f5-4cfe-adb6-d2b77d86df30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909175, "uuid": "db10854e-28ac-4b98-82b3-c3e8f99e2eb3", "value": "PAYMENT_SLIP_002_JPEG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144cedc7-a8af-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675970543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970543, "uuid": "ae22f463-cc65-4953-8c2f-326ff59670ac", "comment": "Malware payload (Amadey)", "value": "a93fe8ddf2804386a3cf6c9e112c647a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970543, "uuid": "86ce80fb-1475-4921-a3ab-361e6cffe0b5", "comment": "Malware payload (Amadey)", "value": "4d9bf71edf2fb4b9b85cdee88eff0cf5b109fe559354d4c33bf2083f873790bd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970543, "uuid": "5b0c8d31-212e-4eaf-ae56-046090422e7f", "comment": "Malware payload (Amadey)", "value": "805030d0e0497eb17dd73dd87bbbf4a6b430c342", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970543, "uuid": "f2e37f8c-b3b7-4840-ad65-e96d58b7a283", "comment": "Malware payload (Amadey)", "value": "c7478b8232276dd9902fa77375a8c89ce4c7923bb20e8792cd532e3b985cf45e30a1e45f3c3d32800f0084b0b59dc61b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970543, "uuid": "d312ee6f-167f-4c02-9c85-f7b4f8d61560", "value": "T129B40217A2E88477E8B457700CF307D31B327DA1AA78839B274F6D5A1C726A0667137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970543, "uuid": "59d13ff9-88de-41ae-a61c-10f686d03cf8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970543, "uuid": "dc13d850-5b7b-4036-a12f-b16d5c09dfaa", "value": "12288:EMr/y90OnXo1RiP2K4x3a2T6ygg1ghr8:Lyh4Of4x3aRZg1M8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675970543, "uuid": "64c7618d-c486-4707-ba19-392d40cffd27", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675970543, "uuid": "8c320832-6ef9-47f2-bebd-400163d35d9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970543, "uuid": "d898198b-bdc3-405b-afe5-6a869be98158", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f36334d-a874-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675945274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945274, "uuid": "8ff61198-1f2a-4968-800b-7dbcdfe7f6a5", "comment": "Malware payload (Formbook)", "value": "023196a1d6dc53932f7d8899b4b6911b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945274, "uuid": "08f37254-11ff-4188-948c-a6b46b60a351", "comment": "Malware payload (Formbook)", "value": "4da18f5e360f53c89bbffc55376aba4d8e2b088d74eaa60546f574a6c976fb36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945274, "uuid": "836fa391-bdfb-43ca-9bab-461b24685d54", "comment": "Malware payload (Formbook)", "value": "92f28856770e9d3b57454c755d5eb1f07e20922a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945274, "uuid": "74724fa7-7091-466c-934f-6071d07bf4b7", "comment": "Malware payload (Formbook)", "value": "67c101c39194401ed1ffdbb38a1e821d44776a55cd58ebd3d2e18f7d50f8f516bb1508fb6fab3efaed4e0063504a7407", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945274, "uuid": "6f50123c-0f5d-4668-bbdd-30bf5a8119da", "value": "T1986423407F53C077DA6357738D33875AA8EAA92140F8671727915FBAB643A82CD0EF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945274, "uuid": "495262d9-e3a9-4dbe-9f1f-8a8381d72a79", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945274, "uuid": "9c3c5250-fb05-4a1e-b642-871fc362a523", "value": "6144:/Ya6o9ofURKnjWkl0uaLr5Ma/XJysJT45wd2PctiXitWuqJs+ErifC:/YW9ofDnxquaLNM7A45wwPsVqJyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675945274, "uuid": "fc9fd975-cf2c-47fe-aa84-4f128f44ebda", "value": 316179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675945274, "uuid": "cee969df-0a7c-4cdd-8d5a-b3bcea4ff62d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945274, "uuid": "6f01d9e6-a7b1-4e91-88d4-d945dce6775a", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91df241-a886-11ed-88f6-42010a9c006e", "comment": "Malware payload (Zeppelin)", "timestamp": 1675953317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953317, "uuid": "e124f470-8fc7-4b10-abef-8e27269de9c7", "comment": "Malware payload (Zeppelin)", "value": "ca1e56a26f9b7b8e18a5f627bd946d53", "object_relation": "md5", "Tag": [ { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953317, "uuid": "cce7a6b5-b5e5-4bcd-bf62-97e598f79cac", "comment": "Malware payload (Zeppelin)", "value": "4ded976d2e5474b5ce1562ceb032981e23f170e7d6ec07fadd131aea82715a5a", "object_relation": "sha256", "Tag": [ { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953317, "uuid": "75e5530d-38f4-4a11-beb5-c361fdacc1f0", "comment": "Malware payload (Zeppelin)", "value": "80f9a9afa9a115acabd32ddbd0339a17d261e90c", "object_relation": "sha1", "Tag": [ { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953317, "uuid": "526313e1-08c5-463f-9295-f56b693fe797", "comment": "Malware payload (Zeppelin)", "value": "3ad1178c42b5703c86412f297d93690e79d4c8c95cf8e292a4cea92470e866baa0866ac3480217e60db6bb4c0e40b7e2", "object_relation": "sha3-384", "Tag": [ { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953317, "uuid": "cc6ee6d3-2e82-4aeb-b58d-1761e2ffa2a9", "value": "T1FBC57D36E6B04436D1731D7C9E5A57ADA12E7E301E2C14477DE82E8D9E3E3A2642D2C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953317, "uuid": "e8634c46-1b12-43b0-8d90-023850f7ee29", "value": "12288:jOU/d7WQvyPWa4DQFu/U3buRKlemZ9DnGAevjdMOU/d7WQvyPWa4DQFu/U3buRKO:7/JRyuN5e/JRyuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953317, "uuid": "bf3e0410-b864-4ac8-99a8-39473bb35179", "value": 2678784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953317, "uuid": "12587e08-dec1-492d-8b2f-e5042143c544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953317, "uuid": "81636a41-d3cc-41e0-86d7-34cd30f8b089", "value": "2023-02-08_ca1e56a26f9b7b8e18a5f627bd946d53_zeppelin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3841a1c-a834-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675918089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918089, "uuid": "1dcfff6f-7568-4518-90a7-f2d5047b71ba", "comment": "Malware payload (Formbook)", "value": "8c56eb64555127541e802044febab8cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918089, "uuid": "fd5f4ed9-2354-45ec-ac97-6ce25ea8c5e1", "comment": "Malware payload (Formbook)", "value": "4df6bfd0831c63681da55ff22d4c6c97194ff02ced1414668a7bb13dfbeea980", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918089, "uuid": "19f46c1e-a169-490b-9742-25049b1fd1f0", "comment": "Malware payload (Formbook)", "value": "91a328c71ae281cc53782c40cdfc4624767555df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918089, "uuid": "a9aa7d01-3aa7-4495-be2f-2fd933a2cda6", "comment": "Malware payload (Formbook)", "value": "70d86f69ad5dafc0f322698d73ce47ddd8e8a3ace4c0414a017af72af6c7552181d4bc4cafbb879ce292c2bd31e232a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918089, "uuid": "981318c8-e3fc-4672-869a-8f0c9a150c89", "value": "T127F4022979BC4D5EE2ED43B549B2031553FAB042B1A2EF1D0F8538D12EB6FC04527A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918089, "uuid": "68a7bace-8355-4158-a735-c08fe0eea8fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918089, "uuid": "ec47783d-2c50-4bb9-9b3c-5b9c50f099e0", "value": "12288:ZGARa3GUecJp1tDX2mRg5xIBGNQ5kt3hrks8RFmUXe1KaI0Yt8tpy/QlQX:ZTPUeFmRg59Qc3hY9bXqJI0B6QlQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675918089, "uuid": "f6c1d57c-a1ae-41e5-92e1-a8e83cb9a61e", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675918089, "uuid": "b1ec5d72-c588-406c-ba8d-8aae4500ac87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918089, "uuid": "5eec7c61-33cc-4a99-bed6-43cb30ae1747", "value": "8c56eb64555127541e802044febab8cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff610f9-a881-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675950779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950779, "uuid": "2993252b-13c8-4b38-aade-4f96c08e4e2c", "comment": "Malware payload (Gozi)", "value": "16b8e5c049f213c00071a59a6f69f5e7", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950779, "uuid": "f3d57f5a-285c-4a60-9866-97bb6d2c5502", "comment": "Malware payload (Gozi)", "value": "4e801b98464a9bcbceeaeb058cfbdef589e40e255206ba8c926f8d4c82ad08ef", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950779, "uuid": "658c5d85-c864-4e94-be08-ebc3a11f9dde", "comment": "Malware payload (Gozi)", "value": "08f0a4a6dbea93a3dd927218f7da6fdf5c2e8973", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950779, "uuid": "43ea6fd3-e8b5-4d18-93eb-4b5d1904dd64", "comment": "Malware payload (Gozi)", "value": "0f70c8f5cf49798cda35099a792f41db3b15adad0b6c0317175b1ed190c2e29fc85447e0ee5701513dfcff6a93f4b72a", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950779, "uuid": "bffd079b-af5c-4883-9da2-f596e7fe6406", "value": "T11AF0AB30DA140926C00F873231E3C3867DB2A2827E4BF657811C61DD0984EE50B09291", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950779, "uuid": "a4812935-7558-4463-a7bc-7cdd200ffa9d", "value": "12:5jnitGrnnXeVtJDWBM83gAyecVUXiBM6p7L:9nnnnXeiM83vyeKb/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675950779, "uuid": "bb5e2d5b-c327-47ca-846e-ad4d25cf1f49", "value": 479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675950779, "uuid": "0e16d234-1305-4577-90ce-e11fa662218a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950779, "uuid": "764ab34c-6f2e-4edd-a509-ba2afeea29d2", "value": "documento.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6567c0ae-a8a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675967243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675967243, "uuid": "d6ba31a1-e748-4661-9a60-25b0963badb1", "comment": "Malware payload (Amadey)", "value": "fbb40368854927013ec19a7cbbb4dbd2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675967243, "uuid": "f15b1564-f0c7-44d0-bd3e-809825748b07", "comment": "Malware payload (Amadey)", "value": "4ebf3e95e2473e6bc35a8704d90355b4a1e39d98bef5503bd006659a4a88d560", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675967243, "uuid": "ef9618d9-06d5-40bc-8a0c-49d529e4e535", "comment": "Malware payload (Amadey)", "value": "d0f8f859dc1f7aaa1113ef7a195c4c90922d5704", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675967243, "uuid": "0647efe4-80df-4e25-b2b8-4238b35adafe", "comment": "Malware payload (Amadey)", "value": "94f1639ceb50619ad26bbeee6d4ae3ae2844b5006fd7fd3f43143717a16a1ccc35b9cf7e054f60aec7db65da37e7c353", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675967243, "uuid": "2fa419cf-8022-4ec5-a775-53924cf87c72", "value": "T114B4024BA7EC8023D979177058F702D31A33BEA16A388397274F6D8919725F0B63536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675967243, "uuid": "efc482cf-c891-45d1-a34e-7049dcbec512", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675967243, "uuid": "376891ad-571d-43b0-b6e4-743f0f96c852", "value": "12288:MMrry90GRnT/QrDYv5UXw2uxjaYTlxhGwXnni:3ypT/QHYv5UXGxja47e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675967243, "uuid": "5bfcd9d2-6233-4d01-8515-0daed8d19bd0", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675967243, "uuid": "10a3d58c-10ee-4e2e-bd47-88965c19ec0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675967243, "uuid": "6dd630ff-7982-43b1-818e-6c37651e0a42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddea04be-a8bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675976035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976035, "uuid": "f49a6b57-3d58-4f5e-a45d-15f40b5f84ad", "comment": "Malware payload (AgentTesla)", "value": "7fa8f8bf85fb1be4bc73196aed2c9d78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976035, "uuid": "f8de36f8-d0cb-487d-a017-be002adb2fd8", "comment": "Malware payload (AgentTesla)", "value": "4ef04af7115b8a7f2550ee3f5ce6a313b2afdc9399dca75f649e4f59eb5e6166", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976035, "uuid": "9d3513e5-4ced-489c-ac71-bd10ad2aa96c", "comment": "Malware payload (AgentTesla)", "value": "39dbe4d1837a0639629f554f7a4855345bef6061", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976035, "uuid": "815fbd7e-dfc1-4b5a-a2b6-fceedd1368b3", "comment": "Malware payload (AgentTesla)", "value": "03287edbc8cf8fb74de4d266d5a65e29a3d1d809d330b166c0fdc83cd9e61686140a93c719febb9d4186ff5b539237d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976035, "uuid": "76f18e6a-8768-49b5-9f40-89f14a3f0ed6", "value": "T1D3F4220E135D9B60CECB97BEE4E60965537AD52CB152D72C8FD815EE2E23F818B81243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976035, "uuid": "71ec4f89-8008-40cd-b629-547d98d03a94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976035, "uuid": "c8c3d13b-0912-465a-ac69-ab581704e4ae", "value": "24576:ctbG3OSvLB/YVEtAEXFXqarxN5IC54TWMhA:X3UVjEFqatgi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675976035, "uuid": "159de468-42ea-4b76-8c4e-38b6e6592eff", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675976035, "uuid": "c8373bf5-88dd-4414-b304-7581b51b3804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976035, "uuid": "aa1b0753-7f85-43d6-bb87-35a3f41e00c8", "value": "Purchase Inquiry_KPCPU-2131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69415418-a86f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675943197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943197, "uuid": "12b3f040-b1a9-4019-be68-37d517c1dad8", "comment": "Malware payload", "value": "75b86d9a7250bb021052632b57891fc4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943197, "uuid": "17eb2e3a-5832-4e7a-8e2b-45d75a57c776", "comment": "Malware payload", "value": "4f1f844233833aff4e5af31ecec27eb4025ca670cc84fe29757854a00d588914", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943197, "uuid": "0133b977-20aa-4635-b0d6-e5c11f1b0356", "comment": "Malware payload", "value": "b25fa1c10649a44217c31edde54f7188374a11d1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943197, "uuid": "51de4c32-ae59-4c1f-b8a3-669d56d94d3a", "comment": "Malware payload", "value": "4a8320d98f6d8e033fb532d819b913add6df90b4c5cf5a6271dbd04eb002a6f08003e38e87ca0c91ad4cfd9a00d6d733", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943197, "uuid": "0e39035a-3f2a-4d72-95d5-4485f9fa674b", "value": "T16803E07EE001F814C8A324FCA50C26B3F71E230BE919F65A7449D35E5AA81DF53A798C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943197, "uuid": "7b91f2d5-3ca8-4578-afc1-05a2041e41a9", "value": "768:M1qeyGBS/Zarud5bNwfc/LL8eedexA8noWvTZZabIdvkLL8k:ehyGBU7d5bNGcserOYZvTZZa8/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675943197, "uuid": "77856ae5-a6f2-436f-9bcc-577094acc736", "value": 38426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675943197, "uuid": "68577393-4414-4b78-bdb4-9a677ec434f0", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943197, "uuid": "69ae4070-6266-4fe6-81eb-1cdcf00a9ebd", "value": "RFQ 774170.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606c547f-a8d1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675985273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675985273, "uuid": "a4ec5ab3-bb06-4556-9a39-6cb404c70f95", "comment": "Malware payload", "value": "1d4387eb294dd394b22e07176907aadd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675985273, "uuid": "96d1610e-e006-471f-8b35-942ab78485e4", "comment": "Malware payload", "value": "4f607c2791f6a633af4059781a8a89dd6fbab4512b56041f0961b178afa2a6d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675985273, "uuid": "79c33073-ef7e-4bcf-83ed-f07472efa5a1", "comment": "Malware payload", "value": "cc01865c70b58e4b8830ffda7b56cf050865a0b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675985273, "uuid": "4a4b4273-6e89-4572-a135-f6a9242c1611", "comment": "Malware payload", "value": "370a594994623d706d26a8c19d8d4cc944ffdf52e5ba49a317078aa1bfaa3b6f163e178d92b832c3f0fa9432448f45c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675985273, "uuid": "4deba5e7-8578-4e23-9238-82552e0d54ea", "value": "T121B40207B7FC8036E8B5677009F603C31936BEA16A78879B174F9C4A1973664B63136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675985273, "uuid": "dc5f18ad-5e58-4663-9be7-787763f16abd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675985273, "uuid": "c8f6aabe-62bb-42de-a20d-47cbd039e3ab", "value": "12288:tMrPy90RbMvDVJOjQPt/CVtFpk3i+/pHajhiZ9:2yYGVoQ1/Cjbk3i+BHaMZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675985273, "uuid": "986ce1ee-3466-4533-8bf2-6fb78c6f0838", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675985273, "uuid": "9056a43f-dbfa-44ac-ba9c-0eac6e0abf4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675985273, "uuid": "fef7222c-43bd-4433-9fe1-9e600c14aef1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d331e2-a810-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675902477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902477, "uuid": "ef5439c5-55e6-4ac2-a6bf-56d5511854bb", "comment": "Malware payload (Gafgyt)", "value": "69704e2a2cfce325870cd707588f68f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902477, "uuid": "b4b75486-c708-4b20-9664-baa56568865a", "comment": "Malware payload (Gafgyt)", "value": "4fbeb65ca3d45996e8cbba22585f8f81a96fb930214a038aed7410c1d8882e60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902477, "uuid": "fccd1e57-64c6-40ff-b5eb-fa182cc62fd6", "comment": "Malware payload (Gafgyt)", "value": "ab8f353ecbe9a1eaf9fe6f9f047865d282bd3131", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902477, "uuid": "2fcbf7a2-c71e-4e95-8ef4-c1ac43693a46", "comment": "Malware payload (Gafgyt)", "value": "06c9c1507662038fa4f709e01cbce4caa9d4dbcd031c487f9156b83a6d7fee2c8a195f1a4f9e3570e098829cbe8c071e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902477, "uuid": "1bf17da3-16c8-48a9-af0e-c20e33d387f9", "value": "T1A6934B17BB1D0B53C49B6AF11CAB3BF18769FAE112D26285620EAFC44733AF02911F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902477, "uuid": "99d70c5a-de92-4fa4-b7ff-8b074d699a79", "value": "1536:IwHJoQLXDxRX8zHcaN7IwRoCobrUgQhiDmB6UmX2VMDrUuKfa5X:IQmQXxwHcaNUs5v+mB6UmX2VMDrNKfaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902477, "uuid": "66b4bc24-0ce0-482d-81ae-194923218b26", "value": 95320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902477, "uuid": "6661280d-54b9-42b7-b9a5-9b029c8923fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902477, "uuid": "3693ebc2-1e2d-42b3-9ba1-1f9dd6e14fd7", "value": "69704e2a2cfce325870cd707588f68f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e7e7ba-a81b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675907116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675907116, "uuid": "9ad6281b-1119-4cc5-80f0-e59ae1a39d37", "comment": "Malware payload (Amadey)", "value": "e96154daab55370437535a13dde0153e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675907116, "uuid": "c706bf43-3d40-4f67-9d3d-4590eb747ad8", "comment": "Malware payload (Amadey)", "value": "4ffd285ecac6fd96349e71900f28607705ce5edab8c793ce23a73571ced714f9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675907116, "uuid": "f7e6768d-1a30-4fe2-97cd-4d597a7dd192", "comment": "Malware payload (Amadey)", "value": "936b64614db74193fd777e5ca80cc97dfbdcc483", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675907116, "uuid": "23c96f8a-bb71-4b1d-b067-601e10b841d1", "comment": "Malware payload (Amadey)", "value": "8a0ad6ea50d8f4ea1f3a1b0968929583e56081c279f22192d0eed2ddaccd18bf3398f0863577c13a48604dde088421e7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675907116, "uuid": "0f342a80-b8f5-4419-848a-ee6ad262f1d2", "value": "T1D7C4024BF7E88432EC745B700CF213D30636BE91573896AB625E985F08739A4B636367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675907116, "uuid": "b034550f-bd41-44a6-9ebb-271cd81dce35", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675907116, "uuid": "8300a588-8b3e-485b-8ea3-fa0b1d9e7b0f", "value": "12288:vMr6y907/l8V8kSryKpOzed8Uqw9iYAdmXQpM2/Sh:hyO/eNKtc6eCU8OSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675907116, "uuid": "c4c5baef-42bf-4f3d-83c2-e4c23c07fb63", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675907116, "uuid": "013724f2-203b-4b93-bda2-ae8de0fa2a5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675907116, "uuid": "b0937f65-c6d4-4676-9792-d4d1359d5dec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790551b9-a841-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675923467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923467, "uuid": "31d59040-9aef-49e1-8fa8-8a560a00dc91", "comment": "Malware payload (AgentTesla)", "value": "9907d8b07935a0c355f3dbbc398fbdd4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923467, "uuid": "8671becd-5415-4c24-a4d8-0b1f014af6fd", "comment": "Malware payload (AgentTesla)", "value": "5028397cf32d14d61f5015a108f3d13a33f2c5e2cf360b99522bc3f545e3b227", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923467, "uuid": "fee58019-ade0-4b80-8ef4-7d06aef94152", "comment": "Malware payload (AgentTesla)", "value": "665cb873e654dd7137982eb00d101b0576d970b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923467, "uuid": "846a4517-d396-44d6-b552-d0aa645f556a", "comment": "Malware payload (AgentTesla)", "value": "9347cb1f9bb45f88ceebace8c98c146d25e181a5a265a04aa61b426a71b2305a43caa16b582acc0b04c66af13d82e83a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923467, "uuid": "f995c844-d4a6-4ed3-81cd-751575607b21", "value": "T150F27D2576AC6733E97A57F484D6652647B1B1921402EBAB1CCAA0CF4EE37900711ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923467, "uuid": "d512f387-7c48-4728-873c-6ab429464c83", "value": "768:8fCUhXwRCYd+xubrVS3BxcBsvC7WY7zyiRiHS:M5XY+xsoBxcSC757zyigy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675923467, "uuid": "ba2fd634-5642-479e-b2f8-ce6abcf0251c", "value": 36224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675923467, "uuid": "1a678a41-d270-4a1e-b740-0d17df8b3b04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923467, "uuid": "5193eb76-c381-4d61-b50b-cb31dd9eed1e", "value": "REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed866be-a821-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675909572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909572, "uuid": "2135bb6e-dddf-41ea-94d0-2cc3ee936b14", "comment": "Malware payload", "value": "a3dcef628444bb16da9ac4e5af4925b8", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909572, "uuid": "282364cd-036a-4891-826b-833f717f8ea2", "comment": "Malware payload", "value": "516ac4be462f844e8c61cfc0b80f7c8781c834e36b0a0a6e5035f63328b3ea80", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909572, "uuid": "92c8b4fb-6291-4c58-99a7-d4252a9fb7a4", "comment": "Malware payload", "value": "84af79d38d33155103d63d4abb2781149ee95afa", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909572, "uuid": "2c059e33-807c-4fbd-8ff0-741558750ecc", "comment": "Malware payload", "value": "80aecdf98a504eb05e7e7583df424db497464e79388b4264ce94ae1c3f1a166781a93ed4a8b863503c5ea0cb1a241b59", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909572, "uuid": "a6c00ad7-2895-42e1-9ed2-aa2a1a27de18", "value": "T1AD2733A30806ADCAD132B436553F1748A875CA5A3EA37B621444DFB7C1F35A4CAD9ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909572, "uuid": "a396a51d-6fe6-4cdd-b85d-b7e1de992fd8", "value": "393216:aVdsJA35z7A79L+Lm71mbgafiubcUZLbxT9i/zVN2I+TXBlkKpPbNiRSKcssJF:aQJA35z7c57RmbBffc2Lri/zVN2IkROS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675909572, "uuid": "c1423471-6c1e-4ae4-9579-f08237537b8b", "value": 21502884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675909572, "uuid": "eaab788b-04ef-4d23-8e85-66b3bdb9d393", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909572, "uuid": "a7b2182a-3811-4af0-af62-503019596f5b", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fbfeab-a8be-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675977337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675977337, "uuid": "f7389f24-c606-4ca7-a985-248701f38eac", "comment": "Malware payload", "value": "9cabea12c472ac3a17bb7597e27ea157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675977337, "uuid": "80a40275-3c78-4186-9d81-228ed9b86411", "comment": "Malware payload", "value": "517a2e10e5bdcbc3fbb70241512a9ead8e89f26c3b9c902a64c7043a7ce5d29b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675977337, "uuid": "66243a7f-fc0a-4b95-a19a-786efd239e65", "comment": "Malware payload", "value": "37897c2f65b13840bfd6dc36458f3f84091d9041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675977337, "uuid": "68da6bf9-1708-4a51-8470-db0d47dab6d1", "comment": "Malware payload", "value": "a33cdf96267651a482da23922c4a04edf94045a906c90eb3712cb558fb736fc27cfe8381582b3337079847333f6ce0ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675977337, "uuid": "e0d84bf2-abcc-475d-a0df-408a41340448", "value": "T119B40107A6FC8432E8B457701CF603D70A3ABD519A38839B2B8EAC491D73174A77576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675977337, "uuid": "48da3f1e-c9aa-44d5-b74c-92c4995d3f69", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675977337, "uuid": "8e810144-8c67-4f90-b53a-30b0b59a12fa", "value": "12288:OMr9y90QTcOLAVeVmKETsiz6DOYiEvWLvLGfNGWYAUCd:HyNczVwgIiUOYszYvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675977337, "uuid": "a905b87d-b7ed-43df-9fb6-2b820f83a89c", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675977337, "uuid": "161b6bb3-2333-49bb-b161-c7813c3781d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675977337, "uuid": "1aaca434-3eb0-4279-b1c7-92c7f6632d13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e723ef-a825-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675911327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911327, "uuid": "d08cda4a-9589-43b5-b11d-05caf69d6965", "comment": "Malware payload", "value": "9800037dd960911ae5ecc8301ccc14ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911327, "uuid": "13f78792-0ea9-41f7-a4a4-ba5a579e2347", "comment": "Malware payload", "value": "517ef20abc0e55712787a74d33380bc97d31b783e1adf47ffe465224e927bb21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911327, "uuid": "014212f7-0808-4dfe-b95a-0c52e2eaa21c", "comment": "Malware payload", "value": "ab5202bd7cf6f032d4645c33e8cc13cd119bba5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911327, "uuid": "0f61f7ad-82b6-4764-835a-ad8098ca7a4d", "comment": "Malware payload", "value": "8139114fdadffee136a72f5995d685ab7e7e3f3cfa67bc7243a5dd0ac8e01a165748da5c17cd9adb43f71d1b01102ce1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911327, "uuid": "c2e40451-aeb6-4276-9ff9-381aa935f88d", "value": "T1A9763301B1DA4ABDC2F6607249E07FD3D33BEE230E74583B17AA592E73355A6F285814", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911327, "uuid": "fab0fbff-efae-4115-b8aa-5855794a311d", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911327, "uuid": "c0e9044d-8d41-4ab4-bfec-415298fe0cfc", "value": "196608:91O/0HS27VWAd5qMrS1xWi5MtVmRocuKNAX6:3OszHdJAv5w+8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675911327, "uuid": "83c9b0ec-92de-48e6-851f-1c303dde9571", "value": 7629445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675911327, "uuid": "502382e4-c94c-4868-94ce-52e381f5c904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911327, "uuid": "df51167e-5945-45b2-8976-4559dfb13b95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f890d41c-a834-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675918098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918098, "uuid": "7a9281d6-d9ef-4498-83e1-0eb6a71f8f81", "comment": "Malware payload (AgentTesla)", "value": "98cc790b3d7afad1a24ae58cb8d801a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918098, "uuid": "1d60a6e2-ca47-466c-8c83-eb79c8501f4e", "comment": "Malware payload (AgentTesla)", "value": "526418af31a5d19ca68606c09913d4a88b0478f2b35bd6779c566ecaf84ab6d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918098, "uuid": "5fde72ca-3cda-4a86-8239-a3bf883cb13a", "comment": "Malware payload (AgentTesla)", "value": "6cb0a3270eaf2d36d46925ea9766878801f9cb41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918098, "uuid": "780b6440-e33a-4fe8-bb16-2f448d2a010c", "comment": "Malware payload (AgentTesla)", "value": "0ee1adc7e1d31ece5160fcf764527315b80105e0131b9e92bb86a9ccd38ad4e4f409aca5d023f54d2f8c258b4add3ebd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918098, "uuid": "bb98ca0e-e05c-439a-83e7-452136b02411", "value": "T10A058E6337B095B2F78720B10428BB985BF17513BE56E2938FB73BC06785DB67298142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918098, "uuid": "579ff339-a2ca-4fe4-8167-d7fbcaa874a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918098, "uuid": "5084d263-5da7-4181-b358-1593d091bb87", "value": "24576:heSqG4yPaer554vifgaT6g818A+mQt6F0xM:qi5gEG12A+eWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675918098, "uuid": "105ab09b-5541-4d84-97b8-31188d4b4fb7", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675918098, "uuid": "5be25a05-8076-4e11-ba1d-426433e738be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918098, "uuid": "30519369-a331-4c73-8f5e-cf88e47f7668", "value": "98cc790b3d7afad1a24ae58cb8d801a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9a2f15-a83f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675922483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922483, "uuid": "523a4a99-9cfc-4a23-94a0-f77f76cb7d08", "comment": "Malware payload (AgentTesla)", "value": "a8c9121e6ee657a0451f4eeb6e6865c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922483, "uuid": "e6d80121-9046-464f-aa7a-18d4352ee5a1", "comment": "Malware payload (AgentTesla)", "value": "5288eacf1129499ed565c4b506f60d8f6bd6d7f5c4e6d7b39eb87d98b6ac1914", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922483, "uuid": "afc25fc6-82d3-4c97-a093-6eccbfce7b42", "comment": "Malware payload (AgentTesla)", "value": "077d52772505c22f0123e53323dc6fefdfc11ed3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922483, "uuid": "84029f99-7583-4e7f-bb29-1c0aff048560", "comment": "Malware payload (AgentTesla)", "value": "71501db2ad9fe2ec94397acb8c42cb0fece70df209d726e625f002ff75044e2a692205c6e8dab0f0adbb61d786cf49b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922483, "uuid": "30002466-ccd3-4fdb-bddc-dca01dcfe266", "value": "T1D5034C5AE39F0264CF5512B3171A0A899AFDB63DB3115571746C933433ECC3E42AAABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922483, "uuid": "aaac032d-0391-4a3a-baab-2ba180723462", "value": "768:3Fx0XaIsnPRIa4fwJM/wM2RF3UoK/PWze90rYpLhD9TOZUFq6KF8moDj7:3f0Xvx3EM/7opze90YthDUZH6HfX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675922483, "uuid": "67ec826e-3228-4ea9-b0f0-7c7485db0b5a", "value": 40005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675922483, "uuid": "e73335dd-3c59-489e-a55a-9803799c016b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922483, "uuid": "c5d7a08f-e836-4ae9-a53e-5bc1e007d063", "value": "DHL722918767AA.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1206e3fa-a853-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675931025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931025, "uuid": "b4901c40-c053-422e-a22e-661ea2e4d7fd", "comment": "Malware payload (GuLoader)", "value": "7739ebe59ba934f4887d70e4a4d31d6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931025, "uuid": "9d7ccca4-4d33-4ee8-89aa-644fa82fddb0", "comment": "Malware payload (GuLoader)", "value": "5296e0acf8e01a98b75a43af312909fcf2e952d01b61ae3eb6f6cb937f9eaeef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931025, "uuid": "4f14b09a-7d96-4c94-8e90-b55ceae2d74c", "comment": "Malware payload (GuLoader)", "value": "98bfe9a0950bdf52ed953ce0dd02b9eed2bca57c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931025, "uuid": "c3b2d077-f7f3-46fa-8bd3-b1fc7e82bb84", "comment": "Malware payload (GuLoader)", "value": "258bd3125887ff86e9b4ca1f2bae8a8ef91acb461f4475a466094d645b4d247b46feaa6a03ee31b54068e7c3c5d3c308", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931025, "uuid": "242ef280-ee1d-4a0a-b767-8480e899e17f", "value": "T1525413D066E4D4A3F9F08FF5A577ADA9C8B1234514B9468B2F250AB93E223439F14333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931025, "uuid": "a3e418a7-6b4f-4edd-b7f1-dfd39c22b609", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931025, "uuid": "60b47ff2-9981-41f7-aa43-0a83bb175df5", "value": "6144:HUj/w8HRYKEUFSf3GmQQ1U53ySuipe/+XUau85B7J:HqxxYQo/G5HtVqmXUajJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675931025, "uuid": "0aaf4074-cca5-4ca4-9fe2-7450582ccd94", "value": 289560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675931025, "uuid": "f3f7a741-abae-4d30-ac51-0cffb7b6783d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931025, "uuid": "035734b6-eb9d-47b6-ab19-ea1e27478b30", "value": "scan.xlsm.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06df151f-a878-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675946898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946898, "uuid": "419be39c-3767-4852-93ab-80d0059f8720", "comment": "Malware payload (Vidar)", "value": "b7ce97165109b514b83367d2be8c0026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946898, "uuid": "90f789fe-965a-4bad-b0df-871ab2ba9d14", "comment": "Malware payload (Vidar)", "value": "5313874091d78e0f05372b6a37fc86e3c9412668e9aac560c9120d1391531f6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946898, "uuid": "ce7cf47e-63b5-4643-9364-daa01fe9e87e", "comment": "Malware payload (Vidar)", "value": "e3806dc513454db2f2b83ff987ab18468e34695a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946898, "uuid": "7866e29b-84b7-4d13-8fab-869588109472", "comment": "Malware payload (Vidar)", "value": "4a78afdd0012a6e7e161108a3130f3a4b74a07984597e4ca2a8bf57f4b3ce4830b7fa662af8607b16e68a203ae4f6b10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946898, "uuid": "aea5bca3-fd25-4828-a03b-d5fe333970a6", "value": "T12414DF323AD0D072F53A25304864DE656B7EB8319674990737A82BBE5F303D19A3E35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946898, "uuid": "30f56490-517d-40c4-acbd-943aaa986fe6", "value": "83d1b8095e33f74e23ddae505b88bb37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946898, "uuid": "3f9bb468-7f0d-4360-8077-99f9df22db0e", "value": "3072:at2OV8pIXf79JhLLCeGWreh5PEiJUZINviJ2Jrbn2gXY0G1DLizUR3dCI:at2mZnLLPG6af8J2TVIj3LRtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675946898, "uuid": "13f05950-bcc3-4a29-9e1b-c50f63ade403", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675946898, "uuid": "3409c243-27ad-4537-a25a-ae46f1bb4b51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946898, "uuid": "0716aadc-1034-4a37-8d6f-4b7ee0543409", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e45899-a80f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675902067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902067, "uuid": "70b48f29-5e03-4f01-b86a-4dbc91605d19", "comment": "Malware payload (Mirai)", "value": "a36745d401626424d49e622bde9452d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902067, "uuid": "9e9cce3d-bde8-4e6e-877e-fe9fb963d37a", "comment": "Malware payload (Mirai)", "value": "5314f7d354345c2e5c3e3ee0d1a8176854a2534d1db8101945f36e5e1e47cafc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902067, "uuid": "38be0549-ebe2-4f8a-b65a-7e5f111854d1", "comment": "Malware payload (Mirai)", "value": "ad09689213ae97c6453696d713429143f7ddde41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902067, "uuid": "1e1aea0d-4359-48dc-b6bc-dbc12ca63ff4", "comment": "Malware payload (Mirai)", "value": "88eed9de61fa63edf34f9b8cb04de96691d365576fdc9471b09f04608037abb9b3da99b6e5505a8e67a5574b1c2e3e32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902067, "uuid": "522ef033-d855-41ee-a817-7c6b691e2914", "value": "T191435CC5D563D9FCDC1015393077FF725A76E93F1028EAD7D7A8A932A982A02D80728D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902067, "uuid": "a32f59a6-7197-4817-91a4-af8f3172bef8", "value": "1536:d6EwVWibZ6uzpNrmvFtWbFB9yWCTZrt+xc:QVWYZ6uzv4FKFHyWoZrQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902067, "uuid": "4951e593-1072-4d94-9578-89cb60f683f1", "value": 55840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902067, "uuid": "8db294a9-7544-426b-b3fc-09c1ad6ee061", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902067, "uuid": "3baae194-7e97-4561-84ff-9f24675b8f3d", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10116ad1-a85e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675935746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935746, "uuid": "d26078a5-ddf9-4a2a-8ba9-6a00f852135c", "comment": "Malware payload (AgentTesla)", "value": "3c0c2e104b46a135df4599e96095bb54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935746, "uuid": "abab7d1d-0074-425d-adf7-245188e57626", "comment": "Malware payload (AgentTesla)", "value": "53606fcd5a8f195a763cb48f5aafffac01fdfb8e73d5fe99438ebc2d1eba6eca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935746, "uuid": "6a1d668c-cef0-4c1c-8fde-472298579f5e", "comment": "Malware payload (AgentTesla)", "value": "923a0fba131a13f55af57fd890b5dd9759ce8937", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935746, "uuid": "c1587a23-fb63-4bcd-84b4-254a68d8a5b8", "comment": "Malware payload (AgentTesla)", "value": "dd7dac674045440d9105d478525a741f6eae1ab93a8832392572056ba049ae503bbb9a6528bf9e0d57ba704f1e37b49b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935746, "uuid": "3f299190-8a6f-4080-abd5-e67d7e2d49ad", "value": "T16864126423D4C973E07242B01BB866357B70AE3720F8DB1B17B3A6E87D78951E61E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935746, "uuid": "02cb7129-4253-4442-a8e2-6c0682038f4d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935746, "uuid": "3735bfca-c764-4638-b4ed-27094a774795", "value": "6144:vYa6qWM5HuCUhJtm9r1PKQC9X0dQ7n5dA2vAxwT1R+6cEytNgJaQzkTbW2v:vY0TtnJpPKZ75dVTxXsP73v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675935746, "uuid": "c7615b09-6d6e-4a3e-9b65-66fc7007f869", "value": 333913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675935746, "uuid": "43a659ac-223f-4060-ba2a-fbee3c07e9d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935746, "uuid": "aa83e1db-3850-4d17-a908-2cb4526c214c", "value": "BL-SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0794c3a6-a8a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675966656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675966656, "uuid": "52b04434-3bec-4d54-9359-0e3cc479a43f", "comment": "Malware payload (Mirai)", "value": "436bcfa743187b961b9c20cf8a9bd394", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675966656, "uuid": "0cba4472-4a63-4e07-b412-2fe56f55beb0", "comment": "Malware payload (Mirai)", "value": "53a6f71a09283c47eca762b63fc5b5275dcee1d313a828461c146ed4429f4438", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675966656, "uuid": "45d7735d-5e10-4d0b-8e77-c1720447261b", "comment": "Malware payload (Mirai)", "value": "8240908c098cc670b7d513304b301643c9f6000d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675966656, "uuid": "ce2bfd4b-15b3-4274-8d5b-a119d3a57a16", "comment": "Malware payload (Mirai)", "value": "2cee4ca064b5abca2d4e2a035a559fefbce1bb5f5fc59a728ce9860a493891107b3fd9656fe35c171e307dfa98f8f3ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675966656, "uuid": "f6e448e1-615f-44b5-9bb5-23a99cca89f4", "value": "T1EA435B22AD792E1BC0D4B47A21F74324B2F6574E25A8C72E7C720E4EFF5564062236F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675966656, "uuid": "b0e7ca9a-4e32-4ec8-bcc8-ab64a69580f3", "value": "768:REko1pq9dgI8f8K5MUDICrmsqSIycUKQM0nUQSO+owS+P:REkKSdgI8f8K5MUDICrmsdeUNUQQ40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675966656, "uuid": "62f65225-0e55-4abf-a480-e99c10f3d83b", "value": 60612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675966656, "uuid": "4a571ef0-a23e-49cf-a104-e12f8e71171e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675966656, "uuid": "16b3d9ff-2757-4eb7-b2b3-e6ddc22b3f94", "value": "436bcfa743187b961b9c20cf8a9bd394", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae407e94-a838-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675919691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919691, "uuid": "26c0b6bd-67b2-4161-8766-5ee86efb90af", "comment": "Malware payload (Amadey)", "value": "052dfd0745c6f872ec31fbedd4e4fc9a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919691, "uuid": "4c323035-ff7c-43a6-99ac-70c8cd8d4ecf", "comment": "Malware payload (Amadey)", "value": "53bcd97d6e5eeb47267cab0f87cd8ee9c98f3e26082f80829301c4f4f6517bbe", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919691, "uuid": "dfa93507-37bc-4fc0-a7da-6e7a6ec46f8f", "comment": "Malware payload (Amadey)", "value": "8ecca12436cd38c2528d5d5d21723be50df05350", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919691, "uuid": "61364bd3-382e-4145-a798-c22442a67a6c", "comment": "Malware payload (Amadey)", "value": "c71128d29e41bfa8377cc3211dd755a696b3b4446501589ba81f6ffe004c97f325a713a181c2c528abd02b94a23cd5c2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919691, "uuid": "5c917bd0-7846-466a-b02f-71b0e163ac01", "value": "T1FDC4020BF7FD9132E8B61B7019FA03D30936BDA05A39869A175F6C6A08716B0B131777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919691, "uuid": "4aea8a66-517b-4a89-a4d5-80da81112b5f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919691, "uuid": "21dd049d-fff7-47df-b6de-8a8965da8ee5", "value": "12288:nMrIy90PsGPIJGnTTjYu4LgejqfQXiWp5zxZaLN4:Lyqsu8sTjYu4L3aQFjzCLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675919691, "uuid": "299df0f9-d8e4-4c0e-aba6-c1762a79cc0c", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675919691, "uuid": "6ca8ec11-feaa-4098-b375-30e8eab84054", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919691, "uuid": "d09b44ad-8950-43e3-90ff-ff0e5ffc82de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007c5822-a865-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675938727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938727, "uuid": "2ee0614d-b573-41c7-ab80-44aaaa34fba6", "comment": "Malware payload (Amadey)", "value": "057cdcca9b1a967c8bf0257f7cb1a5d9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938727, "uuid": "89ca46da-f3da-4e59-a65c-33692069afa8", "comment": "Malware payload (Amadey)", "value": "53dc7d35be1b3971bbed015c76e00a750ae1dc9042b1392fae410acfa2da6334", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938727, "uuid": "17eeccf9-5a2d-429a-9fbf-06c4ba8879df", "comment": "Malware payload (Amadey)", "value": "ef4a81fd98075b1fcb20c1e967421d1568f8c662", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938727, "uuid": "75a8bbb3-adff-4a06-b776-9aff9145e49b", "comment": "Malware payload (Amadey)", "value": "eb2bc907247271035bb62914520c3e28fffd4443f155385ef7b9c430b06f59c2d216dfd5700c99456ec67e36341b9d5c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938727, "uuid": "51c97b91-4d43-4a3d-85e0-21e09dcbd16c", "value": "T1EAB41207E3E88126F4B9577059FB07C30A36BD715B3C879B264EAC591C726B0A63136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938727, "uuid": "15efa6dd-be6b-4a83-9366-c1020cc2bab3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938727, "uuid": "031e8750-9811-4313-a6ff-aa7ae6585d2f", "value": "12288:gMrLy90G7ILEuiLq+jyeH5w5GlwPZz/iKYiLvWj51q:7yvgERhyeKGaP9/p3vWtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675938727, "uuid": "5dfc85d3-f3d2-4027-a295-a0e87de33ed2", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675938727, "uuid": "d3ed6cd5-3578-4491-bb01-c937336b92ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938727, "uuid": "fe84c4c1-243b-4be9-92bd-ec295bacab4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebe6422-a818-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675905760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905760, "uuid": "87d4c97e-c602-43b3-9577-f338cf96ea2f", "comment": "Malware payload (Mirai)", "value": "f2d61d302bb23636386a335b5c38785e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905760, "uuid": "b02b8c1f-e9a9-4221-9cc3-7e5c3bfcafc4", "comment": "Malware payload (Mirai)", "value": "540a6a746c0bbe86f140ce6bfc47d823aee274745c6985b5b9460059d5c3556a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905760, "uuid": "7a3fa075-1f17-437a-976e-8a7b1807fd3c", "comment": "Malware payload (Mirai)", "value": "69340ba7467040c2cf94fd79405c5e17a5b7056a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905760, "uuid": "bb42bb46-6332-4c4f-a117-0d7042b46e16", "comment": "Malware payload (Mirai)", "value": "63a65cad5a2a1643213d0d1871d6c2ce6b405e3a04e3554b972d9591461225896fdfcf12e0da493a16aa15479e686293", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905760, "uuid": "1efd74c8-8347-47c3-b919-2df5d0808dfa", "value": "T1B1332855BCD29A6AC5D023BAFA6E519E3321A3E8D1CF3217CC204B1477CA51E0DB7B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905760, "uuid": "72428f1b-d504-4c04-b322-507a7cb229e2", "value": "1536:zznFR4PmUmXU08BsfqLRL+ug/r6rL2yBCNt5sqA:zrX4zmXU0OckvkbsqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905760, "uuid": "8af7ce17-5a05-4990-9e84-9617a5b5b7e9", "value": 53344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905760, "uuid": "b108504c-212c-4581-b40a-29a84b77c0b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905760, "uuid": "076dcb98-3c3f-41d4-8306-0e6c3e641bc4", "value": "f2d61d302bb23636386a335b5c38785e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e201dd-a883-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675951699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951699, "uuid": "2985f789-efa8-4fa3-bd61-6691b058a8cd", "comment": "Malware payload (Amadey)", "value": "0fb6f061ead68716a849be66b945baa6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951699, "uuid": "106aea01-b826-47ad-ba7a-45c7be418481", "comment": "Malware payload (Amadey)", "value": "54e664c52ca8c7c39c5d59e44d30fddaacdc7b7e644151544dd5317b5a386e32", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951699, "uuid": "9d593960-8a8f-4ec7-a331-dc217a287724", "comment": "Malware payload (Amadey)", "value": "d396b9a094f1c531051f8d1c294f3702361973eb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951699, "uuid": "da384b3a-bc2b-495a-b7c1-8f93dfece301", "comment": "Malware payload (Amadey)", "value": "db050f6d21e11fc37e533948847b5ab49aa17322d7abb58d4833e7c1ec9ffcebd458d388e82ba6a6ca66db81cfc172cd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951699, "uuid": "e9713b16-08a8-48b4-b18b-050bb5ae8aee", "value": "T1D9B4020BEBDC8072D97A577019F607D31A367E915B34836A234EAC1A0CB3265F932767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951699, "uuid": "b14ad796-3a05-46df-87c5-a2a8359b3037", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951699, "uuid": "42011920-37b2-410a-9c25-fe47619425a1", "value": "12288:sMrRy90/EExheexJ/yowE0pdUry/MVsjaT2pYUOqRXBP83lGB6in:VyrExheIJTn0pdPj0bHqRRpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675951699, "uuid": "0be677e4-3a6f-42a2-9f81-34336f748949", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675951699, "uuid": "f0fca5b9-2656-48f3-a82a-a1bcdec65f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951699, "uuid": "b91c4dc8-5ee6-4e92-8c27-c9b6bc42a19a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9462123-a80e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675901644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675901644, "uuid": "564be58b-9ef1-47a1-baa7-c96f54648ebd", "comment": "Malware payload (Amadey)", "value": "7fa03b90a8e4fb1d94d9e6e6831984af", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675901644, "uuid": "d437ce68-83f0-45f6-9711-f305b1f91c9a", "comment": "Malware payload (Amadey)", "value": "5558c6c6709b9786c894182da2d34a699a0f8d2c17573839dca0c95035f910c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675901644, "uuid": "a36c6ee9-c52e-46b8-b4a2-0290ca32457a", "comment": "Malware payload (Amadey)", "value": "211e56df37718b85bd190275eb19dfb1dbd0a6dc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675901644, "uuid": "a73b1bca-b4f7-455b-81d6-73da7234eef0", "comment": "Malware payload (Amadey)", "value": "cd2f3cc6e1e48ef64b3262fbd2e4453044c9af552605737df7ba6581923c0edc60d11fad33098a680bb243b35ff1d952", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675901644, "uuid": "dbf81a8e-41dc-4cb0-942d-0b11b30521b6", "value": "T175C40207BAE88032D8B527B118F107C31735BD615B78C65B2B4BAD5A1CB61B4AB3173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675901644, "uuid": "e9bd3d31-510d-456f-a531-1b4d75560f06", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675901644, "uuid": "cc2a3ecc-6181-450e-84df-1233049c0ec4", "value": "12288:NMrAy90lzX4WIqKi5waI66/qw6AD5SeppONWeMtmaUBt3DEs5sMUOUmg:Jymzf8ih56/qwbzeEeH5smK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675901644, "uuid": "c67e4278-8743-4346-87f9-ca8b9d04fdff", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675901644, "uuid": "752f3946-828c-4ab8-a8c2-f80d5c1c5d03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675901644, "uuid": "b2e71e7d-4cbb-4063-92cc-46853b9ed4e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d6b22b-a86a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675941125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675941125, "uuid": "ee91e789-d531-42d8-b19d-0e40571aef8d", "comment": "Malware payload (RedLineStealer)", "value": "8642bf767d5d3acfa15babcbee0f77f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675941125, "uuid": "c0522cd7-8dd6-4748-97cd-d9b7d006e7d5", "comment": "Malware payload (RedLineStealer)", "value": "555ea71d2d5d6cac55e98e2779a57550866fc5cb0a63fce98096e6a177c2660e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675941125, "uuid": "b34ab371-6960-4213-a853-7ae0abb16d96", "comment": "Malware payload (RedLineStealer)", "value": "f00c1eccad1529a31f1cc5d112974fc1fca32811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675941125, "uuid": "6e1831a0-2ff6-4ae6-8455-a448ca05b584", "comment": "Malware payload (RedLineStealer)", "value": "019ec27a61bcf52c47d3f72929594038aff8d6fb1cf4e5083693903512ca123ad0f5c499620234c1837a676d47bad455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675941125, "uuid": "0c9d5f95-af20-43fa-8ad8-fab41afabd8d", "value": "T16264F12235D0C072C87555304B24EEE5BBBDB9309A799A873B8827BA4E707C1763735B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675941125, "uuid": "ddc4d21e-0c14-44b3-a4d0-4bad1d060b17", "value": "83d1b8095e33f74e23ddae505b88bb37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675941125, "uuid": "8cc244e6-0782-4ea1-b80d-9f5be6138bed", "value": "6144:Sh3pS/91lLvhN3IZUjrrUwdTvTYIkpmYIcWJXml4r/0:Sh3+LlFNYZ8nBdDTYvpX3WlmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675941125, "uuid": "e5c5754d-269d-408b-9947-7f692b7cd93c", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675941125, "uuid": "1565f26d-fffa-4724-98f3-cdc58d32dbf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675941125, "uuid": "8514ad3d-a85b-4acd-98c6-dd27529bca2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825828ca-a810-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675902437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902437, "uuid": "db0fde93-4331-4b54-b644-f921dbf226ca", "comment": "Malware payload (Gafgyt)", "value": "227f7610db78670e9c8018cefc82658e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902437, "uuid": "259fb882-6f76-4a28-b53b-8c7b89caa2df", "comment": "Malware payload (Gafgyt)", "value": "55bd01ad5cdba1b46328e46216a9a34a5cd131b8c60a4e9bc649c4936bdd6b24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902437, "uuid": "06ba3935-50c1-4047-a4e4-79531ea5c361", "comment": "Malware payload (Gafgyt)", "value": "23dafadf0edf9fb5e05692346a27acf4dec02d12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902437, "uuid": "4c584060-7446-4d3b-864f-0dcfde990235", "comment": "Malware payload (Gafgyt)", "value": "310ad47f9f4a539b4cb46fac245117d18ac0951bc516fc7bb6bac39738cb320a5b2a3eea2d05ec74a47f12c0ed08669f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902437, "uuid": "993cb9e8-1d03-4287-b4c2-d1384affcd01", "value": "T106C3A42E7E22AFBEE16882310BF75F7087A521D637A19342F26CD6581E7128D1C8F754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902437, "uuid": "faf957cf-83d5-4bd9-9c89-42acfca25780", "value": "1536:HbDwVYuaKurNAV2rKQ7j+4GeGISeG+GX8J2rKQnGx7M/wa5zIXp3xJJoPxepPb3v:QRGUwaMNoPmPb3JrmthjF71Dq1MdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902437, "uuid": "916642fc-f60c-43e5-a6d7-441d29d2f814", "value": 126307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902437, "uuid": "f3dda7e4-c02e-443c-b745-3b2b8e7160f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902437, "uuid": "b68aea78-ba08-4dbf-8bff-e25e78137184", "value": "227f7610db78670e9c8018cefc82658e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84455b36-a89b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675962141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962141, "uuid": "49ee5871-5df4-4d11-bdc8-888740d5d55b", "comment": "Malware payload (GCleaner)", "value": "5a6c1715c08894cb672c30bacfcf08dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962141, "uuid": "4438e70b-42a1-49b1-b127-940a269ed3a5", "comment": "Malware payload (GCleaner)", "value": "55d784bfa2e49c20250151bfacf81842d15d1b97709ce52dd140ca387fe3440a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962141, "uuid": "453e959a-66e6-41d5-ba46-734744ad3a6e", "comment": "Malware payload (GCleaner)", "value": "4f9131f84a66bb1c5b0d6f7eda02c9168c1faed6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962141, "uuid": "4a38161f-0b3b-44ec-8a6d-058af9776b15", "comment": "Malware payload (GCleaner)", "value": "bf54c92f9cc9d929ec507ae6d6a6a35e1a48c7b4664e03b4e486b9650db65f4daff991eb3090f67746a1a3f4fa9dec28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962141, "uuid": "e6eabe3b-f20f-4575-aa89-914333f6dd3d", "value": "T1BBC5123C7505C89DD280FEB48C3A98E75CDAADE3E8D0A46230DD7F3F917A2895A09157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962141, "uuid": "3289e566-ea08-4171-b7c2-7b5f2157959a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962141, "uuid": "f8e50722-00d5-4008-b80d-bb96b6edc564", "value": "49152:rdH9YPBNkJycTWX+zczlYpDTVnJGPZzuHcB8Mru/Qn5LLYm8/2zBk1xGFgEelULV:JHuPoJVinzlmlnwx6HcabIn5zB1eiv2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675962141, "uuid": "e025ebff-7120-430a-aefb-cd70ade2a022", "value": 2606640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675962141, "uuid": "d81823c6-0e1d-4a38-97fe-ffda5f2e5e5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962141, "uuid": "1840af38-5016-450f-836e-0f78f83114d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b66cb2-a834-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675917724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675917724, "uuid": "3bf3cd05-73e4-4e30-8ccb-9cab1e6fbfc3", "comment": "Malware payload (RedLineStealer)", "value": "11a0782b53031450b37b0b00614e3950", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675917724, "uuid": "c5c04aa5-22ea-4278-a9eb-ff5f5c95a564", "comment": "Malware payload (RedLineStealer)", "value": "56c6f3550ce99a12d809165c9ccceafc03b2a8c9fbd85be5076d8045fc463ee3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675917724, "uuid": "3f5a543d-7c6a-49e1-bf31-08a877fdf3f2", "comment": "Malware payload (RedLineStealer)", "value": "0ba82baf3aca3d0698321df2215b5dbf94176463", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675917724, "uuid": "b73172ba-788a-458b-baa5-676268e36383", "comment": "Malware payload (RedLineStealer)", "value": "512d219a6cd4316d19fb2d67cf025ff14cf96233ecb51557273a0666cc41a869524192cbf98d27b1c73c3c46a16e1be7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675917724, "uuid": "a8b1b8e3-8139-46b7-afd5-c13ef3d74597", "value": "T121C4024BF7E89423D8B153705CF902C31A367EB05E7882A7278B6C591C72AB4963177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675917724, "uuid": "15b9a18e-1c08-434e-8568-30618d65d4f7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675917724, "uuid": "b6023d95-3eeb-4c13-9b50-cc5fa585da95", "value": "12288:aMrBy909PUxsPoq+vcNSWtLu6iIiGCRDuAR0nNRBRhdJTf24h:ryuUxlq+vMSKu6nS0NRjd+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675917724, "uuid": "9a8a02d3-718f-4514-a73a-ecd5e4e4af9d", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675917724, "uuid": "ed88b811-0cde-4a52-8720-5021d8d37648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675917724, "uuid": "2b657014-b88e-4a84-aa4d-c4c3a2b92216", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc9c615-a8bc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675976518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976518, "uuid": "e6bfe756-a635-4431-8b35-234fac42df5b", "comment": "Malware payload", "value": "228fc205adcab3844066c7cfedaebb3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976518, "uuid": "65f87190-3ae0-47ca-909c-52a4e3fd37ee", "comment": "Malware payload", "value": "573f8e67c9c3ed1796ee9a0ba45d6426e497b28a6f717739cab3f111182aa168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976518, "uuid": "74b4f1dc-7003-4c19-8c32-78a602a54c1e", "comment": "Malware payload", "value": "819935e16645ac37f52a5451c854bcfdee4ca298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976518, "uuid": "663cb2f7-5c57-47da-88ba-eda9212088e2", "comment": "Malware payload", "value": "b3907e06b9655e3fa740ee597c12130dfa395e9b97c58e4581c9cda6e530c7fafbad547174cec1b51d1d22df4596d976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976518, "uuid": "8c79ae5a-eb63-47cc-a336-ee2926f9216c", "value": "T17514CF1272D0D472C332B631AD25CEF5677EB5311E786A977328163F9EB02D0A632356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976518, "uuid": "8f9b302a-a53c-459a-8392-4c593a4bdf98", "value": "3ae714bb16df7ea6110fd4db3c856d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976518, "uuid": "92b54747-41c2-4ea8-83a9-e8fef7b42385", "value": "3072:O2blIa6ltXBRozKMM/PGVFZAY9/YWsfzjLdfbOjr/KIMJkP:O25I7VRMKMM/PGV0o/zyztfbOfcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675976518, "uuid": "726cd4ef-1b97-4875-ba29-bde98f24f43f", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675976518, "uuid": "d30b3800-0c65-4fe9-baca-7c487864e57d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976518, "uuid": "c4a30df2-517a-4ae9-b88a-14e55169d9d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1abe4841-a813-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675903552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903552, "uuid": "8c6e5597-532f-4a77-bb5f-7f191897c43d", "comment": "Malware payload (Loki)", "value": "6869cfe45924c3bd855993a465c5fb6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903552, "uuid": "fbfa25f9-66bd-4a8f-8f30-4f562f94e5a6", "comment": "Malware payload (Loki)", "value": "575eab2ba99c3d0a7ad715b2ffeb83f76ce022c4d653564b088540223b23cd00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903552, "uuid": "68ca7e0d-327d-442e-9dbb-dd14a324f692", "comment": "Malware payload (Loki)", "value": "2da76b407581d0d69762eba2ea83c850c3d0de62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903552, "uuid": "029b40d5-e37c-47a3-a4fe-bb1bcd57cb8e", "comment": "Malware payload (Loki)", "value": "39dace2dc2690ebb5f80809f24e6464e13faeb77cdce765a393c035770a0eedb251b4e0a7bd27324fd317750bb8e6bf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903552, "uuid": "ecead2a4-f33c-4978-b2c8-6c5f3af80326", "value": "T1D5052205ADFAAF24C2BC43B92A0A210557FB522B6552F32B2FC7D0D92E50FE51245F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903552, "uuid": "5667d341-7cc7-49dd-bbfa-98fbe81ad4f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903552, "uuid": "d9b88bc4-7210-4064-b164-ece0de47677e", "value": "24576:cttw5BlXfWE53FCSdFd0B3x51+TaPKSpiKOxIY:uw1+E53Faz1AaySc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675903552, "uuid": "e7edfa5a-48dc-4777-81e6-17b8674be03c", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675903552, "uuid": "6c3c2cb5-a02c-45ee-a6f8-850bbdacca08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903552, "uuid": "41fc0f28-fc86-4907-afd1-eae479ecac50", "value": "SecuriteInfo.com.Win32.PWSX-gen.12144.19638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a0e925-a852-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675930947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930947, "uuid": "8e7f778e-6e1d-424f-a57c-647745d27adb", "comment": "Malware payload (AgentTesla)", "value": "37bf421da2a4c3b1883152ec711f11bb", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930947, "uuid": "e5ccbebd-14a5-4835-8573-4fcb26799d41", "comment": "Malware payload (AgentTesla)", "value": "577f6619bb01813855da34ba614d1700dad29cf68f4c4d58782e2330cbf4e445", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930947, "uuid": "a7b13d45-ac68-4bef-8b75-6c76a3a970a6", "comment": "Malware payload (AgentTesla)", "value": "965f30aba7a41ccdf8f51192d2de962fc47b03e6", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930947, "uuid": "4ac7b66d-7dd2-4402-af16-29a3b2bb47c6", "comment": "Malware payload (AgentTesla)", "value": "9871c238ea69a397b0c4c38e4c13f2b2a41a1d4a42b31a453083e46632192ef56e07c0910fc234860b92eb8ea1b4b862", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930947, "uuid": "ae421d41-8463-4746-866b-831e9a773179", "value": "T1A1B423ECCB1602EFD87E39C06A75AF42B88DB5CF10317E66D695B31E40386E5C8A5D18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930947, "uuid": "a867ab7c-3d97-4c68-b0f2-42d45f19f4f5", "value": "12288:IqiI+5df8Vj9MbY6u55wXVRNuQqf9zPCr2nrvT0:aD5dUVsu+RNuQq5PPrb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930947, "uuid": "2aa1f0f2-d1e0-4fb8-b266-811174590b57", "value": 506519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930947, "uuid": "2d22033c-9a56-4594-a142-77f2a1ca6b7c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930947, "uuid": "0ba166a8-a628-4037-b144-698aa914a2e4", "value": "M000206 $250,000.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878e731c-a885-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675952697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952697, "uuid": "3918314f-e73c-4a4e-8f96-c2fad3fdc8c3", "comment": "Malware payload (Amadey)", "value": "ee7fe57574f7fe6cdb154b17ddb30e6d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952697, "uuid": "97f93589-7531-443d-826e-7e85db4677c7", "comment": "Malware payload (Amadey)", "value": "5829a3cf50bea5303ed61ee70adfda7329097f74b1f232d52cd099a88acc76d7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952697, "uuid": "9aa1b932-4405-413b-9d5b-23153eab2137", "comment": "Malware payload (Amadey)", "value": "57273ecf355376eabdf17354520dba18aede4425", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952697, "uuid": "3b46ec11-c524-4730-8c4a-cc99240adb19", "comment": "Malware payload (Amadey)", "value": "3869386929deb59af1830b7d8ec0900f799f8796f947c4cab82aaf10caa26abe7a6ae8a4d6c30331293de3cd2e4bd080", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952697, "uuid": "31b72f79-0f0e-43a1-91eb-cc249f6726d6", "value": "T1D7B40207FBEC4072E975577029F602C31A367D615B78835B634EB82E19B2278B63172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952697, "uuid": "f347fb48-488b-4650-8990-be5852f1121f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952697, "uuid": "c9cc68f6-6eab-4f2d-b046-6446def98b31", "value": "12288:5MrGy90oKUwkYJF5XYGsjas2UYUOqRf2tnDFL:fyBYMjbMHqRetnD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675952697, "uuid": "590451c3-f898-4ff4-9164-5c12e85021c6", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675952697, "uuid": "6d43c0e1-5a8e-46ad-a126-dcfe0eb9f5f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952697, "uuid": "d015fb02-c58a-41e6-9e91-ce97b0bd96be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa3ca3f-a897-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675960219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960219, "uuid": "20a49073-7e0f-47c5-9976-9edb85166c59", "comment": "Malware payload (Amadey)", "value": "053ddc0ab6f011e1b7172968916070b0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960219, "uuid": "b5ef5f68-66f4-4294-b33c-4f3f8619e37d", "comment": "Malware payload (Amadey)", "value": "587771ba0732115e146cb6ebeb0d0e49b9186d0e5ce5ca88307d7f5a3581097a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960219, "uuid": "19e749d6-91ef-43eb-888a-7eaa63c6d2c8", "comment": "Malware payload (Amadey)", "value": "9c4e5c4174cb0d80442059b024d8fb72a61283ca", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960219, "uuid": "f3f66666-a1f7-4b4c-ba49-40285fd448a4", "comment": "Malware payload (Amadey)", "value": "8a4fd64135d0d62239c2fb697adb3dab54052516cb4239d27785679fc5bafdab4611cb7ab483bb3d95494bf9986fad3b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960219, "uuid": "c66424c3-1188-444c-a75e-88036a04802b", "value": "T13CB4121BFBE89432E5B4177019F303C31A367EA04B7553AB278E695A1872570B2317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960219, "uuid": "94592e2c-d9eb-4b59-89b7-b60b7c4407da", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960219, "uuid": "b2516d1e-fb85-42fe-8ab4-4a4eace10473", "value": "12288:zMrMy90ZMjSc/4vIUjJQf/O8eNdJOXhaxx7rtAJr8m:XyfjSsE/dm/exOx4Fro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675960219, "uuid": "da80b926-2822-411e-be2a-71d23ab906ae", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675960219, "uuid": "41088d31-bd84-4cbd-bbe6-e57a17875018", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960219, "uuid": "a9e40785-89a9-4d25-b667-42dd4964eb3a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6750deb-a861-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675937341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937341, "uuid": "746ccfbb-51b3-407b-a2b3-df0036519ec7", "comment": "Malware payload (Formbook)", "value": "fc06acbbabad476a921ede17ef98acb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937341, "uuid": "875fce93-22e0-4c6e-b045-b4456f0e96b4", "comment": "Malware payload (Formbook)", "value": "58b0bb4569e0cfff47eda9148e067e6e266acc8dbd21c47bdd385652d766db12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937341, "uuid": "c6941d4f-312c-4aa0-af0f-be5d83e12285", "comment": "Malware payload (Formbook)", "value": "fa01b697f439d6cb1dd53be2dcc4c615f4af95c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937341, "uuid": "bf89549b-08ef-49d2-b19d-791c229642a3", "comment": "Malware payload (Formbook)", "value": "458e9e7e10546071ecc5fb99ed1ddf439e1bdfc6a64e9c3b35e451bb898e6b821818ed8384ab58a0fd7a074fb36fc69b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937341, "uuid": "d43e9f30-3a95-454b-908c-67c23b11fd09", "value": "T16215E0122398CF12E4A103BC8AB2EBE017B3A935D1A5EDD99DC16CCE0925F6479477C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937341, "uuid": "853d84e5-083d-4f5e-9f3f-88ed23441193", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937341, "uuid": "abae396c-bfb2-4350-a16b-36b059d42307", "value": "24576:VlpDTpTwMYeE26PXV9ANkLHClBi+1ACHzVkbZTXElp:V7RwMYeBG9AsHmJg7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675937341, "uuid": "c2ac3d21-0b5c-43a0-b1e8-450c2bd793a7", "value": 945664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675937341, "uuid": "b3da3777-f6fa-499d-9483-b2dcb7f04921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937341, "uuid": "e4d3fff9-8177-4abc-b572-4f033f4c37d0", "value": "Eur2500.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b343486-a86e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675942825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942825, "uuid": "91dbbac0-d98a-4f52-ab90-2991b4c1a514", "comment": "Malware payload (GuLoader)", "value": "4bb86c670f6d70dcfbd583b935198df4", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942825, "uuid": "f2f0d12c-d17b-4263-903a-2abcac40087d", "comment": "Malware payload (GuLoader)", "value": "58b1f8aacbc830fd6cd4288bc82bc6116813f26d9da18dd44afbf1238baa44c9", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942825, "uuid": "c98a81cb-f740-4f23-b1e6-da58e72846bd", "comment": "Malware payload (GuLoader)", "value": "5de86ff42c9ea4e7c0e178f5fb93a091733d353b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942825, "uuid": "098ab547-216a-4675-94eb-eb22aaf96453", "comment": "Malware payload (GuLoader)", "value": "88550d0444322ced17646da949f2367f55cfcb6755a19beb8695a1b2ca555d7c8b33ebed1be5e91f766c150989779feb", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942825, "uuid": "5323e3c8-5012-4c43-8140-9536a876754f", "value": "T1B694E0315F562F394C3B9FD65CE20A3DACE91F7B293AD35EBC9126A54643289422F130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942825, "uuid": "49a44971-5711-4b64-93ef-689a31fd2d38", "value": "6144:9LmBIe9NXiN3+fad3vpL1QhZK2kbYY4vJqNCayKbjAteqlVavO10cok6xG15UtG6:9Et9Nywq3vRQiV4viCayLJ7aGUk31WT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675942825, "uuid": "a9ad1048-5dc3-48dd-b0bf-ed2fbddcfc06", "value": 431277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675942825, "uuid": "ed4fa906-478f-4af6-96e3-b7890bdd21c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942825, "uuid": "7bc5270a-1ce5-485e-89b7-d97f49fa94b3", "value": "Rechnung_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f862b4ff-a841-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675923681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923681, "uuid": "384c89b3-9c7a-45ae-a5a6-22af6aca0d60", "comment": "Malware payload (Smoke Loader)", "value": "b8b3e591802e185bf74627c0d01adc06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923681, "uuid": "3993c17e-dfa6-4387-8cd9-6863de3f7ba4", "comment": "Malware payload (Smoke Loader)", "value": "594570e97b5ad499baec0899a67b8435e185f3345fd73ef692b1919d24ce48fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923681, "uuid": "50b994b5-3f52-49b3-b88d-e7d926a9ebb2", "comment": "Malware payload (Smoke Loader)", "value": "adf4eb7409ff950f1e7172863c78b09ab67a7606", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675923681, "uuid": "e7bd9cf9-fd5a-48fe-8d7a-ea6c45f8cfa5", "comment": "Malware payload (Smoke Loader)", "value": "3861333a702e292bb331424d84a3a2c84c5cde8897c5ccc452a66e1e7ddda2f81332fb03761536a3d0b0db23bbb3b732", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923681, "uuid": "eb8f55a2-a51f-4c46-909a-45e8c1100e6d", "value": "T17814C0263680C0B2C43B04335864D6B5EBBEB830F6758A5B77981BAD5F702D16B37297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923681, "uuid": "84acf7e6-ce07-4cca-8646-073ba6d8aab4", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923681, "uuid": "a7ccc96f-60be-4be8-b3ad-ad6fe3cd3e83", "value": "3072:1RGPORvVi5+dOKL8OQWKd56BSmF0XeCEiCQ/z0dFfpWUJf/Ebn88t:3GPsBVLZQ6litwFfpjJnw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675923681, "uuid": "21e4b10b-b7b6-44c8-9123-e95204205fc1", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675923681, "uuid": "01f1b447-df23-4df5-a604-abef4ff9c776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675923681, "uuid": "3f20d744-df29-4d08-9734-e06f298026e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cbe9ba1-a847-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675926050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926050, "uuid": "5eb2d0c0-197f-482f-a7c6-08fb867f9845", "comment": "Malware payload", "value": "55215a3738cd3bc9f0665e5acf85f0c8", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926050, "uuid": "e5dc5aeb-b7ac-4edd-9293-3f438c60fa35", "comment": "Malware payload", "value": "59537fddba3734be27b2637e2583a026e4cb5bceee222590b8a29ee9a928dcce", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926050, "uuid": "f853c0eb-e4d2-46b3-9737-8f63ef5fd78f", "comment": "Malware payload", "value": "db66282c1ca7526f029b2894c1cf5e311fbbcde0", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926050, "uuid": "3127bcd1-3a21-4787-8e06-57a355959a54", "comment": "Malware payload", "value": "a88d5b9790ea6b654171ee40ce6835003a4ccc60b7781d5923132895bccab50cc88c8099f68e695ff309f41988c4235b", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926050, "uuid": "834f89c5-5270-445b-b919-fbe62fb22df7", "value": "T164C3CF0172E816EDE2F86E3144FA3F665762FE61A42A4B3FABD1205C6DE4A00CD1175F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926050, "uuid": "0dd41c3c-af07-4b84-bc4c-0f3ba582d448", "value": "1536:qIOjciqwpusMOnrRKWDehU6BpAn9Ama4ThqeQSQaoP:qIOgiJcsR9hyhU6U9Ama4seU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926050, "uuid": "770ea6e4-c540-4b95-ad9c-0b8e7a53a468", "value": 126198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926050, "uuid": "3c680089-7d8e-4a90-b6be-af05f69e1997", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926050, "uuid": "d35ed967-c5bb-40e0-a747-795bf5ec2164", "value": "unk.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f532af2-a852-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675930806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930806, "uuid": "662def40-6195-4ebd-bf4c-249a4fb39101", "comment": "Malware payload (SnakeKeylogger)", "value": "8279d87b8a57fefb7232189259fa4d9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930806, "uuid": "8b24f805-f547-414f-9963-d7eff21bf301", "comment": "Malware payload (SnakeKeylogger)", "value": "59f209004a7119c54746ce6b4a6e3f255701712145ecd240d7ce53d912daa622", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930806, "uuid": "2a06f3cc-9bca-4d56-99ce-f847259f38f7", "comment": "Malware payload (SnakeKeylogger)", "value": "4ec95d04cc42cfc7073d960beaf7d2e4aaa85841", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930806, "uuid": "add82156-35af-447c-bd18-ab6e4860e48b", "comment": "Malware payload (SnakeKeylogger)", "value": "8ea9b719102cac75c0040f285d26a1cbc3802dabd51d7d78e371bbd2f3dd4a355c888277e1e279d11300a2d117b40ac8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930806, "uuid": "89d2fe9a-e3c8-4be6-bc0a-c9a02123e288", "value": "T1B8E32B1D27F88800E5FF9A7705B15222C776F842192ACE1D56C2F5591B7DBA08E0AFE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930806, "uuid": "bb2d96f6-1b45-46ac-9fb3-a306152b0c28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930806, "uuid": "df77fefb-091a-431d-b54d-4f0489d32fe9", "value": "3072:PclpEavI1WvdeUIxvKtkxb8NJarwBVj8zFbY:rIadxvKObw8pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930806, "uuid": "92b277e2-f847-49ac-b344-575f6aefb22e", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930806, "uuid": "50bf2d4b-643b-4ab1-beee-766951c6f2cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930806, "uuid": "d1d16a53-b43f-4df7-bc76-0679cd55e2c6", "value": "8279d87b8a57fefb7232189259fa4d9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4164b6-a869-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675940654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940654, "uuid": "d8f2e2c5-15ac-4cf3-a1e8-ba63793c7cd1", "comment": "Malware payload (AveMariaRAT)", "value": "cae675beb80ed1fae88d407271ed397e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940654, "uuid": "71cc5ffb-13a3-45ad-8ba9-69946b78ab18", "comment": "Malware payload (AveMariaRAT)", "value": "5a70453a6b4f6a5dfd956507dcb364fa07bd6517f87ee23ed6d703f7ec1f6599", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940654, "uuid": "fea6073d-088f-42ad-a815-3f800565cd35", "comment": "Malware payload (AveMariaRAT)", "value": "ddf46550655ca7c075496821d90fb7f5706ee9d7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940654, "uuid": "9e297272-be20-49ef-a8f6-6264e6787547", "comment": "Malware payload (AveMariaRAT)", "value": "d95bc13e987c3c2afc906f20703f49650de36331c0190f6c153eb8bc52deb51c325d2350807dcbdddf1416c4d68440ae", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940654, "uuid": "b678d9a1-02d1-4002-b37f-b423b778eab4", "value": "T1A0C42317AAB18452C7A3C2311EA86023FBA33D3350954E5B2B86BF9879B4B44C51DF77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940654, "uuid": "292ac731-f840-4d6e-9417-fb93c29c1917", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940654, "uuid": "c7b47f32-dc80-4cbf-8430-63ea30d48225", "value": "12288:GkyEGBEcfVj2sEjQS0Y+N8v2ocCSivrlicgs7LVpr6O:eHBbVKsIQSY8vcKGshx6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675940654, "uuid": "6b5e2729-cc32-46fc-8a55-5cbb30dc2f84", "value": 577696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675940654, "uuid": "e593a597-49f3-466e-a195-06467f9690f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940654, "uuid": "732cceac-e2e5-4d89-9e53-ebf9c4e62ab3", "value": "REQUEST FOR OFFER (University of Parma) 9-02-23\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff4196b-a82c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675914352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914352, "uuid": "8d16a127-d026-4680-919b-1e3bd103091e", "comment": "Malware payload (GCleaner)", "value": "5ce26ba4302b1b465e68122791d56436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914352, "uuid": "63ce057a-cb09-4393-92c9-5dd5d6716b06", "comment": "Malware payload (GCleaner)", "value": "5abec94903e3ef4fb6fe0ad4a399d73d8f6a5d26dcb5ad9972aed43bc2b64ee5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914352, "uuid": "97c416a6-b331-4e35-85b1-71842f050f9e", "comment": "Malware payload (GCleaner)", "value": "f4f22eb7cd8a3994576f10d264eb5141d2693f2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914352, "uuid": "d1fb6b03-dbb3-461f-a523-1bf3d3343cb0", "comment": "Malware payload (GCleaner)", "value": "e98a7bce8543dafb002f3d74d95787973c82824c46efb6640766dca13f340e0c16a7ca26c87a3de87c7a1a57e240cf6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914352, "uuid": "14a2114c-e8f3-4d57-8bac-729cc1bb7bdd", "value": "T164C5127D7115C46CD280FE788C3AD8EB5CD66DE3E9E4A02271D8BF3F91782898A19147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914352, "uuid": "d2c04ffc-d4eb-4815-94e2-76794f781566", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914352, "uuid": "4907c0c3-fc0a-4dbb-853e-58a04fa34382", "value": "49152:rdHcBAtLUJbHGiJiXRMAYlRf1QKeadbPfkrktrEXhqWBVSIxiY0YLCgv2MR:JHcByLsbHGicXTARfuKeadzkrKrMhqGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675914352, "uuid": "5179cbca-abf6-487c-95f4-8ded1ffb97a2", "value": 2731476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675914352, "uuid": "dbad79d9-04ef-456b-b897-00a2377621e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914352, "uuid": "23bcd1f8-7144-45b3-834e-ffe34ec15d90", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98eeb8a2-a845-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675925239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925239, "uuid": "6d8995f6-c3d8-4148-acea-f35b4e158525", "comment": "Malware payload (Amadey)", "value": "037c66122aa60c9b65fd3c8f57e54441", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925239, "uuid": "98b0a068-b120-4a09-9d3c-6309997268ee", "comment": "Malware payload (Amadey)", "value": "5ac7409f3b2a730cef86234a64bf7daf96771bbb2debf23bdb784c8de4c6fac7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925239, "uuid": "48ba40e2-74bd-4998-9be9-9c35d9fba066", "comment": "Malware payload (Amadey)", "value": "e14237435b1f2d019fcb5e2b4a13e89c35096e6d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925239, "uuid": "4b2c854c-b5c0-4bc5-bc01-72cd29f46556", "comment": "Malware payload (Amadey)", "value": "05b4f028990939671005c195c68cc6617f4f85becb5ca33c7a668d60de358284f5c485b81c31adece1eb84dbb6b5a9cd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925239, "uuid": "d70f2609-c922-4f27-843b-cec76d2558a4", "value": "T1B6B40117B7EC9036D9B4577069F203C319377E944B3892AB234AAC4E1C721A0BA75777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925239, "uuid": "93c4c70e-e5b3-4792-8f02-748b59bc4f78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925239, "uuid": "e593965e-cd13-4a32-80c8-86b6202df147", "value": "12288:EMrZy905UPCkX/VYyOt6RDek7krN67t+Z8z3lOzaNo57:9yoUbvVGuD/t+ulOzT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675925239, "uuid": "07494030-fd40-4fd4-ac48-f6dace51b7de", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675925239, "uuid": "f5b95c23-30f0-4f3d-91a7-33f5af4cbdd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925239, "uuid": "4335f553-529b-45a9-8c4a-3013aa5c4526", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0079e099-a86e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675942592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942592, "uuid": "5b9356c5-e4d6-4551-a3ae-3acbe3013b14", "comment": "Malware payload", "value": "dd2bc19be3c355a34caa71c57441f92e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942592, "uuid": "863998e6-ee52-4eb6-ada9-0089df031c5b", "comment": "Malware payload", "value": "5b3885296b3bf4ed6f8b99c135e1a08eb467da7e0b5e3fe2a052ebb08a048294", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942592, "uuid": "2e9fa1de-315c-4ecd-88da-c3ef44f376ca", "comment": "Malware payload", "value": "2982803d47914739ab448a2b97391b317500e843", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942592, "uuid": "43c1e45e-6659-45c1-95cd-232311c8b06e", "comment": "Malware payload", "value": "2d01d972f450cb60c4c5eaf5c4d90fa42b5959c11f7b1d83f98c41437202a7a370e4354c9dc7545696103cd1b770b7a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942592, "uuid": "09edb8f3-758a-4134-8aee-75d0fae45fce", "value": "T1B9D36C15B4C1C072D96728321930DBB69E7EF8300F246DDF67981F7E9F202D29635A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942592, "uuid": "1bcd373d-c8ec-4afd-b1d6-6e8b6355619e", "value": "8b99bbe1c3b502f6b126944d2de443f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942592, "uuid": "b3a2a506-a211-4f03-a8fb-74c26c9d9204", "value": "3072:h8/VApZl5zAahB52drrgaduBv85MTVd2sakX:h8szAu72drrgN3TP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675942592, "uuid": "c0ddf8a6-c77c-4bed-bbd8-e3bdcf9b8e90", "value": 134656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675942592, "uuid": "16ee5a48-8dd7-4bb8-83ab-3d1af7cca963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942592, "uuid": "87cb0d60-2d8c-4806-aefa-837f2f8a4823", "value": "SecuriteInfo.com.Variant.Zusy.448962.19609.17054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1fbe73e-a88f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675957171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675957171, "uuid": "52749bca-698e-4db9-ab76-71761c03a813", "comment": "Malware payload (Amadey)", "value": "bfad08e17ad84948f207b6c51861b985", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675957171, "uuid": "2375d8bd-da7d-4b14-b3fc-5cefb38d96bc", "comment": "Malware payload (Amadey)", "value": "5ba97d0a2f81a5882821e5aeefd6439055a3b3beb0437043e60baef40377916b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675957171, "uuid": "05da832f-f5b6-44e8-9607-04f2e13ffbca", "comment": "Malware payload (Amadey)", "value": "84e90158d8082b461453bcc3126a0de6b48b7cc6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675957171, "uuid": "a7dc4690-07e8-4e25-a095-03a35f984ff6", "comment": "Malware payload (Amadey)", "value": "3bffa3cbd053e19130571e032a143fa8f1ed330bdb1447daededec55d3a657f550a42ccc570f7aaca9a1020a493eb6e0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675957171, "uuid": "24553b0b-e466-4960-a4ce-a4ac5eec6e87", "value": "T163B40207A7EC5071D8B1677059F706C30A36BE616738D69B234EAC6A18732B4B73172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675957171, "uuid": "dab18605-9701-4a96-a230-630838b0bcbd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675957171, "uuid": "6d7901f4-5378-4337-94f8-4025f8fc0f77", "value": "12288:UMrSy90QI0YrbdN0aXCDJ0BFyDnrKPc7:+yNIth6aXgeBFyDnrKPc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675957171, "uuid": "4f519d98-3e1d-42cd-9c1a-0e3726499f9f", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675957171, "uuid": "149ab9e7-eabd-4fac-ae3c-bc6c1289969f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675957171, "uuid": "f333ef34-fd3c-4bce-bc12-cbcf8641a3d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df0ed59-a871-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675943984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943984, "uuid": "baa1dade-6028-4ebf-90db-6f70f9adc75c", "comment": "Malware payload (Tofsee)", "value": "a8d94c24c01b5087755b28aca92cfdaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943984, "uuid": "ee873235-4a76-4801-a3e1-65a471d964b7", "comment": "Malware payload (Tofsee)", "value": "5c5e012afaa999bce87e1981f5ad0898db2b9c75058798b9ea5ba82fa4ecdc79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943984, "uuid": "0bff2146-15e8-496a-8ce4-54f7ad47f409", "comment": "Malware payload (Tofsee)", "value": "837e5374be4a46f364a844a10a1014ff6b098d2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943984, "uuid": "6cc48d04-6efa-4bd6-a7fe-ce80dcc30773", "comment": "Malware payload (Tofsee)", "value": "292cf2400fd20cc08e9484fc7a99de69cfb6c7ac7a820d2ca61333441ba78f4c28f5a28ce15eded349329382a80b9713", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943984, "uuid": "f036c740-6ce8-43e9-87c8-547a71b917e2", "value": "T1E814D0323AD0C071C9AB10309874DAB1B7BEB8315A358A577B98DBBE4F316D16336356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943984, "uuid": "be1c91da-4ccc-44c0-83ab-056373fedfe1", "value": "83d1b8095e33f74e23ddae505b88bb37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943984, "uuid": "17276fd5-4050-4b2d-9b8a-a099c188ebd4", "value": "3072:dhiOyHLordf7LC2WWLh5NUHo5rMELMif5rFL0sX/Uts:dhiNod7LPW3Ho5rcifnLt/Ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675943984, "uuid": "f1967723-573b-4b69-a177-e4ca676e1659", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675943984, "uuid": "45ccffb3-e2e6-401a-b39c-474bac7ca18f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943984, "uuid": "c0833b80-4c98-4eae-b15f-2c4108d42c68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202c4bf1-a818-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675905709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905709, "uuid": "62edd113-2967-45d6-b431-45d003b39d23", "comment": "Malware payload (Mirai)", "value": "45f67645b522aabdde3339bc1d3bbf18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905709, "uuid": "06d6223a-af0d-4247-aa5c-7a8850aa02b4", "comment": "Malware payload (Mirai)", "value": "5c68b3865b1d659c8d24d25866f7974c884d9f49d7bd1c81f59f8cb1df8812a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905709, "uuid": "0515b397-5ae7-4db6-9188-678c448f0038", "comment": "Malware payload (Mirai)", "value": "ecbf5fe5dd323b9e078b706b98d10a799eeb7c50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905709, "uuid": "f2b3625f-b8fe-45d4-955a-f9c40cacf585", "comment": "Malware payload (Mirai)", "value": "49aa1f50dc7d1ea1df064e195a5bd8b0bbeb75af7d0f0cb5ef5cc29fdb14810c74cbc7d97ba07acc654b8eb49940604f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905709, "uuid": "34be5988-2b75-4ae9-b5ea-257fd75b2f3f", "value": "T11B931896FC418A12C2C215B3BB1E56CD772613F9D2DF31439E251B217B8792B0A3BE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905709, "uuid": "f6b0a6db-d76c-40e7-b3f0-cfec708b728e", "value": "1536:QJm0ICCT8i7hVpW19t+AnlWIXrHsFEBLAwfOhoAS:8XIl8oV81KAhbsQAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905709, "uuid": "5d53ae52-658a-4f34-97fe-439a30a0098d", "value": 96076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905709, "uuid": "8854318c-a493-405d-af94-5dca29c270ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905709, "uuid": "82b39cc2-378a-4e2f-a4ae-28a49c9c0435", "value": "45f67645b522aabdde3339bc1d3bbf18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3053f56c-a886-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675952980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952980, "uuid": "f2905fa0-c80a-4237-963f-a093519dd091", "comment": "Malware payload (AgentTesla)", "value": "8f5a7a1dca6078d151e5499448dd211b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952980, "uuid": "1aa61fa5-9d24-44ce-a9e2-e06e94dde6e8", "comment": "Malware payload (AgentTesla)", "value": "5ce063044886360fa0d76e7fb85992deb54dd226ad1a959c9efef32c34a43848", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952980, "uuid": "18f9064b-a501-42c3-b116-afd719fe0599", "comment": "Malware payload (AgentTesla)", "value": "41951b766589e6352b42d26daf42a3846d518eff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952980, "uuid": "a0a98a9b-a557-4778-9e83-e74652abc0dc", "comment": "Malware payload (AgentTesla)", "value": "e3a717d78c6bddd54db448bb484374ac5565001b969fc71ee75f2a49a6d019529ab08059ee6057f0690bb3171d40865d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952980, "uuid": "1d64d469-4017-4d70-9732-da4e572029e6", "value": "T1DFE4122936FC8C6EE6BD4B7956B0024507FAB242B093F71D4F8474D10EAAFC04726A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952980, "uuid": "bc752abd-9abd-4838-8501-9f2f2cd12630", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952980, "uuid": "87be9413-9ab4-4714-b65d-375afbbdb2d6", "value": "12288:+jxM9Y8JkmslCk6Tke4xyQnjBkgNWR1OMOuQ2extchdCZTV+yEoQlQX:uMBkmsVa4xJn+gcNQ2extGCZTV+LoQlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675952980, "uuid": "c6f7a4a2-2821-4247-b03c-059422a3c1b8", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675952980, "uuid": "b21c9d0d-cd38-4450-ab95-49494d506aac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952980, "uuid": "18319438-5037-4091-a528-7e59dd2c9fe6", "value": "SOA FEB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163010cd-a8ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675968828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968828, "uuid": "dddb9475-da0c-4aac-a58a-2307e558bb96", "comment": "Malware payload (Tofsee)", "value": "9edd33098db4e14806331199b69ac601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968828, "uuid": "a24c2b84-9a6c-4f45-985e-f5001b26716c", "comment": "Malware payload (Tofsee)", "value": "5d3c00680d1cda0910bbb162285184063e83be390842a3ffed53a572a7b3fa4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968828, "uuid": "317fc1c3-903f-46e6-b07a-b9b4846ce803", "comment": "Malware payload (Tofsee)", "value": "eebbf144c297419360ba5cdca2a89682f4adb7f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968828, "uuid": "bcde867c-3ca5-445e-a08f-8a9954c70f8f", "comment": "Malware payload (Tofsee)", "value": "630b78f455bdfe09558edb6effb792c4a12d61ce778059b955088e39eff7696d2c7186c828ec8ab653c3006d01b77289", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968828, "uuid": "e9ce38b1-efab-4314-964a-f446b5753af4", "value": "T1E214CF2233D0E871C036BE309C69C6F5766EB9210A74969B3F78E72F4EB02C19676355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968828, "uuid": "02b880ec-608d-4327-9ae5-0a0202f6d403", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968828, "uuid": "c275cf55-3e4b-4965-a82a-df6c95dae75f", "value": "3072:yFg5568AC2nX+6KGsXIBMsCoxEDCvAsw3Ks5UMVWp0T6sohg:yFO7AX+6LsXWpED0AdT5FWp0T6soh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675968828, "uuid": "bf99310f-b0cb-41a3-8f96-bb81311307be", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675968828, "uuid": "55e5ab88-29c0-453c-b765-ad68c288820e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968828, "uuid": "3964b077-468d-47d5-8883-2d46d672c08b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fbc62a-a87a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675947977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947977, "uuid": "78878201-373f-4fb3-81ff-6f237da6f444", "comment": "Malware payload (Amadey)", "value": "2294c138d0434985c3e3a11651a80906", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947977, "uuid": "0ee0191e-8160-43ff-a5b0-ccd6c1c84b14", "comment": "Malware payload (Amadey)", "value": "5d463dfca2c92270cf91af9a567866af18847418953816de21c2c7c673cdf289", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947977, "uuid": "91b5cbe0-169b-44ba-b4a2-7fa27b246ea5", "comment": "Malware payload (Amadey)", "value": "4475a0f7f377328e0283eedf12bcdb52399a15f1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947977, "uuid": "df2fce89-f830-4718-8665-51f5617868fe", "comment": "Malware payload (Amadey)", "value": "c82212c391c80ac4e58bebb73e8f1acae9064b9f2106deef9cb01670e8b54586cd30bc903bdecc3ddc338dad66ba75c1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947977, "uuid": "836209fc-46fd-4de5-88a2-e579342c7345", "value": "T1D8B40207BBE88032D9B0477459F217D31A367D616A7483DB238E6C5B0CB2570AA3677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947977, "uuid": "f1e8981e-a282-4c21-ac1f-a4351af833ee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947977, "uuid": "28c0f735-308c-4718-b779-81bf1059f1d0", "value": "12288:bMr0y90KjSVLMnCecYecnHaoxLvpLbFjTg1LtyUf:7yqVLxe1zrLNbFXEZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675947977, "uuid": "7b35858f-05a5-49b7-8ead-8a974f72023a", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675947977, "uuid": "8093b9b7-1cff-4a70-90b8-1b4f1ef5c950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947977, "uuid": "4431c4c4-7c67-4203-8a1d-d2cfb40784ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1608a04-a813-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675903885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903885, "uuid": "e4ea4f5e-3854-471a-91ee-adb3a83ce83f", "comment": "Malware payload (LaplasClipper)", "value": "af97a8118aacf072359407791e061226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903885, "uuid": "f161f22f-0ff6-47a0-b050-c9ca055ca88d", "comment": "Malware payload (LaplasClipper)", "value": "5d5f5d1237220b5c74088668ded4ea66f3802eda2a5037a2594349a47602d13d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903885, "uuid": "91547575-fa63-4d6f-9400-6faf2979cc7f", "comment": "Malware payload (LaplasClipper)", "value": "55de218612548edd76d537955386c4cb8dc3bfc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903885, "uuid": "4e5b9c78-70a4-4b7f-a64b-7f504ad2cc14", "comment": "Malware payload (LaplasClipper)", "value": "75f4d1a4625ce4c38c88794a7a66b090a762519848a1960e9cd18fd40ebd222afddf2d955ef6aecf23ab927e588cd12a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903885, "uuid": "6c2f1d6b-4964-415f-b438-7ba46bb2944e", "value": "T15995121393E07C80E96ACBF2DE1ED2E8365DF7514E4AB77912189A1F34B2172C663E11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903885, "uuid": "70dd69b5-90eb-4407-945e-de665d540ae2", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903885, "uuid": "006eb8e1-fc83-45f7-a6ff-7245fab2d1ec", "value": "49152:ky1SM0SB8OvtkOAEq6KSAcfJyTAY/9jXe:kQVlOktjq6Vfs/9jO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675903885, "uuid": "5d482550-d4c5-43df-b21e-e41dba0c00a0", "value": 1992192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675903885, "uuid": "6ff6eee4-12e1-4bb2-87fd-8d1674d5b7d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903885, "uuid": "1c73516c-dc0b-4fe5-9ac1-2a6d3214513e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d74de70-a888-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675953942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953942, "uuid": "167005b1-960c-4db9-b8d6-af38882f6abf", "comment": "Malware payload (GCleaner)", "value": "7f06a7a53b0e760cd74f2ee427db7853", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953942, "uuid": "2b161b22-f1a4-4168-809d-11ae13679fec", "comment": "Malware payload (GCleaner)", "value": "5d6561747b8f207f8182644c92dfaeafeaf4d7e52de450e5cdc6487903f741a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953942, "uuid": "777fe1b5-58bf-42ce-aebb-4e10e9b6af81", "comment": "Malware payload (GCleaner)", "value": "58ee1bf5a6438c3bcee398716743cd3bd44b3452", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953942, "uuid": "cc5eafcd-7f3c-4e06-822d-bd826f781a16", "comment": "Malware payload (GCleaner)", "value": "e3dc94e6e1e0c78eabe7a44ae213ef5af813a61c7bb404cca370907770363f4294cd831ff165da9d7430b7c4ab1866be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953942, "uuid": "e8e6d737-ef3d-445b-a95a-0bcac7411478", "value": "T1E2B5127C7145C9ADC280FEB4CD3A98E75CD76DE3E9A4906270DD7F3E91792888A0A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953942, "uuid": "215f40e7-13dc-4aa0-9e5e-eec37d3cc5c4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953942, "uuid": "12050876-3796-450b-b182-cd8e3f902cb5", "value": "49152:rdHtFh0STWgBQq+SmCnQT7eR1rOe6CjwVrU8bDijPH8LCgv2MR:JHtFh0STWUv+17cx6rVTNv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953942, "uuid": "18b30fe2-2d6b-44a2-96ed-6c7034f65e0f", "value": 2484626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953942, "uuid": "6547b10a-4dc1-479a-bc89-8020562a8ed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953942, "uuid": "a6acad4b-c4f8-463c-b092-0d72a6044e7f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7dc21d-a89a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675961695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961695, "uuid": "36356288-5a97-418a-89ae-c1c367788530", "comment": "Malware payload (Amadey)", "value": "205cb56efa7e0e81586a696e21d2b4e6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961695, "uuid": "1f577f39-cb21-498e-974c-ad07d4d09eaf", "comment": "Malware payload (Amadey)", "value": "5dd0b39129af5407fa1ed779807f499af56914317b8d2f442b71d503e1cf9f13", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961695, "uuid": "a659f56e-4e55-4acf-8f8a-4fed5a32e6d4", "comment": "Malware payload (Amadey)", "value": "95bc29b09a88169e18d3666c7b719661a54c5d71", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961695, "uuid": "2503384c-a236-4e1b-a0bc-a72932eb7cc2", "comment": "Malware payload (Amadey)", "value": "b08a556896019d22ac966e790292346f270ae89f6695133a0b3957811cd572ad56bcfefc5642a1726eafa68bb790631e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961695, "uuid": "8fc1d6d1-19e3-491d-8cac-686bfb6a05c5", "value": "T116B40217F7E95032E8B15B7019F603C31A357DB0AA7893E6238A6C160973664B13277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961695, "uuid": "e47309ed-a838-4418-b00e-59c3c99e5483", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961695, "uuid": "35ad4dc1-c311-443f-ac84-3ef842a316eb", "value": "6144:Kny+bnr+dp0yN90QEo+IB+HifJEjHWDAVNyU15vg3V9PvCwMl8JcKkXh2lbhakIX:dMrNy902BEKOy1l9CN+J+Xh8hatRL0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675961695, "uuid": "25f79467-be49-411a-bfda-26f1a358d3a7", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675961695, "uuid": "9c8e8020-974b-4ae5-a0a2-d5aea6a46a47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961695, "uuid": "476192d9-8ca1-4e83-95c9-c84fa77b92b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efe717d-a860-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675936657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936657, "uuid": "2e94ba4e-ffb2-4a48-ba69-7d0fedaa1dc1", "comment": "Malware payload (Amadey)", "value": "cf12aeae8cf95a7a34a6509b0416f31a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936657, "uuid": "a0856098-d10b-42d4-b0d8-575eebb5fb63", "comment": "Malware payload (Amadey)", "value": "5e5204872132c8d03e23918271af7958131ef6a5382a7f453d490f2adc5047fd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936657, "uuid": "36d8f2c7-aa4e-45f9-bca2-087bc1919050", "comment": "Malware payload (Amadey)", "value": "e45b6d5555ef371207447699e5d3890ccd6f77c9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936657, "uuid": "50bdc6a6-6d24-4bb7-98e6-a135135d8609", "comment": "Malware payload (Amadey)", "value": "dec1af118898e353daf8dc6865ea249deb4b29ced513a1601876bd51843dcffac92a4700fe4f9838d414cf2cd65796aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936657, "uuid": "bb79f9cc-30bc-40f4-9fc5-2f24155b39a4", "value": "T184B4010BE7FC8132D8B457B028F607D31636BD616B38478A668F6D5E1C325A0A67077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936657, "uuid": "00cdfa46-b10b-4fd9-a394-93bf22d9bc67", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936657, "uuid": "10b8247a-0e4b-4993-a899-d3310cc270aa", "value": "12288:SMrhy900IETTgfrwOrRt3w5QluPZz/9KTSZysNH6v:PyNIU4NrRSQoP9/0TSEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675936657, "uuid": "63b94aa8-2ad3-4e70-a38a-6d60965290fd", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675936657, "uuid": "470351cd-cb4b-498d-a300-ce8f07001617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936657, "uuid": "8252d209-9aa6-48b0-8825-0214d5fb0e6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be75d7e-a8c3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675979119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675979119, "uuid": "3a3f2940-7039-493f-a70a-841d9d9e2e1c", "comment": "Malware payload", "value": "7c6add98e6b772f5ba86adcf1e2a594d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675979119, "uuid": "27a4825b-7dbc-46ab-aef1-44bdc5d156b3", "comment": "Malware payload", "value": "5f163e63e4ec934f7a51e65e9f81533b210a7e2f97a7f34097a973faeb403b4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675979119, "uuid": "a50a6766-189d-43d0-8c78-acf1b550b6a7", "comment": "Malware payload", "value": "f8b5bd4ddc3dfc339d89d7ee52f08de6b452b382", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675979119, "uuid": "1c01c2e2-0d53-438f-bece-ef99cad30a3a", "comment": "Malware payload", "value": "d0fabbf5e6de846d72b88d62c332e1921a3d68e5c5e2f77d5b606e51b3ebe6c86511df9094af3c7e67127935490db2f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675979119, "uuid": "e01cbca2-255b-41d0-8ed1-cb2746343497", "value": "T19EC5127C7545C8ADC180FEB4DD3A88E75CEAAEE3E9E4A06270D87F3F5579184861A103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675979119, "uuid": "9f99a14e-972b-440c-bf20-4cfcfe01a318", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675979119, "uuid": "ed61c9c4-60e9-4006-ae86-0d44c785dc35", "value": "49152:rdHSOzEOwYHrHmV8LjFcPmCYRj7zV7VDJZ3aXLCgv2MR:JHSm7rHmVUMFIPzVPZ3ajv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675979119, "uuid": "5737367b-6b55-4eb7-a38c-720127a01371", "value": 2638370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675979119, "uuid": "6680c2a7-daa1-47e0-a81d-ead4b7d8c14f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675979119, "uuid": "18a70e00-cfdc-4920-bd30-4d9a5e38e943", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716a1d44-a838-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675919589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919589, "uuid": "71bcc99b-b443-4ba9-9f04-da053e9a1054", "comment": "Malware payload", "value": "8976830349a4a7ed0abfb62589289dfc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919589, "uuid": "10a7457d-a66e-4711-88df-e651a71ed578", "comment": "Malware payload", "value": "602d818af015bb9198b0f92f8de70da169ab51d0ffa07002c6c33a8ced28fff2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919589, "uuid": "507005c2-e7ac-470b-98fb-576a6104f964", "comment": "Malware payload", "value": "cd44ec624534a1f770e6245e5c60205ad18f820c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919589, "uuid": "1005048d-f2b3-48cb-a7f9-ea06dce5a274", "comment": "Malware payload", "value": "a09bd7795f3578eb4364369ae83c1a7a2fb331ca5ea9c7b252e1ee01422d0c51f012311b358f8faa49bacd6c4ac3f188", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919589, "uuid": "105d20ad-556c-4d1b-ac3d-15011a20471c", "value": "T1FE652210B6C185B2D0A71C344D9097727B7DBD706B3A8FDF97845A6E8F202C29939B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919589, "uuid": "49728e94-c7d4-4afe-a17a-3e1853e22f7d", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919589, "uuid": "97759ae3-2edb-4051-849e-397e428066f3", "value": "24576:JLllLl7tEtqZzCuZpGxBuxFbEenCGaFmhhOQVG/faVCBPYFHt24PL0A:hllL8WCuYBuxBE0CGrh7G/f3PYFHt/Pn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675919589, "uuid": "28dd269c-b7e3-4af3-805a-e79efde6088d", "value": 1512326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675919589, "uuid": "ee678fc3-3e8f-4a4d-844c-bfc40f4a06cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919589, "uuid": "f2009b56-0929-45e6-948f-bb406b6dd6ec", "value": "8976830349a4a7ed0abfb62589289dfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7a4d2b-a8b4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675972888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972888, "uuid": "614e3832-f3a0-457d-bcca-500dc720dd13", "comment": "Malware payload", "value": "1a94e0b409130c7d71113a0c83cb0e4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972888, "uuid": "af1cd2c3-6954-4a95-a0e9-cd001e1d3ccb", "comment": "Malware payload", "value": "603a3165c1052203f6dbac4a98dc04f4974e1832c80cac03df6453b687d1d3ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972888, "uuid": "770405b1-a3dd-4c47-b9e1-4bee0591b42a", "comment": "Malware payload", "value": "7f3df4888d03f8dc9fefc14f2bbe40e7a342b54a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972888, "uuid": "394c586f-e755-4d8f-a3aa-e3ae78ea1983", "comment": "Malware payload", "value": "5214a7e4bd4c4d35972dfc52b908bf7500e69264f56298a6b6ac655e9441989c5daad068247f33840b3bac1d0727e384", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972888, "uuid": "f0f79965-828a-470b-832a-b80495b2f7f7", "value": "T1A554E0223390E870D472B6319F24C9E0B7BFF5218A755AA77758232F4EB02E0DA76355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972888, "uuid": "19227f39-c4f1-4aa9-b8e9-05e64b246ceb", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972888, "uuid": "362201ab-8fe8-4749-8ce4-8ed6fc7f82d3", "value": "6144:fREdOJumjehNGvJqOqMmEtLxXPjFf3lOB9aw0l04uMXZGN:fRLumyqJqOq+xRf1e9awlCXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675972888, "uuid": "13761683-25f0-4d65-8714-9b130da9b5a5", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675972888, "uuid": "f55b87ec-9630-41ab-aed9-3def9a7bc5a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972888, "uuid": "d3bfd4f7-882b-4e84-9306-66c1ebb9b6e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858e77a5-a8aa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675968585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968585, "uuid": "c81e46d9-da0c-4725-a6c8-79a4189d8137", "comment": "Malware payload", "value": "675d90453b0545f078560bbfb8d8afd9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama239", "colour": "#896E20", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968585, "uuid": "6f0c7830-3579-4a42-85a6-4dd0b5b8c817", "comment": "Malware payload", "value": "6091eb0b25c58641a11d62cfcffc0f0596d273af86629f2b12537c00b9b114f3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama239", "colour": "#896E20", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968585, "uuid": "813379f8-0cc3-4d56-95e4-ea43261ec04d", "comment": "Malware payload", "value": "9aed0464bdebe19a13c35480d3a61707ee338e1e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama239", "colour": "#896E20", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968585, "uuid": "6b5e2faa-ecf0-4959-a8a0-daebe5855575", "comment": "Malware payload", "value": "4cb5ae651ba1bc6af1314814d0208e9560c49da7b2198659777e1dbcac9797d5ae53984943dd28a7589336d685f2bb7b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama239", "colour": "#896E20", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968585, "uuid": "05fa0186-3cc3-4bf7-aaae-fa5b0cd9f8c3", "value": "T1B6F43A2AFA0191F9ED1200F2950FFBFB54342B394C65CCDBE2441EADBBB5D60511AB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968585, "uuid": "7b00dc9b-f2a6-4792-9a4a-4a2a4058179a", "value": "e62ccf1e5c561da53ca2f798bfd5b608", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968585, "uuid": "50596985-f5f9-426e-aa7f-a305c6f628d2", "value": "24576:/H81smt4vyVjXe1ikZdtjMsc7MscXMscktkTNd8uB:kefBtkf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675968585, "uuid": "7ab9c1f5-29d9-446b-8728-4de390bda3f6", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675968585, "uuid": "8f042e79-5fed-46d1-95bc-ed4d24e1239e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968585, "uuid": "ba275304-8800-494a-83c4-6c5e5373b353", "value": "187737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34ce4a1-a811-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675902976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902976, "uuid": "5a3f9a3f-43ac-45f6-ba25-1d2c02d67b16", "comment": "Malware payload (Amadey)", "value": "ffc357a369c50ae37b33589e5c014599", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902976, "uuid": "d9b7bc83-cae4-4d9e-9560-3b8b9551a9d8", "comment": "Malware payload (Amadey)", "value": "60a450511cbe2215c6498c53d491244b41a8f1456263e82f326cfcc580b3d0a9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902976, "uuid": "c97b1d9d-6050-42e6-b76f-d7fb31e739ba", "comment": "Malware payload (Amadey)", "value": "205c286f10277d0dbe043f27046bec63c6b7f190", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902976, "uuid": "f4e9e95d-c9bc-457a-936e-2dce53d6dfc7", "comment": "Malware payload (Amadey)", "value": "b5d6c406e0fbe83aee8cea114180cfdc4dd84e074aa7b074e0c8f1e8d6cb06f555fbef427879b118f880e44c5234fde6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902976, "uuid": "dafb50db-abc4-4653-8c02-233fae43da97", "value": "T185C40207E7FD8022E9B517B418F207D31A367D519B38839B274AAD6A0CB25B0B631777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902976, "uuid": "2b02b988-83a3-472e-a2bd-a16c3b45d5ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902976, "uuid": "11982ba3-3ee3-40b5-8dca-3e2af6fb6bed", "value": "12288:YMrDy908HXYV3y/XdJm09YeppeNWeYtmaDUtmGS7L:Ly2V3qdJ/uEeYUt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902976, "uuid": "ef2ca9d0-cfa3-4569-a378-06bd5fa2544a", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902976, "uuid": "22a1c163-1d9d-46d9-8ee5-58358e25c42b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902976, "uuid": "97ea5f66-2ef9-48ed-99bc-35b1dc291e65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ea3223-a886-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sodinokibi)", "timestamp": 1675953256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953256, "uuid": "b0308769-29f9-41d5-acd3-fe69f830329c", "comment": "Malware payload (Sodinokibi)", "value": "d3624ff1fd9a8d7866a1578359716a55", "object_relation": "md5", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953256, "uuid": "86ee0f05-d3d6-41a8-9118-9733027ef66e", "comment": "Malware payload (Sodinokibi)", "value": "60c49baa290de5336e5903286d1e8ff8b8b833046a63be00966695dc9d3f6dbb", "object_relation": "sha256", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953256, "uuid": "d834dec0-6f33-485b-a373-4db8b38de610", "comment": "Malware payload (Sodinokibi)", "value": "66813f8263a1c8a53e8d6fece8a307e2ba5fa342", "object_relation": "sha1", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953256, "uuid": "993d8709-12bd-4a19-a88c-8a40fd3b1bf1", "comment": "Malware payload (Sodinokibi)", "value": "50268315f0ad70b05c87ca820eacdb80bd202420825c2ecee9f72f070c53b45d05021d07be296d13b775f02a875e21e5", "object_relation": "sha3-384", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953256, "uuid": "7247719d-f318-441d-9ea4-cfd40e875fc0", "value": "T13104E06B6EE040B2F0D341F2277B3F267EBFFC704836151AD76858890A65581DA2A3D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953256, "uuid": "c209163c-d889-41f6-8f4c-06e8c264d0d0", "value": "9014e39262404e977fd8e4e75cce30e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953256, "uuid": "fd187fae-0a8e-46b3-a8dd-796fa3c08c3f", "value": "3072:rNKQ4JTBg0Q8F63VETed7/kBazzFbUL7npOStSWQ:rNn4FQS63VE6F/M4q30TJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953256, "uuid": "2bb7f401-a67b-4f60-974e-5bfeafcbee76", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953256, "uuid": "d8695e75-c626-4c7b-a439-0d8600ed7f65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953256, "uuid": "d253e8c5-85fd-45ae-9f87-d7682670319b", "value": "2023-02-08_d3624ff1fd9a8d7866a1578359716a55_revil_sodinokibi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43f52f6-a83f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675922681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922681, "uuid": "f444eda4-2e69-47da-992a-a0775ad7dedb", "comment": "Malware payload", "value": "95b37b8fea5707e31516b1491b684dee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922681, "uuid": "295e6eb9-5b1e-4f49-84e9-3a6beb74602e", "comment": "Malware payload", "value": "61048b15d511b7ddc55842f2a12970251f46b7fb7d9b93a42e4a2365274525a2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922681, "uuid": "9d67d8df-a500-423b-9776-185a092d9328", "comment": "Malware payload", "value": "daa87465e5529d9235fdd8fa92aa2fa8e64f1165", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922681, "uuid": "c32fc857-ac8e-47c4-9670-6c1edb0e50d4", "comment": "Malware payload", "value": "8ce2faeca7de4eaccfb110b890ca7145dbe90f43e0f7439afeb3fc2bea818bccccda07912c0598e2b7f7d7f259479cb6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922681, "uuid": "4fd4a6e1-4a61-4ee7-b8e9-84bad0c59161", "value": "T1C6E39D83F9D1D6F1D47E2A79847A93500B3F2A109F16CCE7239912641F660D26F72B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922681, "uuid": "730788d3-4e01-43e9-90b5-58ad44c08383", "value": "6652f1a4d5005cb50ad0e122c1bd7ba8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922681, "uuid": "947d5b64-e1e5-4be3-8ca8-f4288e81552b", "value": "3072:8uZ6hcvJTZ9oVFBfnIyht8vPs1XQHBC92ePuH:dTN4HBnI2t8vPLu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675922681, "uuid": "9c351bbb-ae75-4cd3-9a6e-ae3e07dec5a7", "value": 145510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675922681, "uuid": "775ce8ea-884d-4139-b08d-6f02c1c76ac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922681, "uuid": "fe6d5029-cd23-4fb1-869d-5ca9e85ae4ac", "value": "00b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465b1261-a8ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675983941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983941, "uuid": "ba4728dd-1fd1-468f-a4e5-ab92051af1b1", "comment": "Malware payload (LaplasClipper)", "value": "09a0191c8eae4e46114233d76130aad0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983941, "uuid": "329eabce-527d-4815-870d-60207b4359ff", "comment": "Malware payload (LaplasClipper)", "value": "615410f6d53aefbcbdd874fdeaa335d174bdbdae890d8888e02af05e9851b589", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983941, "uuid": "73d552a6-6e6c-453c-a374-7c8c5c639549", "comment": "Malware payload (LaplasClipper)", "value": "b4f7b43ce6c44ead89a921b643f9bb54b90f869f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983941, "uuid": "ac190e67-5efa-4582-bf74-45b2957529cb", "comment": "Malware payload (LaplasClipper)", "value": "02ec028bf30b50784db9ed8332fb1eadc7f0e9020039691c20ba8209d802946c92425395ff787efb8c877988ecd9ab0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983941, "uuid": "2b3861fd-3c7a-4d96-b8cc-b23b7a53d2a2", "value": "T192561293BB508556C0DD8839992B5FF939F1EA676E026923338D7B8D2E722D0B3035D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983941, "uuid": "e32b03ac-aea5-4af8-bb47-f1117d31cc8c", "value": "5780e08c9c78220a0c99027a41bbbfa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983941, "uuid": "8039f01d-2fa4-4192-9891-726504ac453e", "value": "98304:mziCKd/1vxs4IEgIpQyO87n+esGggVa6fTUiJFC3zIhg/EYuhS8/vuXgLu7:YiCS6Ic22GbHfTUiJFC3Bp8nzi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675983941, "uuid": "7930fd51-b984-4682-bd84-e05c2d30f31a", "value": 6283912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675983941, "uuid": "f43e1726-5117-4cce-869b-6c9a64366a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983941, "uuid": "c42c7528-e054-44f3-8b9b-8a45a1b209ee", "value": "09a0191c8eae4e46114233d76130aad0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513e81e1-a899-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675961196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961196, "uuid": "32be1f40-f408-4269-bb9a-37b75f37dcc9", "comment": "Malware payload (AgentTesla)", "value": "41a6ab162b2f072e491a45cdacc318ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961196, "uuid": "6b978c0e-8617-4fa1-862f-a0da30a999ce", "comment": "Malware payload (AgentTesla)", "value": "640367fad550829f947c4910d32d1d141965d95ecbb8d03c60642b22e18d2494", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961196, "uuid": "0242d612-438b-4a16-b13b-5867cc3fe299", "comment": "Malware payload (AgentTesla)", "value": "e1aa5f849312017b5caf364fd2d6262171c747b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961196, "uuid": "fc795bc6-549f-48c1-880f-6833e24c9118", "comment": "Malware payload (AgentTesla)", "value": "2751472d9145b32c11c49a80d5b81c6758ba2ff94034e05691f043d6f2c20dabf22ff6a7435b0e46b9300144d9de7e81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961196, "uuid": "5e54bb7c-9329-4c6a-9704-52c2270edb57", "value": "T1CB64128A67A04497D951CB7183BDC73FAFF5F92722E9A93B13901A2D3812EC1650F391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961196, "uuid": "ce6e8238-588f-489c-982e-1abd980c77ea", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961196, "uuid": "0963f1fa-76c4-4dad-9434-401956db4f76", "value": "6144:/Ya6Qbdpi2lrvM3/Jh7gmWnhzcRdT016rvw+WmKvJB8kG3FB8u5:/YGJ1lrk3/4hzuHbpWTB8rKu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675961196, "uuid": "4b005ca5-d5ab-4e48-9f8e-b2caed061d13", "value": 332284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675961196, "uuid": "e0ff1d18-7479-447b-9b61-9c1764afa88c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961196, "uuid": "b751986d-f84b-48bd-a6e3-912267b4437e", "value": "SC0923881DB001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e41fe63-a8c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675977941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675977941, "uuid": "e1bf4826-a575-48a7-8349-539cded360fc", "comment": "Malware payload (RedLineStealer)", "value": "3788b57c1fda9874f25ea7f6dcb7686f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675977941, "uuid": "9e859053-55f1-445f-ae92-4efabd540ba9", "comment": "Malware payload (RedLineStealer)", "value": "64235eec86bd3d232fe1b044533e1aab8d815c42e2cf5ef6b77b763b1820cf0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675977941, "uuid": "f69ea792-d8a9-4f00-9398-618eb4b37154", "comment": "Malware payload (RedLineStealer)", "value": "aecd613dffc7de70dfa71b9596fbf0a387c5927d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675977941, "uuid": "0071b758-5e03-4415-bfa2-abbbe9812d49", "comment": "Malware payload (RedLineStealer)", "value": "490c140d4381b908485778f7e5a49ac1cbb1c42b7ed27634f02d24626db5e8f0aec85d8af9e34786415c84582bec0d7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675977941, "uuid": "beabcfa5-42f2-4eea-9b0c-4e897e3ec098", "value": "T1CC04D61437FCCD11E0BA5A3F6961A15086BFD802A852F25B76C367CD1E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675977941, "uuid": "458e52f4-bd28-4250-b9fd-a4a13c8fe793", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675977941, "uuid": "a5925317-74d7-43ef-acc3-92dde15bb1f0", "value": "3072:nxqZWWFa7E6T87zIvOKPe3l9rhXv7xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0je:xqZP78vz6rh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675977941, "uuid": "abfd3714-df5c-48b3-b0d8-8b7e1454faf1", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675977941, "uuid": "700590cd-cd34-4a90-9596-4ee22919893b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675977941, "uuid": "a89aaafb-8cac-47b1-8ba2-ce6801a83932", "value": "3788b57c1fda9874f25ea7f6dcb7686f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a374dde-a869-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675940515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940515, "uuid": "ac1a57a2-b4bd-46fe-8a16-2e25b84ae560", "comment": "Malware payload (Smoke Loader)", "value": "b40aa8f5fbc135ddc29ddce16c4c18ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940515, "uuid": "c1bd1c9b-8215-4872-93e8-49c4207a9fbd", "comment": "Malware payload (Smoke Loader)", "value": "642d9efde8e1a56a1b7ffb46be0a37195d48052e1bad7f3fa9f37a4c94432a2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940515, "uuid": "d234710b-8879-4730-910a-69830b669369", "comment": "Malware payload (Smoke Loader)", "value": "0bf065c0eb7825374716fdbcd28493ad3d8a996a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940515, "uuid": "09d577ed-c7c3-402a-a72b-1c0e1180d15f", "comment": "Malware payload (Smoke Loader)", "value": "823f09717325f094d7543753b0c8d4dfccacf199ac089cbf937499e7f24c250af2d1108116ed12512a39a63cae0a2054", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940515, "uuid": "ada82a69-cb5f-4505-a94d-7eb3cd9f87ba", "value": "T11914D0323AD0C0B2C56B25305C64DA616BBEBC30857D9D9B77981BBE2F313D0673A256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940515, "uuid": "44d7db81-36c7-45ce-914d-f610bf7c76e6", "value": "83d1b8095e33f74e23ddae505b88bb37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940515, "uuid": "aeeb001b-21a9-4c3b-b927-a1370e918dda", "value": "3072:01OOxOzNDmbFL8bcQTW6h5aGAPa6skrnEh/iyQhsCl1jW3yBAcZ9PuEr:01O52FLiTYGsIkAh6XsedW3pcP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675940515, "uuid": "e0ab9b67-6d45-40cd-b7b2-0357aa2d205f", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675940515, "uuid": "a0875b85-aa80-471c-afff-a07a1a07bad5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940515, "uuid": "0e966f4c-d928-4609-92bf-32d71a0521e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b9b1fe-a81c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675907568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675907568, "uuid": "d16d6ab2-9f30-422d-b9bc-e9b3c0857f96", "comment": "Malware payload (Amadey)", "value": "5d4e54d149be28b2c02aab874dfacc30", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675907568, "uuid": "35678da1-186f-4e41-b392-9ebe05a655b8", "comment": "Malware payload (Amadey)", "value": "6478f2c841c53a1e647e6cf21099f6b68834c36e5d3f43a3f5dc4753b334d43c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675907568, "uuid": "543a110b-4d11-4175-9419-4b0bff7ee571", "comment": "Malware payload (Amadey)", "value": "fe40ec7e886adb61b0d51bbdeb18e694954ef953", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675907568, "uuid": "c1119e13-1c61-446a-a1dd-187b5c062ecf", "comment": "Malware payload (Amadey)", "value": "bd04c97f61dfda39ac77c90ed8159cbd51b3bae422caecd25b1a1f681218a4a9bf575a67e7a90eda61f2335222fa168c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675907568, "uuid": "3ceefcbe-7f62-420f-9fd0-2f9241d488e6", "value": "T1A7C4020BE7E89032ECB1577049F647D30A377E614A34839B674E5C6F0872AA4AA35377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675907568, "uuid": "efe388d2-6452-41b0-bb51-87e5a0e39553", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675907568, "uuid": "1e7e213b-b12e-4aeb-9ee9-356b2a78b493", "value": "12288:1MrCy90wuGiX93XG6HMzed8UqW9iYA4mIiqT0BcR:DyeXU6s6esVrrQBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675907568, "uuid": "0863517d-45cd-4cf2-afff-7fa46b936d7c", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675907568, "uuid": "871d4f87-6407-42b9-8cc0-556fffcda77b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675907568, "uuid": "cda7334e-6fa3-4128-bb92-04d0a88212c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076031ca-a897-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675960213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960213, "uuid": "12cba837-10f5-4a0b-8f4b-69dcfe96b6de", "comment": "Malware payload (RedLineStealer)", "value": "2a7a195be2586caec296c6ab419f901d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960213, "uuid": "ebbc320f-f5f2-4bc9-887e-108f40cfb759", "comment": "Malware payload (RedLineStealer)", "value": "662b2691fcf8bc29610b97c2d26bca073b3a0323f2c896adc3796fb7e170f0cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960213, "uuid": "4fb7cad3-1c16-4575-a990-d1ebabd6db3f", "comment": "Malware payload (RedLineStealer)", "value": "2c0815954842270868825021efebf0bac71feb94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960213, "uuid": "da9d9046-4e0d-4f20-9294-ba809eeb314f", "comment": "Malware payload (RedLineStealer)", "value": "9c0ad4fd3893411132b2a362616a6402be13f69d19e84c91d02f52d40683a88cf0b774d685521e49c8657cda1e7c6c88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960213, "uuid": "1a50750a-5262-4951-a381-d9c489bd8b64", "value": "T12E54E02236C0D871D872B7324C66DAB4677EB5214E7896BB3758172F8EB02D0967233D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960213, "uuid": "adb49ad1-88cf-4c37-ba6a-d498e7216b87", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960213, "uuid": "f10a731f-66fe-436c-8996-35a86d9a9ebe", "value": "6144:BRc352Er1Slk2BiLptntRk8zd2dFFeZAh:BRcBr1SK2Q3tJ47Fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675960213, "uuid": "4099fa45-270e-4ed1-963d-1b356fa932ff", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675960213, "uuid": "d18f3dc4-b150-48bb-b457-8bfbf51c2dcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960213, "uuid": "b8656bc8-95f0-4438-b47c-aedf64f58322", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43949858-a8a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675968045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968045, "uuid": "f45f3c5a-a268-4f7f-9f19-9f4fab23df47", "comment": "Malware payload (Amadey)", "value": "ed8aafca136a9f78aebe7503b7b44904", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968045, "uuid": "c2aea511-d324-4399-8a55-3f0c8e777d8b", "comment": "Malware payload (Amadey)", "value": "66843287536a92fb1c947f6db675ed06c8ecc7047c9aa9d898d648bc4bb0c106", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968045, "uuid": "ee2658f8-d6c7-460d-a4ad-b9e5685f84e5", "comment": "Malware payload (Amadey)", "value": "5e33997fccf973153e557a25c5c4d343b03be033", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968045, "uuid": "dbf5d051-f217-4064-8c8a-d98a98636bf8", "comment": "Malware payload (Amadey)", "value": "b459679e6995525e39c9a47458f4b4731c022797c0a9932e44dec5964df8bd7f8d0d3001805495c0d0d40c460af67073", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968045, "uuid": "ff411994-22af-4d8d-8ba0-6945ab75a826", "value": "T1E9B40207F6E84037E978577008F302D31636BDA29A789297675F6C0F1DB25A0B63936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968045, "uuid": "760c65c3-12f2-4eef-b0dc-bbabaaa06f57", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968045, "uuid": "2340386a-68ee-40e8-8799-5f71c0f82a4c", "value": "12288:eMrZy90qSl8hunfkLqTlChqtxYaDTqdh68QS7y:jynSllfkLqwexYaKO/my", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675968045, "uuid": "e29d0684-465f-423e-860c-ac4d3f136ee7", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675968045, "uuid": "3ab73a66-43c6-4533-b2b4-0dc308a33e1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968045, "uuid": "4cea9ab7-e507-459e-93a3-22974c49101e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc40ed8-a84e-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675929005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929005, "uuid": "ab376d7f-8c80-4f75-95b6-b9137433b0e0", "comment": "Malware payload (SnakeKeylogger)", "value": "774fce3482098255807f037d4b878e8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929005, "uuid": "cb51a3b4-530f-4e7f-bd3c-cdef28750520", "comment": "Malware payload (SnakeKeylogger)", "value": "66bcd3c46ec7c8441a869a00e2d29d5692bff89222ef063ec2b8783ce8396064", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929005, "uuid": "30825429-d4be-41dc-9cb9-646ebc85e709", "comment": "Malware payload (SnakeKeylogger)", "value": "132d20e0776a61b262747dff778db068ac878af4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929005, "uuid": "4e3a622b-830b-4077-8117-10de214883c8", "comment": "Malware payload (SnakeKeylogger)", "value": "23f065a4a715fc48123b1fa6623be58c9524dac66c2e91cd5db71b54fcacaeb9d28a700261fdc96474e55ac9a0a3ba60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929005, "uuid": "2c4536fd-e0c7-4995-a5b4-c4787bbef409", "value": "T1D3F45D243AFF5019B1B3EF696EE47596CE6FBA733B06945D1060038A0723E41DDD1A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929005, "uuid": "0155a2a7-c6a5-41d2-9e8e-ad9859a0e2e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929005, "uuid": "cbc7a286-8e4f-4382-a2d8-2829916290ee", "value": "12288:HKIUgr0oFGV/nMA1uSxiq0WhBw8rYddwT9Lkcr3ZIFY4PA5qhtmQQzQzM6Wgimk7:HKIwfTF049KPmTK6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929005, "uuid": "d74945eb-298b-420c-8b4b-6c6b36aa260c", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929005, "uuid": "28113a40-4fbf-4eb9-947d-165bf0882544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929005, "uuid": "d634ad23-402b-433b-838c-20e835ecc938", "value": "Statement of Account SOA002920_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4e4ab2-a854-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675931472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931472, "uuid": "429ae877-febb-4366-aa44-a20391bc0024", "comment": "Malware payload (Loki)", "value": "1086aab81143886e9f560384829f7c6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931472, "uuid": "f405c089-79d6-4150-8da7-9750ce6ea68b", "comment": "Malware payload (Loki)", "value": "66c8806ba383d1c3671492bff679e2ee9e5f4d384b5a317a44ff45c4410a1e86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931472, "uuid": "0a2f6b05-1a5f-44c7-b152-c06bc73ba411", "comment": "Malware payload (Loki)", "value": "d9855483093d9a6ed8844c490fb6718437bcbc3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931472, "uuid": "422b29d6-99af-462c-810c-f7c89e8a3d07", "comment": "Malware payload (Loki)", "value": "073efbaefeda53b91320cb65fbd26a22c293031b8141f2640f25accfbe1272aacbfa8f4fa3b0f863737a33a31c0aba4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931472, "uuid": "32d6c924-3e8a-4e44-863e-9d6c77c77955", "value": "T196B47F3D1D7616E2E0B8FB7196E28420B5AC8183330FC95AD9EADBC17F016826DCE55D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931472, "uuid": "d9c7c57b-ae96-4896-bc6b-e495bda436a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931472, "uuid": "c51921cc-d8ae-4b44-8a28-7a4636b3bdaf", "value": "12288:OHOSiPb+HT0qE8S6S7ztLHKNu+A+/1bkYbupzTY0tKGIfpBGrQk2SP8D:Oub8vOztLHKNu+A+/1b9bupzrd8GrQkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675931472, "uuid": "cd96404b-3446-4b8d-831f-a6523dbf1606", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675931472, "uuid": "dce27158-d7f5-4651-a546-c3c1e8501855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931472, "uuid": "17ae6a9d-a78a-412a-98a2-fbf38a096358", "value": "TRANSFER.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f986b8a-a8a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675966857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675966857, "uuid": "fce96e41-7a34-4114-961e-6b923a97f197", "comment": "Malware payload (Amadey)", "value": "8e43c89495f74dde7d08368f02c1c696", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675966857, "uuid": "88150b9d-a614-4a97-9440-09a82efb474e", "comment": "Malware payload (Amadey)", "value": "66ccd0ba26f91eac6dc6b56d01eb18d268adbb28fb9a8305e1e49182daf2d0b8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675966857, "uuid": "18512104-e2ef-4a02-8e19-4f5927e34c39", "comment": "Malware payload (Amadey)", "value": "df85be25bb981265c7a82f4118ca1ee2baa204fb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675966857, "uuid": "95cffbf7-ac2e-43b3-a434-3c0d07ebcfbd", "comment": "Malware payload (Amadey)", "value": "391d91c75db413773a1f84a3228ed0970f5ce7e76d4ffffb451b73701677ee5d8fe81c0acd28420dfe7105b2458482ae", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675966857, "uuid": "b331c161-c555-4450-89ff-82356046ce9e", "value": "T19BB40247E6FD4022E875177058F707D30A32BDA29B78929B264B6C5E1C722B4B23177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675966857, "uuid": "ed6193e2-2661-4fa3-bafc-cd4309c194b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675966857, "uuid": "b4bcf239-a1b0-42c2-ab7b-44f1536079b7", "value": "12288:gMrWy90coufepYyV+9FoVt/a3xrauTTcUjw9XBoVA:GyD2pfV2Fc83xraxcCGVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675966857, "uuid": "39ac28b9-4546-46d5-926f-42f97456d8cc", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675966857, "uuid": "38531ba0-2f46-41d7-9d35-c8efabf7c3b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675966857, "uuid": "0b855113-ac78-41a9-aee7-edb00035f1ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffdd1fe3-a8d3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675986400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986400, "uuid": "af398814-1157-458c-a0ed-590b845e5ab9", "comment": "Malware payload", "value": "c05f4e44e927c3d2365420273c74b7e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986400, "uuid": "519c5fc0-ee2f-4114-91bb-03478e1467c8", "comment": "Malware payload", "value": "66dceebb43ee22e5deb6e342ffb6c5010148d3e0bbff159d0df811fcac097034", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986400, "uuid": "d2cdf11b-f366-4eea-8513-916585be6caa", "comment": "Malware payload", "value": "55fc4da3e0121fbc070a5c6f9f04dc76a0f30cc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986400, "uuid": "8cbe7fab-09a1-4b37-ac98-ed7d54358f1d", "comment": "Malware payload", "value": "4cf63665309652ef31ff4ff02cd0562a35862984d8eb3b0dd6b57279c8a138ac334c8aedde094bb5c7960ee3b63392e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986400, "uuid": "4a9a932b-5382-4134-a990-79237cf6a3a1", "value": "T1B514D01272D0D432D032B6319D29F6F17A7DB9314E386AA773482A3F5EB02E0D676346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986400, "uuid": "7447d137-0913-45d9-b6e7-8a7e9d0889b3", "value": "3cde11de1ae6a53187494063cc0a2730", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986400, "uuid": "246b33d6-7430-4652-a92e-bde241988174", "value": "6144:VF3XdBRC2ZBjvWDhHDG8zxgeotaSTUdWVKg9oz:VF3NbCsTWDhBzx1rKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675986400, "uuid": "59d66e7f-70bb-45bf-b1ba-8e02b6d635cc", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675986400, "uuid": "b6f52a4a-81a2-40f2-b1e1-8fd91d92acd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986400, "uuid": "af28eaeb-153f-4ac6-9201-056ce714f7ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99fa1ea8-a8ad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675969908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969908, "uuid": "feca36d7-7fb2-46f2-b401-da110269a802", "comment": "Malware payload", "value": "97b4147e99f1a804839123d5e249e03f", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969908, "uuid": "93c30368-a8fc-4d73-838c-995cc0849b08", "comment": "Malware payload", "value": "66eeb341c2b1fcbaf98322cbab4f0945804f63fe1e73b2d8b9c3217ac045c9f8", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969908, "uuid": "7ac8c6a0-ffbb-4a0e-ae1b-282ad872b483", "comment": "Malware payload", "value": "4802a74389eb8744920a41b03987a1b4a6f21cc0", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969908, "uuid": "f4810990-8952-4838-a3d3-ed04741ba9d8", "comment": "Malware payload", "value": "f51b9b8b0f0ef1f346f8e47b58c34a0ec9f2a5e9985c48ae588b14aa598656aac45d9a1a64ed7f6458e41a582c80f657", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969908, "uuid": "9662a913-0b77-4fe9-bd90-a3a7219f763e", "value": "T1DAE16DDEAECBA01B471762E66DA23D0CBF212670D8904024BFB4E78EA335B1351405AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969908, "uuid": "20256a42-8a21-48ed-82c8-c78fa7513fa5", "value": "96:SPDBVGNEbJPl0EJjAr3BZE5S4dwatCu2WJ3f2Wgw9RKUzVj5q4NaM+12AVoolFn1:SrBZFF6r/TC0u2W37V5q0aM0wqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675969908, "uuid": "675edb33-be10-400b-85e7-4ef9aae7c480", "value": 7211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675969908, "uuid": "84bfd82a-6e7c-49d8-9704-e2ea605e1cf9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969908, "uuid": "2251adf3-20ac-43c1-8e98-6f6492288633", "value": "Agenzia_E1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201dd157-a8b3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675972280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972280, "uuid": "19b83e74-16ce-433a-a44a-198f672c3f51", "comment": "Malware payload", "value": "16499424f1c37c1f3c6c62be4ac35fbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972280, "uuid": "30906b58-974f-489f-aae4-2aa943e6f0cb", "comment": "Malware payload", "value": "670f6ecd6b0d21395476f2e2127575c406df7bdd11626b5d39ea76f70df28925", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972280, "uuid": "39f59a4d-1874-4dfe-9543-fe894463a9c3", "comment": "Malware payload", "value": "dbd2e1228bd22ab566e89a478964bedb5ce5d555", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972280, "uuid": "db21bb30-2072-48bb-bb41-41e56ab28dfc", "comment": "Malware payload", "value": "ab05e9977974357f5e5b71a916db0baebb217044c9a485a506861c793f4d56020a100a13429f5295166112ed9950a5b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972280, "uuid": "37abafc4-8b8a-42c4-84ad-441bcfb87793", "value": "T1F9B40213EBEC8433E8B5677018F703C31A3A7DA05774839B274EAD1A15726A4B63176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972280, "uuid": "84e44a7b-34b4-4295-9651-4c1c66e487c1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972280, "uuid": "76c5d4d4-7105-4a51-ae81-296b43987d14", "value": "12288:nMrVy908rGe/JhOFG1Ye3es2EFIj8qSf:OyFh7OFGCe3es280m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675972280, "uuid": "8ba9a4df-c359-458d-95c5-b0ab6d5a5129", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675972280, "uuid": "5d4665d7-069c-445f-99fa-2c90139d3a48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972280, "uuid": "f4e5a73c-8229-425b-a190-a3076dca9f63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7160f7ab-a86a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675941064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675941064, "uuid": "4f95d7dd-3613-4265-be90-f26d108a6d14", "comment": "Malware payload (GuLoader)", "value": "41d9981648be3816b84e3a33237ab4e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675941064, "uuid": "80855903-f3dc-4084-b9f9-c9b8a1d08a2d", "comment": "Malware payload (GuLoader)", "value": "6781afb787c35eeceb10518ad4c41ed8028c28c03f1cec8a0fc01008c7bb6579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675941064, "uuid": "f5007d57-e169-44de-97c3-55d36f81f7c3", "comment": "Malware payload (GuLoader)", "value": "dc3ddd821f5b05e5e3b8ea7eaef0359a39860f7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675941064, "uuid": "b528ccaa-9823-47f8-9cf6-d10107d656c1", "comment": "Malware payload (GuLoader)", "value": "c63456df8e2d95880a2e9cc08846523c1285dd61487a0c38c1a0979ff70384421efd4b069c0684c158ce6a16440db9c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675941064, "uuid": "4bacf616-382b-49d3-b46e-af869c753619", "value": "T134C412C5B58481E7E94BB830C4639C1147333E329BE20BDF26B437A69573272A757A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675941064, "uuid": "84b9a3d0-b683-4969-9dc3-b1c2ca92f3b0", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675941064, "uuid": "d228276e-0420-4c7d-bb12-5056dedf22e9", "value": "12288:IzKFNn75e95/LZpClnmimIbQDfCybqwyIE4ds4QGCs:mIn75eX+lmimaQDfCybqwyIESs4QGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675941064, "uuid": "9e45d0a8-d3e5-4927-9c23-15bb6caf9a9e", "value": 597320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675941064, "uuid": "ad6c91fd-27d1-494c-9beb-1678bd6b55e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675941064, "uuid": "37ce44f7-736d-4f6d-ad5a-c9f110b7ca46", "value": "MONDEOX_118302.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3bc16e-a83f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675922670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922670, "uuid": "1138a260-8d37-443c-92ff-3aca8bf23040", "comment": "Malware payload", "value": "e77ac4b7553b4f5e5f8aa2a8c658f7d5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922670, "uuid": "de0b3b9c-8b42-4054-93f2-8a76c77432e7", "comment": "Malware payload", "value": "67c61f649ec276eb57fcfe70dbd6e33b4c05440ee10356a3ef10fad9d0e224ef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922670, "uuid": "0903d528-b2d7-4af0-85a2-27fdc1320fe5", "comment": "Malware payload", "value": "b0ef99434b34c87db0dbc07efa58b250ae48fc03", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922670, "uuid": "e7057a12-e1ce-4c79-81ad-96d1ff002425", "comment": "Malware payload", "value": "38be19e5e5138dcf13d5f3db1005df85ff862174f8c1a6d28a5279e6eed6c5479c08a4759d078a2a37c417e953299569", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922670, "uuid": "fed14080-abfe-47e3-a803-600fdd619c63", "value": "T14FE39D83F9D1D6F1D47E2A79847A93500B3F2A109F16CCE7239912641F660D26F72B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922670, "uuid": "66735ffd-75ca-444a-a41f-6fa7a14a9869", "value": "6652f1a4d5005cb50ad0e122c1bd7ba8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922670, "uuid": "7d3e0a9e-449b-404b-931d-e30e2b01a712", "value": "3072:8uZ6hcvJTZ9oVFBfnIyht8vPs1XQHBC92ePuH:dTN4HBnI2t8vPLu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675922670, "uuid": "1ee3b2c3-e1e0-4a5c-8d96-68913016f152", "value": 145276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675922670, "uuid": "cbdc8998-0d57-4ffc-a093-f7f44b5374bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922670, "uuid": "a1850403-ce83-455a-b670-ef08584c7c32", "value": "00.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5686beda-a880-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675950467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950467, "uuid": "77a574f7-6904-4092-8953-4156f3436495", "comment": "Malware payload (RedLineStealer)", "value": "f1d9bd1d8f4c2932a917233165c8bde9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950467, "uuid": "a9546155-fc75-4cc9-bb46-3ae94159aaf0", "comment": "Malware payload (RedLineStealer)", "value": "680519f8a1fb07b0c5d9e7479b69814522c8018281db3782cdbc53c68730e4c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950467, "uuid": "da54325a-fa6c-499c-b14c-9384abe84531", "comment": "Malware payload (RedLineStealer)", "value": "a6488817ce9a198155a83f8a0d0b3c699cbcae70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950467, "uuid": "3a45ec7a-be78-479a-a04f-3a16914e077d", "comment": "Malware payload (RedLineStealer)", "value": "de37f726746c231131c959020b4cfd60db15f92e4f0b4a22ee4a5e3a47762767e4648bc506fcea48b5711c7a8612ef76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950467, "uuid": "c7a948fe-c253-4164-9977-eb9932561164", "value": "T11DB4020BE7EC8026E8B5173059F603D30A367D615B3843AA274FAD5A1D336A4E77136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950467, "uuid": "257dce34-f3a9-4ad5-bf88-ee7cc42747f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950467, "uuid": "c51b24e7-1d03-42d5-a57f-2da6213fd349", "value": "12288:wMrcy90P0TAOg0Z6sLmxyLYbWmhHe7FVNFF7r9j+XT:8yDZ+syCYbWmH0FJOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675950467, "uuid": "f8cdd47f-d22e-423e-8e2a-251a43899303", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675950467, "uuid": "def6d5bc-d0b5-4fd8-8016-b86d7d99d50c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950467, "uuid": "f839adeb-9d07-4e90-883f-4ff45013b75a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e8d200-a810-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675902443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902443, "uuid": "11788998-d0bc-4fe2-8c1a-3a3caf5ca62a", "comment": "Malware payload (Gafgyt)", "value": "66d4ac8af86caeb43daf77d5d4f01ed5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902443, "uuid": "cced67a6-2780-41c0-ac1f-1cfe24185030", "comment": "Malware payload (Gafgyt)", "value": "6809cd3097cafa2c01e393b03098ef771ce6f096318c0bc7c6c8618595e6ddb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902443, "uuid": "08cbfec9-a600-44f4-a3f9-62a32c9a93fe", "comment": "Malware payload (Gafgyt)", "value": "c8c06e1bc3000ebf5011215917dd90fe537b6a78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902443, "uuid": "bffac2e2-dcd3-401d-8064-c739a596cc43", "comment": "Malware payload (Gafgyt)", "value": "af22777cdeac19d8213e2ec52689b05a950bf02f93c4e6cc2604276bf18073e38bb598e85c9f98cb783c5a9611091ce0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902443, "uuid": "0ddddfa3-64bd-453a-bd49-bdb8021ce410", "value": "T11DF33A09F6408B57C1D2277AEA8F424A33339B94A3D733155A38ABF43FC2B995D32915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902443, "uuid": "5ac22516-9074-4ffd-9013-c245fa656e2d", "value": "3072:Bi3eg/SaaOfhANbakAslSo9unH5EM/9xEZomgwZBxPQgVa:xg/SatfmNbaEz9unHqM/92omgwZBxIgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902443, "uuid": "d808db74-c86a-44a3-a682-246e4e1bed83", "value": 161376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902443, "uuid": "c6afae1a-9df2-48be-a537-a20c0485e0c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902443, "uuid": "396fdb37-f5a4-4ea8-98b8-5e816e7129f9", "value": "66d4ac8af86caeb43daf77d5d4f01ed5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c568da2-a855-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675931901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931901, "uuid": "87bbb3e1-40c6-4cfc-a679-5845c9faeed5", "comment": "Malware payload (Amadey)", "value": "94d21df9aa177392e50ad3864d3ab033", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931901, "uuid": "e582b58d-372c-46ca-8a52-758a2f909c6b", "comment": "Malware payload (Amadey)", "value": "69506c123ba9749ee121f36019c20ba673fe72f701790af76ef0e1648d968cbb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931901, "uuid": "89e61db6-4db3-41bb-a3b7-eb20f3321b62", "comment": "Malware payload (Amadey)", "value": "df10187df7abaaf081ab516d2dc5cfa06ef7ff86", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931901, "uuid": "8ea48685-1ea5-4c53-850f-fd63af5259f0", "comment": "Malware payload (Amadey)", "value": "a1c15e3cea1a4d9d7e66b9235ddb331aa5f65ea2c2aee19f356d86ef61d89831df2db9b15d5481d033fc8813ab160056", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931901, "uuid": "62dd1318-c073-4dce-ac21-4c38a4db800c", "value": "T1DDB40247E7EC8031E8B45B7119F707D3193ABDA15A38825A238E685E0C73670B77636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931901, "uuid": "ed86dab8-38c6-4b57-bac3-59d0390db4e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931901, "uuid": "84652170-b682-4d64-a780-d2e1fb3ca09b", "value": "12288:OMroy90bRQ6pfSVKGqd5gyVeF6hSQulT5FD5Ymf:qy6W06VwdSybuB5Vumf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675931901, "uuid": "745cf3e1-d0a9-4179-afdb-c825df43f785", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675931901, "uuid": "5adbcfe1-982f-4fe8-aef0-7d925f8ecd4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931901, "uuid": "bbd9c75f-005b-44d7-bdaa-21c33f3a0d88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba19bce-a898-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675960891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960891, "uuid": "6c21e766-ce29-4a9a-ac11-966cccae77de", "comment": "Malware payload", "value": "f8c7d533e566557eb19e6a89f910ab6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960891, "uuid": "925888c4-5b82-4c2d-b325-9a43f62e6534", "comment": "Malware payload", "value": "697949b98fd6207152522f27bcfea3716c336a8cab81751738eda59fd6067dee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960891, "uuid": "4f5cf5de-f681-4517-a198-e4894210b0f3", "comment": "Malware payload", "value": "a225ef1c22fcd29562bd5f8a2d0da3969a5393cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960891, "uuid": "b080b81a-7e99-43ca-bda2-9a3a6346d6ea", "comment": "Malware payload", "value": "fce237227e90c7cff2acf9ee9009e578ab7e2da89f862e7aee5ddebec4e9b2228337b365ea865c8942b0f37b43313dcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960891, "uuid": "6032f3cf-0805-4a28-8698-627849982cdd", "value": "T19104C33B0162C05EE5843638D051DFFB32A9ED111482B5C772C67EABB929B8DCEF2654", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960891, "uuid": "7a7b588d-ca90-4cb7-97bf-f4d91b38187c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960891, "uuid": "47c854dc-06b5-4dd1-a75a-6a36fd6d6ed5", "value": "3072:+aU3o2140NKteqz0d6EPMGz9tEsyyyyyhxxxxi+ElqRKbCG:vU3LTNgeqk6EP/pIxxxxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675960891, "uuid": "27c5a1c5-fc6c-4bc1-ae13-784dfe5f79de", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675960891, "uuid": "a93df1a1-dde9-4bde-9a19-faf8128af482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960891, "uuid": "db988c82-8fd9-4218-adeb-46243030e005", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0d6f33-a858-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675933302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933302, "uuid": "0dc30368-5183-49d0-917d-2a67c9a21165", "comment": "Malware payload (GuLoader)", "value": "9adca127115cabf8ffa2838d9296d08d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933302, "uuid": "dc635808-f961-48c4-86b3-7b9bffdf2985", "comment": "Malware payload (GuLoader)", "value": "6a16d99022c9a96f02261d54ce60238518db326045ba46842d3785849120b277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933302, "uuid": "3751eaf4-159c-46f1-99b6-028211ecc45e", "comment": "Malware payload (GuLoader)", "value": "d695770172fdcb45bbce08d4fa1578ce0286923e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933302, "uuid": "a9c2e0ba-c343-4226-a54b-d3e78887ff45", "comment": "Malware payload (GuLoader)", "value": "e6434ea5dee61d58326a8b6a2a61d530959d6f6fa58527f1e3501b478ba8968cbeca99ceb10e85e24fc156e0193c3a97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933302, "uuid": "70e0e26a-5236-4d8e-a4f5-579a382e442b", "value": "T180D4F268FB10E80BD65A0B380C49D6695920BE403C64D663B7E37FAF7F7A1C3B915186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933302, "uuid": "a0d914bc-8177-48aa-bd9e-493d3a7cc7dc", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933302, "uuid": "811de1ee-29a6-42da-8b01-4d9665e5973a", "value": "12288:rbif/mHZzu6uhuQgRN6Zuj90Z2upnD6/gIfMacI2TVSxjK5XtHMbtbSp:/if/mHZzutuQgHt90TnD6/gIb2o0MZbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675933302, "uuid": "69a2febb-6584-49a0-ad3c-30ae3ce78987", "value": 607872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675933302, "uuid": "4ca11ab6-1b3e-4b7a-a47a-8663502e0036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933302, "uuid": "6e2c7bce-5eea-4933-a204-4b36bf61df60", "value": "Pneumographic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ad9bf8-a816-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675904800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904800, "uuid": "48fc8111-1375-47b1-a493-642ddec9adcb", "comment": "Malware payload (Mirai)", "value": "881071164109760d76d605c7c42537c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904800, "uuid": "400fb2e0-276d-4400-8a6e-2b77718ab29d", "comment": "Malware payload (Mirai)", "value": "6a41f22a66b6de01d5d8026c14b33accac64be14863341efeb4439876f5e417c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904800, "uuid": "d1b7235b-5710-42bf-ab8d-43f1a794d1c6", "comment": "Malware payload (Mirai)", "value": "fe1048eea6f721254f08c353c3283085bfeb2720", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904800, "uuid": "9acad180-b7ec-4da3-a4ff-ea3c8990b45b", "comment": "Malware payload (Mirai)", "value": "1f1a965eb8400c232e262fcaaffa8740727de51621038e6696783b730bdcb3b1c03dd4dad75e0bded76de6c5a0cd2547", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904800, "uuid": "6efc1d3e-f1e9-4663-9439-7a7720b35e8f", "value": "T1F6833A82F54381F1E8130479101BB77BEB32DBA6446BA1A3EB5B9D61DD239421217FCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904800, "uuid": "3255b4c3-f3e1-437b-998c-3638008d1e85", "value": "1536:JQM+JXRAcZVtphqdE/rFJtqWnER6dLc+H+431SF7IlvlPC:JQMehA6pmgrFJRER6dLcg+43g6nC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675904800, "uuid": "eb6c118d-b196-4356-8ec9-510a8efe0345", "value": 88076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675904800, "uuid": "b6a8360d-bbf6-43af-af95-007a56ed01f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904800, "uuid": "13ac32fc-25cc-437a-a8ba-c1215b591040", "value": "881071164109760d76d605c7c42537c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264da712-a83a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675920322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920322, "uuid": "61848392-8bec-4b8d-8afd-6fd0c53ef808", "comment": "Malware payload", "value": "ae4d62453efae010e631c0ab3a0d32a3", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920322, "uuid": "630e17f4-cdd5-4e0b-b35a-0dc5f463cb7c", "comment": "Malware payload", "value": "6a4fcd114e716464f67b36f3cc68d4eb21c1b17e7fb234eedb11f67c61877cfe", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920322, "uuid": "2cd5416e-2f84-4343-aacd-dc69a6cec991", "comment": "Malware payload", "value": "ecede3cf9f83ed504022cf5f1d09b5d38a9c85a5", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920322, "uuid": "77c7d0f4-ea7b-4850-b8c7-bb76547a710f", "comment": "Malware payload", "value": "1bed30bdfa60d7e9bafbed5a668072ccf5c65e26c3eae62db74d368d21d335380c4bd7973d7b6d23cc5156ee83a4cd54", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920322, "uuid": "c1d85e7e-0b60-4bcd-bd99-1922d9e1e01c", "value": "T1A4340282AFC48D86EFE395B81859EB21642FB273B35E93EFCD16145D2850634C8D0D9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920322, "uuid": "455bd8e4-230f-45ac-a73b-852fb9a5238e", "value": "3072:ebAVfBWQdmUeG33ovY8bhTh45mtE+BjJSoi+CkfssssssssssssssssssssssFRf:qAVfBAa33ovYY4Uutuw/fwSDlD47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675920322, "uuid": "e6b93aef-2a83-4e11-b8c1-d6601f9ffc94", "value": 246237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675920322, "uuid": "68788b5a-03ad-44c7-8afc-a6f72f9f93e0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920322, "uuid": "b2f55544-8467-4e15-95b7-155772f0849e", "value": "DocumentsFolder_429951_Feb_03.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820c5a8b-a85a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675934220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934220, "uuid": "1a98449e-89f8-496c-bf00-49542ab9ab26", "comment": "Malware payload (AgentTesla)", "value": "d857a5a515e5221f28ff63a350a56358", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934220, "uuid": "e56d3ddb-b03d-492c-968a-b72cc3f012ed", "comment": "Malware payload (AgentTesla)", "value": "6ac8d00d9effe1d0d2959a343a1a2216c467c24011f56d6a438983efe5e3432c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934220, "uuid": "5006c4e7-2305-4c1b-9a6c-6048706da918", "comment": "Malware payload (AgentTesla)", "value": "138129e241cd6d40386a5e31ab156e21c16ae5e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934220, "uuid": "7f1620d0-3f72-4a03-9fb2-88aec0cc8cae", "comment": "Malware payload (AgentTesla)", "value": "2c794686b331aa0dbc62e3eecf78ecdb1cb62955e09ae6b87daf65fb8c35066e92ff096210251727783c9da78ade7048", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934220, "uuid": "8112fa2e-900e-494a-bca8-53aa3d7c6a42", "value": "T193228E2DC510EC36C322057DD12842F4F31C10AAAA95BA5D1985F29D4BE06C353DA6E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934220, "uuid": "99a0d2cb-03f1-4de7-b3f1-9f2427e3b452", "value": "192:ScIMmtP5hG/b7XN+eOihO+5+5F7Jar/YEChI3ON:SPXRE7XtOih7wtar/YECOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675934220, "uuid": "6c1f9e8a-3350-4992-823c-3feb86bec2b1", "value": 10353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675934220, "uuid": "cb6786bb-ddc0-4b7a-ab68-46cee7299b60", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934220, "uuid": "a7828062-7708-43c2-ac7c-0e37a5b70446", "value": "RFQ 213.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1981d4f4-a856-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675932326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932326, "uuid": "acf39b01-ed72-4fb8-a667-c03ac22ecafc", "comment": "Malware payload (NanoCore)", "value": "c0b68c419222b718fcf6bb0545b99ab5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932326, "uuid": "871e35e8-ae47-4338-9f08-567afd1cb52f", "comment": "Malware payload (NanoCore)", "value": "6ad4933f47bc34c1cd1fa74eb2b63d0f89cff9cf43b2d7311fdc60cb3723dd37", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932326, "uuid": "d9368fb1-9259-45cd-93e6-42db2ac05925", "comment": "Malware payload (NanoCore)", "value": "d1dc3eadd56d1fa6d97a773be15754df10dd89d3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932326, "uuid": "263d613f-a844-470e-acdf-7590c904aa31", "comment": "Malware payload (NanoCore)", "value": "b4c76089d51e11e70b46a45002bff7cf17d7c82359b44c3dd755506a04b81b6327ecf4b87ad76f3cb3c9ac9f06d8451e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932326, "uuid": "c65b29ed-2b2d-4e57-84b7-17c635f1b340", "value": "T1C475AFF876047DE6267F576BDA96ACDC03B6266399CBA4CC8064B7C305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932326, "uuid": "91862958-70d1-4e34-8adc-0852fbf80b85", "value": "24576:bnaHdSFtlCpanTqeLtO3DjRMp/wJCc8EEqQ6VRdCTX+DGF+aEUYait4cD7U76yA5:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675932326, "uuid": "366beee1-74b8-4ac7-8bf6-9c7f2389c365", "value": 1617831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675932326, "uuid": "0f4bfe08-bef0-4754-878d-09204f41ed8d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932326, "uuid": "47bae605-9c8d-482e-b55e-67550231e0ff", "value": "Price Request No.15 09-02-2023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3028a5-a813-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675903690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903690, "uuid": "8447122e-8f94-4b49-a836-1b2300aadfb9", "comment": "Malware payload (Amadey)", "value": "84047de7d483d2468a6072811966b680", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903690, "uuid": "49fcb41a-db50-4a8f-8c60-e8b5c98b92d2", "comment": "Malware payload (Amadey)", "value": "6b177ebca9bfa8902b2fd7b46c67f93360b9412d003c200b8be66d27f7a6e9ec", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903690, "uuid": "ff8a3161-88b2-481b-99d9-0725def3c97e", "comment": "Malware payload (Amadey)", "value": "c154465416713ab126cf33448a184415eca89d08", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903690, "uuid": "a268ce5e-dd92-4513-8188-bc1263f3a546", "comment": "Malware payload (Amadey)", "value": "153953417cced01e8a8a1cc6f08d331d6bce33a0bad18f8abea644645b04a5e33f868eb11cef0ac18670a8510e829bcc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903690, "uuid": "aae5d584-1ef1-4fa1-8538-3c8578b5e997", "value": "T1A5C4024BF7EC4132E8B117B05AFA03C306327DA15B398667364E5D7A0CB26A0A57177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903690, "uuid": "0e142e8e-2fcd-435c-ac6a-4cc40475626f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903690, "uuid": "cc4e2ee7-3579-48c0-8400-4393db88e0a9", "value": "12288:+MrSy90WDAfTIk96AYsmnKf2Lt8zQ8jVdMJcNTar2XEv2sv:EyRDAfTG+4tEndMJcNTaaM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675903690, "uuid": "b3988447-842e-4107-9284-2b9c3966340c", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675903690, "uuid": "368cce18-32c1-4cb2-bc9e-99d304dddfd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903690, "uuid": "08f66654-3075-49bd-b3c1-1513e357111f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7996f074-a82f-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675915737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915737, "uuid": "f760bda0-2ea5-47cd-81ca-ba07e74749d1", "comment": "Malware payload (CoinMiner)", "value": "70172ce32af36f58aff5fb56c535ae04", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915737, "uuid": "432ac531-0a2c-4948-a660-a61f04f90165", "comment": "Malware payload (CoinMiner)", "value": "6b53be310650aded4526b12df038853dde1a8a90b32508430b641a0209f23649", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915737, "uuid": "659e8f50-7c55-48f0-ac1c-b379e8e328f3", "comment": "Malware payload (CoinMiner)", "value": "a013c9b8f3791770fc9594d3c823472cd9b80d99", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915737, "uuid": "479b4c02-df91-4503-ba4c-0b258a0fbdd0", "comment": "Malware payload (CoinMiner)", "value": "f34462f9eb39fc8b520994537e86109e3140ff1acd09ccfdcf777ea1c750594798de6baab394bc44e57ac406bdd73441", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915737, "uuid": "fcaf29e9-3c9b-45f3-aff4-afac8f07158f", "value": "T1C1642A4393E17D80E92A8FF2DE1EE6E8765EF5408F4BB77552189B1B30B11B2C563A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915737, "uuid": "3cb54b74-cb56-4e96-80c3-1b64a4d05737", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915737, "uuid": "a54f150b-f789-4ca4-9fe5-1c7ffaa1b822", "value": "3072:YPEUMPTWPRdbF4gGeAHy2ga1hLM0fO4ZOI8c9W48CQENe+pGSQVsuz3:YMUMLAbbyVTOI8c9W4FQkeQGS6s2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675915737, "uuid": "9f3062bf-2419-47c7-83c8-eee4aaa68796", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675915737, "uuid": "99192a7d-175a-429e-a11a-d64ad05a6ae6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915737, "uuid": "2ffa99f2-9d77-4dbf-ae7e-90a0f04b4d47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90051432-a866-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675939397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939397, "uuid": "698e8259-6e9a-4bd1-8139-eb88ffa3a333", "comment": "Malware payload (Formbook)", "value": "e761e8b3646ccc084ed533c407671083", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939397, "uuid": "3f6a4e25-fe80-43b0-b6f8-09d3bc67222d", "comment": "Malware payload (Formbook)", "value": "6b60dd70bf55a384960f59186c966024419c766d6f973013849bbfd56ece32e0", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939397, "uuid": "b13bf80d-ccf5-4628-9a16-27285e5df6d5", "comment": "Malware payload (Formbook)", "value": "002f76096f7e26c53fcebc362a9d4ec93de90fac", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939397, "uuid": "c5562998-05f1-4832-9fe1-ddc2d34cecf3", "comment": "Malware payload (Formbook)", "value": "59dc0a664b358be72afb4623aa04c98edfd1ece771d88c1555a4058bdda7755eb8a435087c4032af901e10a902987cd8", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939397, "uuid": "da26596e-daef-4176-9ca5-5a83f64c10a4", "value": "T1F8E4231635B919F83C6809CB1655190C35AAFFD8F8D26CFB7678C33772C2598EA38864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939397, "uuid": "461e7a12-c7a8-4bd2-8065-bd5610832a66", "value": "12288:NH+aK7ugfoHfPuQyTqVONH+B7yPYLr+o9J1CfOIQ8mZjoV2B/hSsvRaOU16e4:NHADCycONH+B7sgr+o9+Q8mZ0gBEsvIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675939397, "uuid": "bc537c82-6f70-479e-8011-381422e4e11d", "value": 712371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675939397, "uuid": "2bc50bc9-7875-45f1-b233-56add2b70161", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939397, "uuid": "e2e05264-b4f5-46cb-b472-41e2f1d933f8", "value": "ORDER-ZWL 0736449574 ZWL0106245448.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce50d884-a816-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675905142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905142, "uuid": "7914b15d-ffdc-48ab-9d12-a25cac11fad1", "comment": "Malware payload (Amadey)", "value": "4aa514cd2b12af0caeae907bc18b830e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905142, "uuid": "1bf1176f-0588-4842-9f64-59da0a10a3cc", "comment": "Malware payload (Amadey)", "value": "6ba8418a26b0b0c33af552ba80ba182650379147d35a753dfb358d82e2ccebea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905142, "uuid": "27fbdcb5-d51e-4d7f-9e84-8d87707623f8", "comment": "Malware payload (Amadey)", "value": "547c2d758f3fa6219cf48f289af06d7df3f6cb25", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905142, "uuid": "205919a0-5ff5-481a-b6a8-b2545d33f741", "comment": "Malware payload (Amadey)", "value": "32e73147df2fe7523522a8608ec82ae87092389204f3b1e00b5f383b3ee416d7c7049e118ccf148e411602eef7fd8990", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905142, "uuid": "0e26ed4a-f06c-4a27-8436-d495a421fbd3", "value": "T1C3C41247BBEC8073E8F0577089FA03C306327E755B38879B678E695918B2690A53537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905142, "uuid": "2ee946ad-a59d-4c8f-9aa0-077898299cee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905142, "uuid": "d74f8f80-5a78-483d-806f-12cc6429f94a", "value": "12288:OMrhy90bAQvAP5XhqsEnf2xt8tQ8jVd7JcdWcZsIw8/7:PyCghqpmt2nd7JcdWcZX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905142, "uuid": "6fec6adf-2e39-4508-b4f1-ae594ba2ba11", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905142, "uuid": "b1f194b3-9d2f-4034-8448-bc30798be0f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905142, "uuid": "79015de4-0026-4cfd-9892-a2b465408f4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a4454a0-a85a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675934260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934260, "uuid": "245f326d-bbb9-4032-80f0-85aa6ad3e38d", "comment": "Malware payload (AgentTesla)", "value": "7d75fc0dec90f41e388c904d92750905", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934260, "uuid": "ab5f3059-4a44-44dd-9135-8486ed968a89", "comment": "Malware payload (AgentTesla)", "value": "6bf19b47e17a3856e31e384b6aa304346e151f2c41385d01da5834a751fae776", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934260, "uuid": "b46847a7-279b-47d5-9d78-71a01d5471cd", "comment": "Malware payload (AgentTesla)", "value": "ca4e7bb6af3d9328dfb66d9f4fcd6c46ef4e2677", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934260, "uuid": "7a706cf0-aef7-4551-b2c1-3dda83af5c15", "comment": "Malware payload (AgentTesla)", "value": "3cbdf81b34b27ed30230937424ae0a407299ca1e7bb19696f404564b7afe1c7a457795a4b9f6dc28f0b847531ccee2b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934260, "uuid": "579ecb63-6a55-4ce6-900b-c69c62b983b3", "value": "T1A7522B6062DC5523F8BE6FB98CFA9100577CB6D37C23DB6E21C5518EAD827410991B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934260, "uuid": "39fc4e72-27eb-46b1-a17e-ebddd86a0049", "value": "384:kYVYVMIM/F1tIbE31qCTzZK4v6wzbaZv:rYVtM/NIQqCTzB6SbSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675934260, "uuid": "63339ed4-2051-44e6-9d1f-2b38c04a97ef", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675934260, "uuid": "8bd931e7-76f8-428c-ba6a-dfa2ae923603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934260, "uuid": "b1ee1fce-afbc-48b6-a6d0-3bb65ce80e72", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0250ed8-a8ad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675969945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969945, "uuid": "bc572241-1cc7-47cf-9bf2-c674d5d0b279", "comment": "Malware payload", "value": "4bddac01f2d7e1146eb5a3904d02a793", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969945, "uuid": "def77fee-09fb-4f82-a848-cc8b9ca22f9f", "comment": "Malware payload", "value": "6bfba9eac78ecc0ee472b7925d97196413bd866182ddd554666851df20d89097", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969945, "uuid": "515b6523-98ba-49c8-93ad-5e506d8fdb5c", "comment": "Malware payload", "value": "cb392677adf8b5450b0411bbf6852acf9b097872", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969945, "uuid": "c575f0a5-6b1e-44aa-a659-a14bc8293d2f", "comment": "Malware payload", "value": "1b78497b328389939e16e3fb8e57502dc1b16bb399b251a0817b5d9b6892c98ba22cc9cf72525add660cf0ba6e7610c3", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969945, "uuid": "392a67df-65e8-485c-b877-0e027464b3a5", "value": "T1F7E15CDEADCB601B571762A57DB23E0CBF222630D8908014BEB4E78EA765B1351416BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969945, "uuid": "5b0ca799-daca-4345-adb1-b32b27fbf322", "value": "96:SPySM1NEbJPl0EJjAr3BZE5S4dwatCu2WJ3f2Wgw9RKUzVj5q4NaM+12AVoolFn1:SVhFF6r/TC0u2W37V5q0aM0wqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675969945, "uuid": "cfad29c9-f73e-444d-b179-d1ce72104f6b", "value": 7132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675969945, "uuid": "39aa82e1-e4d9-49f2-b224-8adf315c9c53", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969945, "uuid": "40bca973-6db6-438e-a0b2-9d891281a56d", "value": "Agenzia_E5.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4245c5-a869-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675940649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940649, "uuid": "0c238334-090c-4210-94f3-3d33d51096cd", "comment": "Malware payload (AveMariaRAT)", "value": "1a6f87a988d2bd49e33f0c53247aa8a0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940649, "uuid": "28fb481d-6d94-4420-8acf-6026ac55fc06", "comment": "Malware payload (AveMariaRAT)", "value": "6c08bec143e6f1474f75b50131897374c9db23c51c15c09457f607136ba02982", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940649, "uuid": "e58eaa1b-918a-48ac-a9d2-9e6c304af62a", "comment": "Malware payload (AveMariaRAT)", "value": "a6ca988a949bf4950ddad7e7ed5406202d690377", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940649, "uuid": "223950de-ff2f-4011-97ad-d58bb0471313", "comment": "Malware payload (AveMariaRAT)", "value": "d485239eef4fcfc9c5959fee3cda963f27da9e18cf4a2fa79eece6396f254bff6eac92f9ae3c72ef59d8357a6795dcb8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940649, "uuid": "2dc8495c-35e5-42b0-8869-3519a6e57c89", "value": "T1C0C42307EA744D918397D2155B8C6062EA8337BB80864DA779CBBBB0D9DC704C825DBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940649, "uuid": "d1e4d2a9-a263-4d8f-8fd6-ca7be29b77b8", "value": "12288:MqABEcbVJ2sERQe0m+78v2oCCSyvrJ8MgS7LVqdEEVS6F:MTBPV8sgQey8v66uqh6EAfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675940649, "uuid": "a7cfbb8c-981f-415d-80db-72a5ed5f9dcc", "value": 563911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675940649, "uuid": "8617a326-5e66-43eb-a863-3a39726678bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940649, "uuid": "f9b1dd56-38db-41ff-a471-c8cb2a413760", "value": "RICHIESTA DI OFFERTA (Universit\u00e0 di Parma) 9-02-23\u00b7pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b9a768-a859-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675933583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933583, "uuid": "b9cacb8e-921f-4e44-a329-a6d82e0ba5e1", "comment": "Malware payload (Amadey)", "value": "f9a9919619467a1190bd1ac47dd4784a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933583, "uuid": "ce22986f-13d1-443b-8079-1b0d792837c3", "comment": "Malware payload (Amadey)", "value": "6c225a58d88af25d9add6c0ae9d8e726c2123020597eae9e150bdff9a192f7f2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933583, "uuid": "486e07d9-4748-424a-8c55-eef8dece5226", "comment": "Malware payload (Amadey)", "value": "a19a4742b7eafea5c9e295c9da51f8d587ee7187", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933583, "uuid": "d6c7535b-db11-462f-a0e4-3d858e00bdca", "comment": "Malware payload (Amadey)", "value": "c36d2f6b530a5fb665da10f4dfdf310d32e452d862291ee0935a8dc521314bab66406a0d06158e24f8ee67975ed06e08", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933583, "uuid": "4dee0817-65c1-4b9c-88c4-fa53ac893e4d", "value": "T1B7B4010BABEC8136EDB157705DF706D30A36BEA05B38434B275A5C5A08B3670A631777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933583, "uuid": "2c61b403-8ddb-413d-b8a8-c0f1650cc224", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933583, "uuid": "faacd1e4-e091-4b25-bb1c-8233ea5eb40d", "value": "12288:gMr5y90r7GQHxnnuTc3oF2nP5oGok+odzkYzq:pym7dRnuzFWRFl+o+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675933583, "uuid": "659cce8a-ba68-4f11-a765-2b3501cd2a24", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675933583, "uuid": "96762ca9-4721-4ab5-8c41-c7e6e8376736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933583, "uuid": "abe39f87-178b-4f12-89ef-ed9ddad98c28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d92e2c9-a850-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675929837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929837, "uuid": "06f72cdf-e23a-4168-be76-3fc6926d9a19", "comment": "Malware payload (Smoke Loader)", "value": "0d5fd71d534788964c05eab2e8b1c996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929837, "uuid": "65e3321f-126f-4210-8e16-106c78e583d9", "comment": "Malware payload (Smoke Loader)", "value": "6cb9d360ce34aa7ea88f72fa666f362c8e5b26fdadcdd94ea99b749830ad3bb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929837, "uuid": "f27b1ee9-2689-4f09-bfdd-18d4337378ff", "comment": "Malware payload (Smoke Loader)", "value": "392b62f82a8c5d8c3eaaa42c8a63c0a28c44691d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929837, "uuid": "0140474b-336f-47b0-8859-b393e76db8be", "comment": "Malware payload (Smoke Loader)", "value": "2d2926c16de93be69c093340e4a15ecdfb1a2f21553a837ac0c5b76d11827d2bc178752a53aad4c2953c12db13493ed2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929837, "uuid": "b1de866a-b072-4227-8254-60320f9f8712", "value": "T11A14D0323AD0C032C5BF50709864DAB5ABFEB83557B4895B77A81BAD9F303D05736286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929837, "uuid": "4be58d19-fa54-4f48-9609-86be8f380523", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929837, "uuid": "8fea4f5c-c78a-4034-aea7-ae82990043ff", "value": "3072:7wqgOMdrvELee1LFz/W2d5A7Bt+jPBoB7kBRwDJB8ei/NiMjgsY:UqgZvbWLt/qtYpoB7kbwQeiVPUsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929837, "uuid": "b1e6b954-70d7-4a79-b753-b0b100e5ae07", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929837, "uuid": "18e55caf-04ba-4c1e-8c2f-3d93ea0e204d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929837, "uuid": "6e5c68e3-c590-4605-9f00-9061fbe042d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632a5ed9-a855-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675932020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932020, "uuid": "2073ec71-c4cd-4d25-8024-f7a70340c286", "comment": "Malware payload (RedLineStealer)", "value": "b544837a56ffae1cde3177ed20ab11f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932020, "uuid": "f8ec364c-e8c2-4195-bc55-daa90ebf3e28", "comment": "Malware payload (RedLineStealer)", "value": "6cbcb3401bc7ddbeebed837c8f8ab68607d658bcac9c95bd9eea1c9424451b28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932020, "uuid": "12990899-b0bc-487a-ae3f-a9c589c73fb5", "comment": "Malware payload (RedLineStealer)", "value": "696f9058bb55210bf463cb3df084ea01e03430a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932020, "uuid": "4b170f76-8bfc-4003-87f7-44af8c6ede2b", "comment": "Malware payload (RedLineStealer)", "value": "576b0a662ea85242360598c90fed0b1a5536b48c949ab1be771689f01a6b3fc25594bb8f368520e9dd5c42d4a5eb3af6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932020, "uuid": "1aee17c4-3b36-4d2f-bac3-eb9e891d3ffd", "value": "T180946C03D2E27C81F9668B76DE1FF7E8778DF5608E6AB7653218DA2B14B0172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932020, "uuid": "b26bce66-9b66-41a6-9647-0b7680d42b88", "value": "bf429ce1bef7a73c16e22bdf4abc3568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932020, "uuid": "07034ba3-f3ea-4a91-98b7-84c746202f31", "value": "6144:g3J1dFYQbXhg6eUtzOI8z7m+CykBKocoHtRmLiq8pYvG:g7AyXhAUtzD8WU0goNk3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675932020, "uuid": "5dd9566f-93dd-4207-9eee-6b6067a08b3d", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675932020, "uuid": "297a92ef-00d5-4622-92a2-498b3ce91964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932020, "uuid": "d3290b2e-906d-4460-9eb6-407ce897de8b", "value": "b544837a56ffae1cde3177ed20ab11f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432e8eaa-a86e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675942704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942704, "uuid": "38c1d5cc-20a2-4501-968a-96facb56cc09", "comment": "Malware payload", "value": "62e7a17e594da56761168f2851f0d7b5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942704, "uuid": "ca4c2a50-a19c-401f-86dd-eb46b67db4a1", "comment": "Malware payload", "value": "6de8ded866b82171fe5e14c4038b523b33a3e75344d8b9178268fea1c4086a30", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942704, "uuid": "19db9bc0-f6c8-48a4-9067-a2c83644163d", "comment": "Malware payload", "value": "34d024d0d9af07f5ee98c031f326ced8e412c8cd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942704, "uuid": "ee3f75c9-f6c6-4f98-8a05-169a64b74013", "comment": "Malware payload", "value": "18ab4681d67f06a091de25b91c43dd3fbfc6d9a25716e67e6525b04b8711436c789ac238ab1c87c7f8ee0602103b03d9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942704, "uuid": "770237cd-d8ec-469b-8987-2a0f958cfa7a", "value": "T1EF35F107F177ED2BDD27C97CE89F108282136C39A954C64D21C2B32F9A32BB0597EA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942704, "uuid": "4def3a2e-f0dc-40ef-b2c9-e5434f4e05a8", "value": "24576:+FehPHZFaL6Fe4uwaqCfAvT8nc6Zb4wr4uNq4:eUP5+6kwrMOT4ctE4yq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675942704, "uuid": "811b106e-370c-4660-94fa-ab44de15b3b0", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675942704, "uuid": "6ee0cfca-50c0-48a6-bf2b-9545268cc9cf", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942704, "uuid": "1c4544c8-8095-425f-9a77-13adcff611d7", "value": "Order6000521351(00010).xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8bf8984-a810-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675902502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902502, "uuid": "93c7837d-504f-4246-a2af-d889dffb7020", "comment": "Malware payload (Gafgyt)", "value": "4fdf6d12fb6d132e3110961fbb22ea78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902502, "uuid": "51ca277f-9576-4c12-9da1-dae27a98e316", "comment": "Malware payload (Gafgyt)", "value": "6dff88853dd2b41dedfbc0ec1d9f6394926ebd4e7f0428b902d777785fa9670d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902502, "uuid": "2aa3e662-2c6b-4176-af8a-990c8fd12600", "comment": "Malware payload (Gafgyt)", "value": "8e1d0f7694896171114b29e3ba5bbdec5ab8a774", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902502, "uuid": "15814b33-7cb8-4730-ad2c-b9f9c8466c0a", "comment": "Malware payload (Gafgyt)", "value": "cb60acde48867fbdd7259a9a73369904e255820292ee508623fa38f5ca504b6afa0989ba0dedcb53940f55de518f40bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902502, "uuid": "cc8581a7-1b59-4137-baa2-66e4ee09c4f6", "value": "T158A31792F801EF76F40BE77604C74B207630BBA20A535622735B79A6AE762D43933F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902502, "uuid": "7b275827-3d45-47a6-8cde-a971f3c76c20", "value": "3072:I/l2/g5q3DC3ZtTz+eURhWpyF4ioe/u7qmu2VMDrY8faJX:I/I/g5q3DC3ZtTz+e3yFAeKqmu2VMDr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902502, "uuid": "29a8b2bc-8e28-47da-8db2-2704ccaa97d3", "value": 100089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902502, "uuid": "3e716194-684e-4342-9363-eee84aa62387", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902502, "uuid": "e06457eb-a752-45cd-b5f4-548810f0716e", "value": "4fdf6d12fb6d132e3110961fbb22ea78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e2e004-a8d2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675985677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675985677, "uuid": "8e2da021-b0ea-4030-9eb4-5de3767da8bf", "comment": "Malware payload", "value": "d8b3ef2a088752b31b31c14f4a1db920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675985677, "uuid": "2df1e8a2-e580-49b6-b72a-4d34100656b8", "comment": "Malware payload", "value": "6e0657ddf2fcec5da4bd3cc825bca67224f0d4ae806742db9d51ebeaa220553c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675985677, "uuid": "b19bcd68-3b36-422e-8c99-4024866a3fba", "comment": "Malware payload", "value": "59682994878cd2edbd6abbd7f6fd989a5a811b67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675985677, "uuid": "c149f67a-2667-491f-91b8-28f0202629e2", "comment": "Malware payload", "value": "a31a953a1629b013d77adb1619bd09d443a1db52901db42215523796417767c9e3b0b6a37fe7235f5cd315013d9e293f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675985677, "uuid": "eb30cac5-dfdf-4f89-bfd0-72910a9906ff", "value": "T19E14C01273D0E872C472F6305929C2F52B6EBA314E7C6AA777582A3F4FB01D09676351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675985677, "uuid": "0b51d0d6-0f53-450f-aedc-bf5470a1fbbe", "value": "3ae714bb16df7ea6110fd4db3c856d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675985677, "uuid": "68e3e7e7-3464-40a0-9773-2872afd4d4eb", "value": "3072:H2b01EuFnpTRe9Ae5cUb1DX37KlRW4VplsJca5tK24DEu9kPO:H2I1tPRoAe5cUb1/KyBK2i9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675985677, "uuid": "3653a641-c8e5-4097-91cd-1763fdbaefc5", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675985677, "uuid": "7c5c75fb-0dc4-4b4c-8c55-3717b48843d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675985677, "uuid": "aeffdeda-7a81-4296-805a-51a8074a0f73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b111a31-a849-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675926772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926772, "uuid": "44576a51-b36a-4332-9b22-19ad53316ae2", "comment": "Malware payload (CoinMiner)", "value": "79f60b309ed0e379c35d931c33e05e7d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926772, "uuid": "50a3dbd9-458d-4926-886e-6b47d44c7fcd", "comment": "Malware payload (CoinMiner)", "value": "6e27a3657b4210d7ff95655fac0866e0230d882946202f87b476b54e0fd9c6f9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926772, "uuid": "fe77cc47-ffaa-43d2-87cd-a026053ce629", "comment": "Malware payload (CoinMiner)", "value": "01b2faa9e1d56cba93710d662a8af79764ae1f8c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926772, "uuid": "504e635c-9b18-4495-9d65-e487728bccc3", "comment": "Malware payload (CoinMiner)", "value": "0539aeb19b2277521189cd177e177b9a8d92de3da929b54082c77e66c12274121604c525d3d85cc5cb6877aed181ab08", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926772, "uuid": "eb23b992-eb38-475c-bb22-a783355048ba", "value": "T17914DF3236C0C07EC56614749874DBB5ABBEBC3146748A1B7BA82BAD4F703D06636357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926772, "uuid": "e25e8990-5322-4899-b72e-2b3ec0f4f459", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926772, "uuid": "d388c70f-9ed2-4d21-9ef0-b37555f2e9ea", "value": "3072:oBqgOakKMSbYQALaDCeWid57nFvtWMTu6sCgk4CP1VV6t1n/k/:CqgaLBLa2e5FvtWMThxZShc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926772, "uuid": "200648f7-f3a1-4a4a-b42e-e9600ef4f463", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926772, "uuid": "d5fa535a-b821-49e3-b6a6-6ada60ea152e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926772, "uuid": "db771aef-14f1-4c2d-a5f9-821ea30390ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6610f5a9-a82a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675913557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913557, "uuid": "f06fb794-fc10-46e6-8ac9-3d3ab3d76b09", "comment": "Malware payload (RedLineStealer)", "value": "03fc82a071acc3960971962634b859e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913557, "uuid": "7f6f49bc-20c1-48ea-9663-ceb01323ccae", "comment": "Malware payload (RedLineStealer)", "value": "6e396b9e962d71787ca221ebf657edaefbb0adbc50c3698027ea49790bd366a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913557, "uuid": "a2769e5f-691e-450c-be49-b05384fa451c", "comment": "Malware payload (RedLineStealer)", "value": "3d3788355dce9cee1264bd0f93e98e52543811ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913557, "uuid": "298a129b-3d06-42a0-a93c-d54eb2d6ad7d", "comment": "Malware payload (RedLineStealer)", "value": "1742fc096f44ce37cdcda4acc062663b83523e5897ee58c24b2820cbabaa3eb39b93021c4371e4378fdc03b73425f770", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913557, "uuid": "86fc67d2-80d7-493e-a061-5f4d987f11a3", "value": "T1D6946D4393D17C84EA2A8BF2DE1EE6E8765DF6408F0EB7751118DB1B34B1172C5ABA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913557, "uuid": "61e199b8-a8d8-4446-9821-8e7599f3c9f5", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913557, "uuid": "93470e6e-a6b3-4819-96ad-cef12c9ca2d7", "value": "6144:qMz+LECyCM3r8fh/xYq2xUzMK1Cd1XgZb93lGv8QkeQGSNAUZ:qMGuCX5aq2ywK1YSZbFLQkeiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675913557, "uuid": "09552514-48b1-49f0-9f53-de46b72cccee", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675913557, "uuid": "d8b37111-095b-4336-b284-5714e71ea2d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913557, "uuid": "4ad3e089-0923-4c97-a320-32a1f95f8e54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8495421-a887-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675953611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953611, "uuid": "7dd696a5-f004-48ef-9791-de94054f948c", "comment": "Malware payload", "value": "c77f6ba30e7511b9e4ec64bcc993a7f6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953611, "uuid": "75a3ac23-bf2c-4db9-b8f2-3853b2245923", "comment": "Malware payload", "value": "6eb2b9f2e98ab5a7923b2b551ae9fcdd215aa9171b87d0f849213b03761eabda", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953611, "uuid": "8d995dee-abd5-4404-8a10-fe81ba5b1a9e", "comment": "Malware payload", "value": "f098ca4649ec2a19cdfed029b9492fbb7eec128c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953611, "uuid": "7c36006e-9d48-45b1-9369-29ce4ca888d0", "comment": "Malware payload", "value": "d0849f3c98abe6d565c9d65ac302b15255fdf4a7c1cd8ce9ed0dba8a3bea9e983be37a1e3f0890f9c170e1e20e8657e9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953611, "uuid": "d70ab32f-0d1d-4349-8480-447b2fd97522", "value": "T1B9E4233832B0DE15BEF4BD5E319F5A98B14E70C8AF917EC106068DDA7786853293217E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953611, "uuid": "16047356-fb32-4e69-b249-c31c44be26d7", "value": "12288:W3xsQmPCs6GP7xGbpubHmF6kOt7kwB+LWCe6gx1gpvyVtK:W3xsdPDzxG6HmT0gqYe6gw6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953611, "uuid": "20ef1873-f6ca-4bb4-9cb1-363ed2ca6471", "value": 712034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953611, "uuid": "548c0609-04ba-4e8b-8e20-c0ec7760fc42", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953611, "uuid": "3be312de-28f4-4206-997c-2dac181cae8c", "value": "Offer inquiry.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1fa661-a82d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675914721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914721, "uuid": "1e065c13-163f-4416-b289-82297a46a951", "comment": "Malware payload (Formbook)", "value": "f63d6f2e2dde5f8bc0e1975321f4786a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914721, "uuid": "2a91d170-cd40-4bde-bdf5-1970d1bd79a2", "comment": "Malware payload (Formbook)", "value": "6f1d97b426097b4534644a7950d22e0e41aa9355dadea037fc2d7712c5bdc669", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914721, "uuid": "e6b8d9c4-b665-450b-af06-c895ade5fdaf", "comment": "Malware payload (Formbook)", "value": "1dd3e798f915bef3165a649b307cb4881fdbd41d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914721, "uuid": "2711fdf3-a434-496b-93a8-f9f01a93cecb", "comment": "Malware payload (Formbook)", "value": "3b6ace13cb24708257b36dd4c493311e23d7f56e8be73ce0d0c16c2e290f5faa7df45998bfe234a998b3c1921ad6f7c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914721, "uuid": "9ebc7037-9648-4407-a9db-def3d4dde1a4", "value": "T1FAD4C33E1D7656E2E0B9FB7186E28420B59C8193330FC91AD9DADBC07F016826DCE65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914721, "uuid": "04066c73-d228-4b30-96e6-47ab483baf90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914721, "uuid": "a192ee73-c418-4cb9-8f3a-e36584872e2e", "value": "12288:AyGiPb+HT0qE8S6S7ztLHKNu+A+/1bKBZlAN4wss0uM8Du9ud30UopGHzGv0dF:Tb8vOztLHKNu+A+/1bKBwKLl8iM1TGv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675914721, "uuid": "e73dfc83-bb66-424e-a27d-38a34aca0479", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675914721, "uuid": "2defc02b-2166-444f-8851-09a827d07f2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914721, "uuid": "475dc363-bfa8-471b-9108-6b02d2e4b2be", "value": "IN0098767898AA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb205989-a87f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675950207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950207, "uuid": "6e772a2a-f781-433c-841a-2f95a13045fe", "comment": "Malware payload (Gozi)", "value": "9d6986c743ca739626fc081703f83433", "object_relation": "md5", "Tag": [ { "name": "agenzianetrate", "colour": "#FB819D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950207, "uuid": "a457cd44-ce6c-442f-a702-4eed3edcddc9", "comment": "Malware payload (Gozi)", "value": "6f66109ff6e4340a935fbe7a7af677041c1bc837fb3e64f5a9f5851a3e94684d", "object_relation": "sha256", "Tag": [ { "name": "agenzianetrate", "colour": "#FB819D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950207, "uuid": "0370da6d-4696-46ea-bd62-97897888d171", "comment": "Malware payload (Gozi)", "value": "0627e3441f6f28354521bd3c277bb45cd8575285", "object_relation": "sha1", "Tag": [ { "name": "agenzianetrate", "colour": "#FB819D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950207, "uuid": "8bffe998-857e-4e18-9c96-bc21035f0040", "comment": "Malware payload (Gozi)", "value": "fedeac06ae3d14b8b00531c09df5c914cbcbfbc6a952c510b7bb5b9154526f6137393d1fc496bd04e0434caba67b2a79", "object_relation": "sha3-384", "Tag": [ { "name": "agenzianetrate", "colour": "#FB819D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950207, "uuid": "ae3f3f65-08d3-4de7-b64a-7c100a00596e", "value": "T17914D0223580C072F4BA15305824DAB5FB7EF9315271C94B7BA81BAE5F332E1673A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950207, "uuid": "30e812f8-c0e3-47d6-ae8b-cb83baf8e0a7", "value": "30b62189dd33bea0f552414113e8b2af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950207, "uuid": "b5cea3b0-0308-48cc-bce6-6f56fbd74c94", "value": "3072:06mOyJOKeY5YAL/qPWaVU5kXTtjLXi42v0zk8BaNTRiinwRU:06m685xLSPfXTtjv2v0qNfwRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675950207, "uuid": "e12e8323-a6b4-4ac7-ad10-d079789e7466", "value": 194115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675950207, "uuid": "d5d1fe34-0d7d-46a0-affb-11107d9c9f3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950207, "uuid": "38828366-cefb-4f42-9152-c01881364914", "value": "scarica.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abaaa9f-a8d0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675984888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675984888, "uuid": "3cfbe577-d395-4d87-a821-15256ed55b70", "comment": "Malware payload", "value": "35ad9c294dbe66a6a9ef301dfecbf33a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675984888, "uuid": "066adf11-5ad6-462d-b319-aff7aa917477", "comment": "Malware payload", "value": "6f9b06ad1751a9f3eecb1756af2720f389f4d2e594494c63ff86c71bf6842f14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675984888, "uuid": "58556cba-7262-45c0-961b-d2cf021d56c2", "comment": "Malware payload", "value": "6eac3537c7769c18bc0e9a192c3c5e1db4918b1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675984888, "uuid": "7b90d6db-9934-4e4c-bb3b-ad617d56626a", "comment": "Malware payload", "value": "7acfe578f66598c46b05668638cb384276fc669c4dfa60a373db55e7c5b124897f765466871662e4e29a962bb13456ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675984888, "uuid": "3d0176bd-9dc4-4b65-b4be-f178df61d692", "value": "T14714C01272D0D472C432B6315829C2F53A6EB9215F7CABAB37582A2F9EB31D0D736351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675984888, "uuid": "dc754946-4359-4e07-acc2-fbcaead111d8", "value": "3ae714bb16df7ea6110fd4db3c856d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675984888, "uuid": "92c6ab5c-d1e1-4a5c-8cac-411c183fc061", "value": "3072:72bU0kO1HdjROKgFMRn0Wm1Tn7XwtjM32Z2I+IU6PRmVxhyIkIK4nGIdkP2n:72o0tnRPgFon0Wm1foM3W2OU6PW9jd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675984888, "uuid": "74650a02-589e-4435-a222-5ef0ac1e2642", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675984888, "uuid": "b03858f1-d409-4673-aae1-8966353c2954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675984888, "uuid": "173510eb-fa6a-4f5b-82bf-121a2fb5ba77", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57461181-a83f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675922551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922551, "uuid": "5f22c7db-9b3c-44c1-810a-9760f46d3599", "comment": "Malware payload (GCleaner)", "value": "247d223644b2c04090058861f5fbdf9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922551, "uuid": "37cd8b28-1300-4a07-ba17-f09262a0397e", "comment": "Malware payload (GCleaner)", "value": "6fc427b8a12d10e6a8b7077bb55393fee546cd5615be1d8811bbe85a845de366", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922551, "uuid": "1d0eb157-b4b2-471a-9ca6-5625b3f64caf", "comment": "Malware payload (GCleaner)", "value": "a916053f19cab3a37c683a3c81e27d47f6f5ffa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922551, "uuid": "ed246061-0f43-4894-8028-93fa5b169498", "comment": "Malware payload (GCleaner)", "value": "46979512b93629f4f7af51d377ea95519aed2051346ee3a06ae08d9eef048c1f265e9e724ecafae00104f083b2fdb821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922551, "uuid": "c64afe14-0cd9-43da-9756-f5426264bfd4", "value": "T19DC5123C7641C4ADC280BE749D3A98F75CE66EE3E8E0946670D97F3F927D1809A0A117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922551, "uuid": "3987f1b7-6926-4e78-b67f-df59cd2210bc", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922551, "uuid": "b058e519-353e-478a-b7fd-e2f137299b5e", "value": "49152:rdHf1+ptVj8ACfsIg35I3WLhpWLoz890+sZs00RxH9QLCgv2MR:JHfgprj8ZkIgO+aLoAFsZB0Sv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675922551, "uuid": "b802b8f3-3d0a-4fcb-8606-4258b5045fa4", "value": 2729578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675922551, "uuid": "28b50da8-3be0-411b-85d0-58d348ac6e2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922551, "uuid": "cb44bffd-7073-4f3a-a465-97539d8aacec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cecd31-a84b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675927698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927698, "uuid": "3f914e6e-8292-49c6-b109-98c6e9b75b5c", "comment": "Malware payload (Amadey)", "value": "1bfa5315324c22535944564b70c8587b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927698, "uuid": "aff9b183-4872-4408-baaf-a933c5a3e9a1", "comment": "Malware payload (Amadey)", "value": "703ef0d958c0d96cb5f71c636ea3fcda40270980db154c53ac450e7017415581", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927698, "uuid": "0eddf6a9-86f2-4f98-8da4-8287e08d9ac8", "comment": "Malware payload (Amadey)", "value": "0f827cad1fcc59d7c02859225f005f5ea08e5ac0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927698, "uuid": "19b81a89-740f-46f2-9a29-2c4bb76c3065", "comment": "Malware payload (Amadey)", "value": "ba9cdf6231e4b69bf69f978b10644c5054b9bffc4e919b9f73c40df63c36edb6bc4e3eeb0b2d1d8abe0695a49b922971", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927698, "uuid": "3de9707a-1b8e-4a9c-98cb-0b0021f6c1d3", "value": "T17DB40207F7FC8432D8B553B01DF606C31A367D605A3887972B4EAC5A08B29B4A17577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927698, "uuid": "918df8fd-025c-4107-be76-9b4bd607e2ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927698, "uuid": "438e9125-5bea-450a-be35-71661df6bb12", "value": "12288:5Mr1y90Q6NikXfwau+2lANnPNfWS8Bteo3ZC0C:AykXfw36VfJ8BthC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675927698, "uuid": "104662fc-bd6a-4775-8a44-c830091dfef7", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675927698, "uuid": "385c6e4f-c816-4dd1-b95a-17ce0419c6aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927698, "uuid": "2a9c8ebf-6868-4422-a310-da1ef4797fea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744071ef-a87a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675947940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947940, "uuid": "80cc9ba1-2f16-4db4-a45a-02dc844f641b", "comment": "Malware payload (RedLineStealer)", "value": "537ec79595dafae8086cb495226bbe9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947940, "uuid": "12e85e72-1d8f-4251-821a-3c997358ca88", "comment": "Malware payload (RedLineStealer)", "value": "704a92f4d2671d97b2c368044524a3a66ad86c80ddb7ebba9d27f8de7b435f8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947940, "uuid": "46c0065c-ae8e-4a4b-bdc5-ba397ace2ed2", "comment": "Malware payload (RedLineStealer)", "value": "f037a2d6cb5cce909405157ac6849fc4877d288a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947940, "uuid": "af2f26bc-5f9a-44dc-8cf9-1925ce90d58a", "comment": "Malware payload (RedLineStealer)", "value": "6929b96eb2079a9d8accc92ab884ce4172a7f0fc5c1aa261f0004b05a31c4b6af15392a65d4718c686da82d98b4be21e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947940, "uuid": "2075da28-57c7-4b78-b1a3-dff34a76fd48", "value": "T178B5D972BF07B0AFC110147C8D97CA43D39842EE91288E1DD9DB74B2F853DA5DE8AA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947940, "uuid": "15eecb09-6f60-4d47-b0a3-4699a7a732e0", "value": "2c8b3b62f3cf8dc7581eede43c52e301", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947940, "uuid": "633d970d-70de-40fa-9d4f-caf7d011c711", "value": "24576:mwcZkt0OHou4v2bjvnMkdaREcBHmBc0j+m8JcIEYSKTwNJdT4f86YoyilnF/YZl/:m1kcAnq3hDHo+2gG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675947940, "uuid": "6a6abb8c-11e9-44f4-868a-5ae4988d94b0", "value": 2355216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675947940, "uuid": "f40252a2-636e-4b27-8ed9-5f99323182ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947940, "uuid": "eadb6401-7e91-4f9c-a159-c414bba77ede", "value": "537ec79595dafae8086cb495226bbe9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68ff298-a856-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675932670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932670, "uuid": "6ba86aaa-7834-4127-ac40-ce9f10937370", "comment": "Malware payload (SnakeKeylogger)", "value": "34f84eee66eac2868ab139ce7fb4f158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932670, "uuid": "9bfab70b-b9a4-403f-ae46-8a998ca76269", "comment": "Malware payload (SnakeKeylogger)", "value": "7054dbc6d04ee112e4a41488055980de02ebdf28048bf1e3b9105e10487637ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932670, "uuid": "ad3974dd-9dd1-46e3-b03a-725a393607af", "comment": "Malware payload (SnakeKeylogger)", "value": "65f9fe3e912cb0101cff6d8f7e9b330445aecc40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932670, "uuid": "1e5ad362-d70d-4c93-82d3-28ee51a3480e", "comment": "Malware payload (SnakeKeylogger)", "value": "b9f9b0dcda3fe1051ca438323f00cf4327259aa7427d09fc274be531ec9b209e6cff11c287bffc55ae7a199cd2dcd754", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932670, "uuid": "827b6dc6-98a5-4dda-992b-154d92baef36", "value": "T16154224048A4E677E4AA8372DE75157AFFE5AD2720ADCA1F07719B48FD224C01E2C729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932670, "uuid": "45da4d4e-4a4c-4a39-8955-ec45b2d03669", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932670, "uuid": "a19eb1e1-3f2c-438a-b6fe-a084cdba185b", "value": "6144:/Ya6I1EtPgAYmHhjOuYCL/CN58nNwvqTjO6KHe9GWy5MSqEs/Xv:/YGq5cmHhVLqNy8OjOVHYGWy2YE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675932670, "uuid": "484a46cd-1617-4548-80ef-924e6cfe4282", "value": 296196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675932670, "uuid": "4bb5d823-a631-44d8-af9f-94025e494716", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932670, "uuid": "315c5cdd-7dd2-4e40-9e34-e5450a2cdbb2", "value": "Doc345825537292023.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21697dc-a891-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675958003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958003, "uuid": "32569867-eb43-46af-9a78-340459b841f3", "comment": "Malware payload (Formbook)", "value": "180dff04abb5da7fe88a82263a2fdbdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958003, "uuid": "a1a12881-220e-4219-89bd-f9fda0efeeba", "comment": "Malware payload (Formbook)", "value": "707ae12af6622a529cdd2a96a2f1708dc39b57a3cda03f343b7d4498d6d95c30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958003, "uuid": "8da8ba05-ec06-4cfd-b0d1-b0244b812f2c", "comment": "Malware payload (Formbook)", "value": "e0a84cd4818087232c8b1631b362d1c7213b472f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958003, "uuid": "8c756da3-3301-47de-a9e2-01a62ec28817", "comment": "Malware payload (Formbook)", "value": "7d0abeb45909c297bd2d32a007143b7a873402909cdc5f2c94c861f3f04cd4fd4e3568c2abd3840b6dcd8e415c0c8772", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958003, "uuid": "b38cc4e9-ae9e-47b1-bcc1-3a2ed9f2f8c9", "value": "T16364136162F0C15BE1530E311EB76A937FD6821140A11B1787B01A9FFE72A53F11EBA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958003, "uuid": "f3286261-8775-42c4-8650-588a7b62742d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958003, "uuid": "daaf47c0-b241-484c-800f-2782b4c031a1", "value": "6144:/Ya6cj8hHN36gtnscENpjdh5f1rR/ILbVIvXhm0L1ZtmxWpEd:/YCjaN3hiN/btRIXVwXhtJqEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675958003, "uuid": "d5f3f722-2595-44b3-bd60-6ce24080568f", "value": 315890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675958003, "uuid": "c7eced27-37ba-4849-b218-ac3b5c8ad916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958003, "uuid": "37564605-21ee-4beb-b4af-c8b5cc489d42", "value": "1030.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eeca242-a85c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675934993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934993, "uuid": "8f480560-2ca0-4dc8-83df-549da79780fa", "comment": "Malware payload (Smoke Loader)", "value": "f7565fefc1fe5ab93fa3cfd1db11b670", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934993, "uuid": "1a6ca17b-c5e1-4193-b7d8-7176c67e9b59", "comment": "Malware payload (Smoke Loader)", "value": "708d7d560a799f9a5757cec56c31b2418c4482dd08a1533c0f2ec7b2e1257079", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934993, "uuid": "e795ca6f-8bb8-4fee-aeb5-98ddbfe24877", "comment": "Malware payload (Smoke Loader)", "value": "4e4e99028f92cfe23f168656882424fa12b68e25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934993, "uuid": "ad39a89f-9613-4bad-9667-bce38df6f002", "comment": "Malware payload (Smoke Loader)", "value": "ab1187369e18bca39103a7e4f17b804f370b342e72914c4ec39ceb3cfe55d6d7fe90f8f4c29a369daf21c3810fa2841a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934993, "uuid": "5629d943-9d0e-4904-a9cc-229f65c426e3", "value": "T18014DF323590C072C36A1534D874DAA16FBEB83096B98A4B77A41BAD9F313D0673735A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934993, "uuid": "21cf4a20-bd8e-41fb-8896-493bd0af1cfd", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934993, "uuid": "dd1ee34e-b3a0-4e8b-892d-a30f34b87e2b", "value": "3072:ySq0OAJciNweKL8JOsW2d5pLdJI5fv1yJBBd+n+t9mg6p0Ee52Pr4:3q0OlFL8AsLLI5n1OFDt/6Fe52z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675934993, "uuid": "90f37f0c-a8a9-487b-81b3-1c58039ab62d", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675934993, "uuid": "e7ffbbe8-8616-4a83-a728-f64d5700d445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934993, "uuid": "1fd1ead8-3145-4de5-a904-5b34819660c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcf3c3d-a831-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675916818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916818, "uuid": "27876ee8-59d7-4d7e-bea8-80d49422d10c", "comment": "Malware payload", "value": "c4cabd2cd46018ac8a424befcb16ade3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916818, "uuid": "a9f02c84-b713-4641-b401-97aff5932998", "comment": "Malware payload", "value": "70b0234f303aa6a28bdeb2011739d6828293a6235a0fb6f5308f7bd0203b6ac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916818, "uuid": "18a66765-2704-49fb-b0db-7f3accf6fd91", "comment": "Malware payload", "value": "cba8da3d4a8bc3027a6a315a015ab1fb2a98c044", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916818, "uuid": "8811816c-2ac4-4dae-97d1-ec1d41eb9e9c", "comment": "Malware payload", "value": "03952719e81b92c63ad546c94029a19c0da22f7506524eab6c327eabef2575138c13cee8575176c350444ebaf8b773fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916818, "uuid": "01c413a1-00c3-4ded-9fac-60d91d8aa92b", "value": "T178237B40EA845D98DE5ACB31F02A43C607BA5D06287982DC6FED7C7B5FB32C46919336", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916818, "uuid": "f2e8421c-3c2c-4a84-9dc2-f2ca232da913", "value": "768:GrphWz3wDS5PmxxxxxixXYylUpK9jg+HLr6GbOsKpeQi9c/KYP3hrv5k:G103wDu3Y6Uk9jg+rr6GbOsKpeQiQKWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675916818, "uuid": "380f0040-18a5-42cc-93e9-210c9dae80a6", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675916818, "uuid": "c3678089-2021-4929-b62e-b647b8402963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916818, "uuid": "58c143f5-53d1-4e19-b2a9-e2674e56fd0f", "value": "c4cabd2cd46018ac8a424befcb16ade3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2388ce-a847-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675926022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926022, "uuid": "7257bc49-db19-4557-94a1-38033dd7c3a4", "comment": "Malware payload (GCleaner)", "value": "96eca9cc81a606370f10e3671be17d80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926022, "uuid": "9477e3b3-2db9-41ca-8e17-a2a72ff72287", "comment": "Malware payload (GCleaner)", "value": "710080ebf325bb4fe21be11da0680a09e077e8493b4b06c2dff82fb921e73a2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926022, "uuid": "da710a0b-e90f-4318-af01-4ec57fe68d0a", "comment": "Malware payload (GCleaner)", "value": "70837e073dd140e65e405e34aaa5ed2f631a29aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926022, "uuid": "328e4fb1-a14d-4eb4-b422-9576fd691ee4", "comment": "Malware payload (GCleaner)", "value": "9331138f34e5cafa35ad22266b206ed75f2d8fca514268822d486d3e78964528edbf1cc50cf3a246ae8512b7ccc06949", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926022, "uuid": "759e5e90-848e-43bf-8281-457c691ef5e8", "value": "T1D3C5017D7510C4ADD680FEB48C2AA5E74CDA6EE3E8E0A12270CD7F3F52792845A0A517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926022, "uuid": "5e1ff330-8afa-4c7f-9422-6334a9e08df0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926022, "uuid": "7112f2c8-e54e-4aaa-931d-fa45ec17f185", "value": "49152:rdHsJSdYsEFP45xWnq3lYUhR9Qs8G2Q3fbWhpt2LCgv2MR:JH2sE945xWq1YSktG24fbWv0v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926022, "uuid": "d04fe090-a058-4eb3-93e1-8901cf5dacb6", "value": 2724271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926022, "uuid": "1af75fd2-3730-48c3-bcc7-3dce0d5cbfda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926022, "uuid": "b55042a3-aa21-4310-a6c8-af7ab7c2a016", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11500988-a832-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675916851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916851, "uuid": "dad3801c-670e-46a2-9255-be77fd1c5444", "comment": "Malware payload (AgentTesla)", "value": "72c820e94bfdc89048babe26aba5ea28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916851, "uuid": "469cb5c4-d47d-4057-8090-0ca713b1dd6e", "comment": "Malware payload (AgentTesla)", "value": "716c596257001fa783b8500fce06dd51a5a5906bc78f4c6c6bcce77f363fda4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916851, "uuid": "a83afeae-2ecc-4e81-b03e-bff6cf93f10c", "comment": "Malware payload (AgentTesla)", "value": "b26d6b501f1f832ccb1f1cfd15400494d421e360", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916851, "uuid": "76c701e4-70bc-415f-9585-94e1b637ae1a", "comment": "Malware payload (AgentTesla)", "value": "70bb958959698be846eaf2cc6f8d1df08937697c982d7c5016a05ac69ddc5efc3aa4730fa3395d925610aa34b301f3bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916851, "uuid": "b0696c7d-1764-44b5-9395-e3b13d5d26ed", "value": "T161A247A65EA44C61F16AE8B3470E600D19BFF43620C245C4BFCDD7B4763954E4B6B2B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916851, "uuid": "c62c7663-2dd9-4362-a76a-beb1b9198e43", "value": "384:Q6HrRGt4Q1h5SdqCuvWgrVLiV6RqzAVYUQQxIceVRCy1MtHaTN:zRGt5ouvWDoMzJj18HaTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675916851, "uuid": "34041be1-df2e-4b5f-9be2-7fb6001a9771", "value": 21631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675916851, "uuid": "3fd1ba83-86bc-416c-8791-6e86fd8c1f74", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916851, "uuid": "03a981c6-6e71-4735-9bf4-c733bd0abf54", "value": "72c820e94bfdc89048babe26aba5ea28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b845b9f7-a860-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675936888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936888, "uuid": "2031543f-d29f-4f3f-9480-7b2c9f640274", "comment": "Malware payload (LaplasClipper)", "value": "09410908002c128c78ae788754a93f95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936888, "uuid": "1a8d8dc7-1f5d-4552-9845-9269f6925a12", "comment": "Malware payload (LaplasClipper)", "value": "719dc62c28d143014a62dbd91017f32020362ee3a06bac5c35d61868d571b127", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936888, "uuid": "1c4bd831-396d-4c8e-92ce-43bdaeaa7221", "comment": "Malware payload (LaplasClipper)", "value": "3f2dbbc056ae39621fda1ce98e6377d1d19c6cf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936888, "uuid": "d8b63f03-95c6-46d0-b77a-67fb2d7df603", "comment": "Malware payload (LaplasClipper)", "value": "a87c4c7d8fd198e4c0acfb050e877f013a53dee468c40990471f824a9bd3b4b973d5c157df3aa0a8a950092f57e7a4a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936888, "uuid": "f5955deb-72c7-4a36-96db-da395b688baa", "value": "T1FE14D13636D0C072C57A143C5830E66D6BBEF83042758A5B7B682BAE5F313D36A36356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936888, "uuid": "f7343a24-0cbc-4fcc-9c65-9fa76af73aba", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936888, "uuid": "b45a1366-4d1f-4255-af58-394d718baf80", "value": "3072:2GpOgsOUj+Qy9tLKGgxWOzd5vSgdz0H60VxeEsSuKqDWYqB2mQX:2GprCqDLYxq4AHdGKIpmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675936888, "uuid": "a22290a7-571d-474a-b5c3-1dff0c0292ec", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675936888, "uuid": "695d2020-4376-45e6-95f7-c0bf8e2c3df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936888, "uuid": "904e46e3-bf44-4121-8fcc-e2cd1b7e0e60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac7dae0-a832-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1675916866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916866, "uuid": "36a92808-5e10-4c9d-8407-57002fd7b4ea", "comment": "Malware payload (AuroraStealer)", "value": "d2db5ee3f24b4e339cafa103110cf5c3", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916866, "uuid": "a06067e8-59d7-448a-b48c-770909625b7f", "comment": "Malware payload (AuroraStealer)", "value": "71afdcd65282b8f31cf485e8d7dbe4fa655ea746993f753a375ca221d31c0bc6", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916866, "uuid": "918889d1-44dc-40f3-ba61-0df760d70a18", "comment": "Malware payload (AuroraStealer)", "value": "1a9793dd26b517a8a73d1c2a76904029e417c6ea", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916866, "uuid": "912c84fd-2bb5-486d-b598-f2750f500253", "comment": "Malware payload (AuroraStealer)", "value": "a64f6ad76c27bbcf09fe37798722b276a9b47701ed5fb17c7b2d3d19afbe22d8a77e02e1837b99aa5c9214b8719389d0", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916866, "uuid": "5a970a65-7ccc-4b0a-a45f-baa3f4f3ed54", "value": "T15DB6AFB875043CE6E66F527BC996ACD813753A628F97A5CB4064B7C309733F5EE22804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916866, "uuid": "1c71ce4e-5b1a-4afe-a854-0a3e24750b8d", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916866, "uuid": "3506d350-6c6b-4b39-9b2a-1b12ac39b9cc", "value": "24576:lFwTW1g2df/JR8K4TM0CCOgSsSDOFodmEpvEwyKg76Z8cfQB81lBB57YHAIS2Rek:lkW1jdf7z6CCOWUue9+z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675916866, "uuid": "d90172c1-8bbd-4cf4-a088-90b0f5cfbed6", "value": 10748928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675916866, "uuid": "abead60c-dfbc-472e-a67a-7752afe3a243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916866, "uuid": "9800fc69-1fe1-4a06-b668-688147918b38", "value": "d2db5ee3f24b4e339cafa103110cf5c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44390f1-a8b9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675975213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675975213, "uuid": "0d1facd4-830d-4484-9e64-351acb738e2c", "comment": "Malware payload", "value": "824957b8da7790edc7a76c9a7fb2d984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675975213, "uuid": "766ef19a-3351-4405-b7b5-d0a47d4078d1", "comment": "Malware payload", "value": "720a0d348257ad4c88b6657d1d383af1cb86a7d3ac8b452721b722fb8895cb41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675975213, "uuid": "aca51218-8cb4-4c95-a3c8-7f56fd798e18", "comment": "Malware payload", "value": "dcbdf1912237d6ace311ce77408049d0dd892854", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675975213, "uuid": "79d35519-ee9e-4666-82fb-b33e2a99d979", "comment": "Malware payload", "value": "ad7452ac5ca70bcde7c29ee66c78b9d49aee67fb562b5aae06c45085d1facc179a4fe0ff8d41a22678cd7fcb2ce91bda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675975213, "uuid": "8edc158f-ea7b-4028-b56f-d85d270808fe", "value": "T11AB4020BE6E88072ED7117B05CF306D316367E505B3887AB668B7D5A0CB26B07672727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675975213, "uuid": "dc6bc2e2-c585-48f4-8d3d-9c8750e3c795", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675975213, "uuid": "8a761379-a25d-4acc-b23a-1adef6d504fe", "value": "12288:+Mr9y90WAJ8idQI786rSv07HEggM9+freXakiRNr:Hy1FirYP0b1ODeXNur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675975213, "uuid": "e9de8613-5ef9-4c21-945d-5d769fdae8b5", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675975213, "uuid": "3b9c6b71-bdf8-4968-8927-81de1c53c0f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675975213, "uuid": "7f583493-75ab-4757-ad39-ec9353503541", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c507b38b-a8cb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675982865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675982865, "uuid": "bd123ad3-099e-4108-a4d9-beeb815d4a5d", "comment": "Malware payload", "value": "dc455af17eb67cbf11c8e97020dc08e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675982865, "uuid": "72fa66d1-faa7-4c69-be41-8da4a53a407d", "comment": "Malware payload", "value": "725c95122929e71e9ef27f6b6e0114ae0e6ac972368f8feb6a7983d14ecb34a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675982865, "uuid": "fccbfab1-ec91-40d0-a0fa-155df4fc201d", "comment": "Malware payload", "value": "2f3fd90ee3661ab355de7dc434e91919b7174948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675982865, "uuid": "5733ec3d-9bed-46c9-a652-69d67a4b6cb8", "comment": "Malware payload", "value": "8db86f8fb834c0fa3f27f917ffc8d22f211b518084b52765748a957a57abdad3bb0803d7f013b93e9847211d8a0d40b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675982865, "uuid": "c73d33bc-76a6-4579-bdbb-53db02f8a70e", "value": "T173B4014BA7D84132D8B45B701DFA03D7093A7C60A674879B268A6D1A1DB3A70F73137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675982865, "uuid": "7867523a-285f-4cfc-b742-fd1d731ef3d0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675982865, "uuid": "9528a006-0b8a-49ef-b44d-160df8a97a23", "value": "12288:yMrTy90lzFb6LQ9QgtDvfVVgxLyiz6DnYpEvWlvH6/H/EzlqermwLn:ty6F2J0DvTAyiUnYbv6/fEtBLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675982865, "uuid": "8b4298aa-6f63-469f-9eb9-8b71d23980cc", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675982865, "uuid": "f4a22c18-7147-4dbc-88c7-72ab538b9f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675982865, "uuid": "3f358bf8-ee24-425f-b6c1-c74864759791", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5500beeb-a822-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675910092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910092, "uuid": "f7cba21d-1686-4da3-9662-9229a8a57722", "comment": "Malware payload (RecordBreaker)", "value": "f2950ef26f40451cf5790fc1ebf0e6fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910092, "uuid": "b2a6d3a8-4024-43d0-9d0b-f764057ef6a3", "comment": "Malware payload (RecordBreaker)", "value": "72ae99634eb46397ef2a611e58f1f67482cfdaf6624128d6efcfdb41d1c9e2f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910092, "uuid": "88e29405-e9ed-43f5-ba80-98125cbb5f58", "comment": "Malware payload (RecordBreaker)", "value": "08ba51a3ec7275694cac1993f254800c160547c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910092, "uuid": "d2b4ad4e-fffd-4f25-a927-76ab2a2a393d", "comment": "Malware payload (RecordBreaker)", "value": "645dd7fc4f70b90f1e975f648ab884212f1dfc13e161d5319c7f5959e33f91558d90dfe38947c084362b48e874078027", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910092, "uuid": "fca37770-e8e7-4670-8ef7-d05c6ad85de2", "value": "T18F64190393E17C80EA2A8BF2DE1EE6E8765DF5508E4AB77512289F1F34B1172C563A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910092, "uuid": "5702f45e-90db-4b6a-860f-8514fbcb9e7c", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910092, "uuid": "b21570df-770d-4918-ad07-65c3a37190d7", "value": "6144:tMLStGQAAx/hUgnpznDk0v+Y5BNQEQkeQGSBa:tMW0QAlgnpXDTN3QkeiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675910092, "uuid": "1f3e25e9-c243-40d3-9988-2f9bb4302bfe", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675910092, "uuid": "46b588aa-84c6-4543-ac08-836a52b0a3af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910092, "uuid": "59ba84db-1962-44c7-9876-f2122edf8a59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14443f04-a87b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675948209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948209, "uuid": "23b93441-44fd-4993-9379-7b9928e93ca6", "comment": "Malware payload (RedLineStealer)", "value": "7d87c4bc2f2d293c42d30b5c85b7a061", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948209, "uuid": "3d491f64-5dee-43fa-b5f0-9ef3593772b3", "comment": "Malware payload (RedLineStealer)", "value": "72fa014db49738f6ab72b7e127c30d4d15a7e6c03aaa5c3a7e06be766858a124", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948209, "uuid": "f8029606-3967-4604-8fc3-107b6a749ecd", "comment": "Malware payload (RedLineStealer)", "value": "4cab1a968d1e93eb0b6ec52f0df4f9d7e56029d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948209, "uuid": "857bc539-0566-4c10-94ba-fedd3fbd5b4b", "comment": "Malware payload (RedLineStealer)", "value": "c5414329ce0ed49e5f525ce6303235352ceaa390983f77a393b29b7da555f8bd3c28529dfbc35b0239be6880f1b6c73c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948209, "uuid": "a4062b14-cdfe-4750-8e75-09d7a88975df", "value": "T119B4020BFBEC5031E9B567B04DF602D306327EA25A3C83A7134EAD5A08716A5B53177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948209, "uuid": "a70f0068-9491-470c-9a3c-33f5a346e089", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948209, "uuid": "7b0df869-9280-482a-a67e-f1262813a749", "value": "12288:JMrny90xCiQb5c+bKuZdZ3+Nxpsvka6OIOIpCNAJ:CyKCdba+nr37vP6s8CuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675948209, "uuid": "0d215ce1-87c9-4fa4-91b4-e6b45345d794", "value": 530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675948209, "uuid": "a02c705e-f6a2-46e1-b33f-cb5807a0288d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948209, "uuid": "0e682e1c-6eed-4734-83ab-f3c3ecc5c6ce", "value": "7d87c4bc2f2d293c42d30b5c85b7a061.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa270f9-a8a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675965193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965193, "uuid": "40199dbb-1251-4a5d-9fc3-9346ae2e8868", "comment": "Malware payload (RemcosRAT)", "value": "8d1aa8b42eef344ccade2dcd857a28ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965193, "uuid": "70863004-6ce0-480b-81d3-4a26759411fb", "comment": "Malware payload (RemcosRAT)", "value": "735a6bac9599aff59caa878c83f1ad80e7b653289c668275fda7d2b8ee36828f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965193, "uuid": "083cf51f-f2d9-4a65-afa5-71958f23f93b", "comment": "Malware payload (RemcosRAT)", "value": "de8056db25d0f559bd733eaa5878dfc08ffbede2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965193, "uuid": "86f2875b-d81d-4879-a1d4-a7b25d8e5839", "comment": "Malware payload (RemcosRAT)", "value": "e6e975a68d65e5c0b0b26b08c874eb100760502ec2dc1c3a4938c65eb7f16e0538b3fdf8f8031a46a4421a4c02f003f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965193, "uuid": "78d9f43b-db87-48c0-9c04-1241d3b63260", "value": "T1F0C423ACA26CD59DD1132EB628B3FA0059F9A83531F657570310CE8A3D23FA1C81D7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965193, "uuid": "2e05f708-01d4-49e6-b43a-27d18991778e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965193, "uuid": "b4a8bef9-e3a8-4c96-843d-15d6b5374f01", "value": "12288:PYiifIi+9dJ8SBAwNnH2g09lhS25LoebE/8ki:PYiQIi+bNAqVWlQYkME/8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675965193, "uuid": "3cc58a84-35e7-4752-8207-5f419a5e8890", "value": 543727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675965193, "uuid": "feb4e8ae-cd5e-47c7-96e8-2f4e7c1c6350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965193, "uuid": "6715b1b4-914f-4e02-95ca-8ef96a4d4ce5", "value": "statement up till Jan 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1628af-a874-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675945430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945430, "uuid": "5750782f-cca4-42a2-80bd-7cac94e5b227", "comment": "Malware payload (Gozi)", "value": "60c29e9cdc0598bffb663624e50298ef", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945430, "uuid": "eaee197c-c934-4154-8cac-a0d50b1a7474", "comment": "Malware payload (Gozi)", "value": "73645fa4d522df3dd9171dfd57267d84ec9d24e67358bed8d23657de87a39444", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945430, "uuid": "fdd7305a-d7c5-4090-8a91-d96f41198124", "comment": "Malware payload (Gozi)", "value": "e5dc2d4f59fb27637ab64fa1dc0360da4bb0a75e", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945430, "uuid": "2098213a-7a9b-4b46-a058-032e8022f643", "comment": "Malware payload (Gozi)", "value": "f583cf9627a78cb9aab562195d0d6bc440f7fcef1309e70b0bc2bb0b439a6b7251a39141847b67a6700cba375f16cd69", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945430, "uuid": "74b4ba2d-2978-4268-acd7-9ea25821457c", "value": "T178D0220A8D8DC2A1C142540AE058BC58AE0EF04829F7CCA8A2C2CA869C514D0DD0CBBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945430, "uuid": "6ba3f0e1-393a-49f0-8553-faba983bcbbc", "value": "6:HRYFJb/4sZOVkj69Qvyc1yc54vVG/4xHy:HRYFJDoVY69Qvhy3VW4xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675945430, "uuid": "02fdaf1d-1ad7-4097-8a71-1798e651bc3c", "value": 196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675945430, "uuid": "f0035dfe-5393-4dac-a140-6063e6a0282a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945430, "uuid": "3c3c222e-bc8e-4534-ac6c-ff98fba234fb", "value": "verificare url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ece9a9b-a8c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675980063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980063, "uuid": "271f60a0-c060-4fe9-bf02-a347d6db83e7", "comment": "Malware payload", "value": "5f7129558c21ecf129bc0775180867aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980063, "uuid": "2204c349-90d6-40b3-a97d-04944bd25d22", "comment": "Malware payload", "value": "73aa37793c0a4553ab9772938645f2390d6e83346697d09b694d2d413267eef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980063, "uuid": "511a2f32-9be9-4b63-bbb6-29609b4e069b", "comment": "Malware payload", "value": "643af7ad43b35936efd6b6d2a8ae40545fb31715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980063, "uuid": "528feb5c-1117-49b7-a115-da5961d41f39", "comment": "Malware payload", "value": "1fb873e0bef41e3d532e965b36e523d36f2a8d200d503bc208b41d53312513693f3cc67e2183b34f51eecec23ad26822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980063, "uuid": "f718d576-c781-43da-871e-6119e6193650", "value": "T1E454E01273E0E872D432B2349D25C6F17B7EF8214E7C666727442A6E6EB07D0A627313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980063, "uuid": "ea957bc6-0590-42ee-ad4c-1b339befdf46", "value": "3ae714bb16df7ea6110fd4db3c856d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980063, "uuid": "56f89932-5537-4ba4-b309-66c526e4ea35", "value": "6144:jms0nuRsQNX+wBpgCuzfW2sZdNRMNlyjEDvUu/RY:jmssAso+wBpSze2srNM0wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675980063, "uuid": "5af2fda5-85ad-4007-96a1-36666d4da0db", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675980063, "uuid": "04284356-43e0-414c-b0b2-1cf6b9f3171f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980063, "uuid": "49d8743a-3a19-4c70-933b-dfc6efe9410b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4cfd4c3-a814-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675904347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904347, "uuid": "e24104cb-7bdc-4628-b534-526b2c1030ec", "comment": "Malware payload (Formbook)", "value": "6dca0101bf6a48aa85f852010faa089c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904347, "uuid": "bec7d0b4-1087-4e48-8001-d9b57e4abfe2", "comment": "Malware payload (Formbook)", "value": "73d4fe3cfef607ffec79eb83b0e0179b4d30af24c95dcd5d8687ecc442e4aff3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904347, "uuid": "0689bbff-00c3-4d20-b9b3-adf1dd854aba", "comment": "Malware payload (Formbook)", "value": "1226ee419c68e624811ba61d91fb809bce4262e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904347, "uuid": "a847c725-2e68-41a9-b779-6ec8b6171ba9", "comment": "Malware payload (Formbook)", "value": "508c85182e240a27032515b2ed06e39a936403e955c964a20050e90248c9e40eab75a7d6d4e000651dc59a8739387be8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904347, "uuid": "e842c503-5992-4c25-83da-7f2d0adc4108", "value": "T1A5058E6337B195B2F78721B10428BB886BF17503BE16E2938BB737C06785DB77298152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904347, "uuid": "54559e21-2c60-4321-974f-dd9fd7d40326", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904347, "uuid": "bde0d8f4-706e-40f2-90ca-a8cdb69f138f", "value": "24576:4weSqG4yPaatqho3GSWpLEAbS076F0xM:4PuqhoWjpAA+NWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675904347, "uuid": "ba54eade-63b4-48fc-a160-27eca53b4975", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675904347, "uuid": "b93e3c86-ffb2-45b9-b48d-a80e4ccd1ac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904347, "uuid": "cd6b2aaa-ae0c-4651-89f5-47985086c575", "value": "New Order Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4b67fc-a810-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675902429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902429, "uuid": "a3ce6df4-b480-493b-8533-1c82757e3ce8", "comment": "Malware payload (Gafgyt)", "value": "50ba489334db173a954e0e9dfac76720", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902429, "uuid": "58dcdf61-5bf3-4723-95b3-18bd8ee7bd81", "comment": "Malware payload (Gafgyt)", "value": "73e5c7db3d3777ae968c63e9fcbb803df6dccdd358f6888d89bf2bfe7e740d2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902429, "uuid": "632f034d-4c90-4694-b6e3-cc1ce587f421", "comment": "Malware payload (Gafgyt)", "value": "599e54a51f04948fbc73d0541674afb3ffb4f863", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902429, "uuid": "4c32a050-90ab-4a33-b57f-4e3eecd69540", "comment": "Malware payload (Gafgyt)", "value": "4fecb280df697064b1e2e66ae7a8975638856897d6d88e1dfc63deea5e0d059990cbcb834992b7b1f62826be31a027b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902429, "uuid": "2d43d511-92ad-4f99-80c7-a523f5ea644f", "value": "T1D6834C81FA43C6B3C8830BB6029B9F651931BEA61E1A9F46F31C7DF49F124C87512B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902429, "uuid": "01f2d3d0-d21b-47f6-a5ff-a9ac594fdcb6", "value": "1536:MW9UfE0+jisRQ19Nnt/O3TWKK3reznKEyin58mF+bVYz+UEcf/31:/UfE0+jiUQ199tkqX3+KEDamEbVYz+Pc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902429, "uuid": "eaad7320-fded-4ee8-ab1b-efe822d21502", "value": 85095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902429, "uuid": "9f83786d-cebd-4749-846a-513eae9264bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902429, "uuid": "5e28a90b-8de6-4a46-b4c5-dbdac3ffaef8", "value": "50ba489334db173a954e0e9dfac76720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b62018-a8c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675980227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980227, "uuid": "9369857f-5400-49b3-ad91-e2ceef091908", "comment": "Malware payload", "value": "79e97c40e89d0f4a6661461de090292a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980227, "uuid": "b0d7a301-54c1-40f6-ada8-3790d64c14e2", "comment": "Malware payload", "value": "73f7f9959a38c0c1da1caf0d7e2c7a51b0f6414d6f4060941f35d4f03cdf8f6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980227, "uuid": "640fdf02-8b13-4620-8687-aadc29fdebe2", "comment": "Malware payload", "value": "305f623da70f9ddf30ec6ea75740ca431792bf0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980227, "uuid": "3a118284-51a7-4fe8-b12c-9da9f2b21a74", "comment": "Malware payload", "value": "446d562f95119e96a980536078ce802c38b3bae8e5527405c9f1d1ee57f60ddda9b296f00d55c1ce1a1eb94610cc5b9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980227, "uuid": "146b4cb1-f6b4-4d9c-995c-1e8a90271f9e", "value": "T10DB40217A6EC8133E8B417702DF602D31A363E505A388B9B364FAC5D59732B4A63537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980227, "uuid": "ebdadc1a-d585-44e8-abbd-63c378b3b18b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980227, "uuid": "2de11911-1c37-459d-bc72-e9fb6115ffee", "value": "12288:1MrZy90lAsNx+1iBblletY05iz6D4YQEvWlvLqVGjKxj7:cyE1+10ZYtd5iU4Y8+0jKxj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675980227, "uuid": "5a8a1cab-a795-4e05-9a17-b7821cc78620", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675980227, "uuid": "070112fa-951f-44a5-8b96-88464ef722e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980227, "uuid": "5975edea-bdbf-42b5-bb14-04e35847a6bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d370e3-a864-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675938715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938715, "uuid": "5c493eb8-61a3-4104-9c47-90d9229b88ea", "comment": "Malware payload (RecordBreaker)", "value": "ad024d5d58c173e9519dd60656474a7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938715, "uuid": "e2e804fd-bd9f-448c-bde0-dadedc32ea04", "comment": "Malware payload (RecordBreaker)", "value": "74fc26065e1968fb4295e10cc092f0023057559a422fd45983a98d68ddd43180", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938715, "uuid": "d569012d-340d-4a83-8225-8db9c5ff29aa", "comment": "Malware payload (RecordBreaker)", "value": "1c99f4b52c79b8bdc9b408630f83dda37a191fc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938715, "uuid": "241f24fc-cbbb-4e84-b8b6-09dd0b66d575", "comment": "Malware payload (RecordBreaker)", "value": "ce9e1dc8df5cef72e03eadfe68175f3df88fa4a51175b20ba17ab5fc1c8cede799b2fb5fbad73415026b18c5cad45958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938715, "uuid": "2af0e2a4-a1d7-4ee9-81c1-3cdf07a477e8", "value": "T1F314DF2236D0C072F06B10745864CA7A6BBFB830457A991B77A42BFD9F306D06B7E247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938715, "uuid": "d157bf71-534e-4d4e-b69d-c346215c6829", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938715, "uuid": "ae6ec33f-2dbf-48c9-bed6-1eeeb3b95524", "value": "3072:t2qVOj5ci4d2PDXLA4RWkd5mi3as2QlSIkIxShsyKUwCsdD:UqVUjnrL3RC2asqIx8Drk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675938715, "uuid": "0b82ec48-cf03-482a-8b1f-d701d8699654", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675938715, "uuid": "5be96260-e14d-4710-96ab-2205e1213e10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938715, "uuid": "51ca74de-e6e6-4903-a931-ec0d26cf275d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec83445-a886-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sodinokibi)", "timestamp": 1675952951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952951, "uuid": "808595b9-6591-422a-bdce-a1172f55719e", "comment": "Malware payload (Sodinokibi)", "value": "5ebd682151819e1c5c807b15f4057c25", "object_relation": "md5", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952951, "uuid": "62785c80-1551-4754-827e-b9e0f528b1d2", "comment": "Malware payload (Sodinokibi)", "value": "7546e51b37738965704fadb25674f7fe69ea047ce5eb425c916cfa3048c78cda", "object_relation": "sha256", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952951, "uuid": "649c506d-fc3b-4a31-aca7-4bb97f2844ff", "comment": "Malware payload (Sodinokibi)", "value": "6c094d3f421d5848afe90d65ff799dbaa152006c", "object_relation": "sha1", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952951, "uuid": "8b76927d-2ffd-4bb0-a045-49eb07279f9f", "comment": "Malware payload (Sodinokibi)", "value": "32e93cd7840adbc4bb56eac556897a7f5fd65dc1e4036a303e86588bcc983a3f47b949b2779c62c4cfad12f7ca4d206b", "object_relation": "sha3-384", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952951, "uuid": "028f44fd-b212-45d5-9b21-45482eadc585", "value": "T1C1649F6FF6C10372D29203F22A1F6ED6FB3FA574227A45E05568801D1266E68933F3D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952951, "uuid": "8975edcf-8ac8-47d6-95b3-45320da23aba", "value": "bcaa152421a4795925c1a5ec4acd51f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952951, "uuid": "abd51586-a183-425a-87ea-0af06b0ecf2c", "value": "6144:+9ES63VE6F/M4qE15NENn4FDBWE1WNzZoRscLe+TlhbfmdL32M81:h5RqE1Ta4FDBWxzW2cL3lh6x3P81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675952951, "uuid": "26a4ca57-6d75-4bf3-b59b-5f8b5db50fad", "value": 329111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675952951, "uuid": "349ad995-98e8-4a60-b896-3bd996b9e20a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952951, "uuid": "e9a0f5fc-abf0-4ded-9424-8a3a34c1c2b4", "value": "2023-02-09_5ebd682151819e1c5c807b15f4057c25_neshta_revil_sodinokibi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb14ecf7-a8af-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675970849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970849, "uuid": "0cace237-b7df-436e-a788-fc406a8a92ef", "comment": "Malware payload", "value": "d8624bde95b684231c78dd109b03c968", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970849, "uuid": "56f2cc90-f356-4faf-a76e-2d1aa237ad2b", "comment": "Malware payload", "value": "754ac72315dfe56ed6cec0809bf4d26132e46fdd670e45da63f127b1c7488a07", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970849, "uuid": "c0e8c5c9-a8b0-4c23-b06c-6ded09aa3628", "comment": "Malware payload", "value": "6c38de8a732f13aad0119b9be7d2aaae3d3a84da", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970849, "uuid": "b7a7b451-f5a3-4447-9b41-5ea4e082ea49", "comment": "Malware payload", "value": "e3d09d40ef44011a067017fc0bc3d965218f807cbe202b90ed875af0d5a6d114fc1d014b272e7637fb11b4435d6826ef", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970849, "uuid": "70d54b2f-c763-4081-90ed-1cdf905ee457", "value": "T1DEB18E92CD0F10E7D70364995F07A629C5A186FB110333B2636C313991E4EF457891B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970849, "uuid": "e43ceef3-ec7c-411b-a32a-bee76af3a9b8", "value": "96:cEmE/31oA+KndrH0gmOGjIsj7wviecPwS+5D0seEyH7ofsAfSJ/bPw4FPX3FI/:PB1nxUgzW97wZTS+jlzSJzw6X3Fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675970849, "uuid": "3b6e1e35-837e-43a2-907c-f5e5aa7685bf", "value": 5203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675970849, "uuid": "f8221f3e-cd9d-47b2-b548-54599ae08aff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970849, "uuid": "4fbd5ea1-6524-4b88-bb50-fd8d482f4d79", "value": "Agenzia_E9(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e43b1c-a8d4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675986732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986732, "uuid": "8d342d63-9e9a-4d23-a015-1dbd88f34e06", "comment": "Malware payload", "value": "baf3604306b1a9eaa963aa3de73ffa5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986732, "uuid": "abb637c8-d86f-4216-b6ec-d67b19dce548", "comment": "Malware payload", "value": "756fdad2d0d9ea070a7bdcf7aad06d0b3d442b8e31e2e7b28315a473bf2da981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986732, "uuid": "603804ba-2877-4eb3-a73c-0ddea2f9c6f1", "comment": "Malware payload", "value": "dcc385d753b68fa79e6a8ee664fccd1e5e2c663f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986732, "uuid": "a50d9aff-3895-41b5-9676-14519178a028", "comment": "Malware payload", "value": "b9ff52f7c82b9c787e6ffe8bba9834f0258c29e371711f969db421ff59497db7ef83423281424665bb93705854c858d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986732, "uuid": "9245d199-c4a4-4b3c-b28e-f756820a7589", "value": "T1EF14D01272C0D872D032B6315929C5F57BBEB9314E3CA66B77442A3F5EB02E09B36355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986732, "uuid": "23f5bdda-8040-407d-871b-bbe7e8281a90", "value": "3cde11de1ae6a53187494063cc0a2730", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986732, "uuid": "274dc9a9-a09f-4c51-8950-0d96986dfdb0", "value": "3072:lEmvT+0qrfypbtRvnit8kyv5fieA+b5SVpIOjEPEg8cw1JgJF8:2mb+0G8Rfit8kyv555SHjVgzw1JG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675986732, "uuid": "bcb87b89-0eee-46bc-8df0-88eb4e39c34a", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675986732, "uuid": "eead81ad-e007-4bf0-995b-59b440e6e620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986732, "uuid": "e9bb1014-4ff2-4327-8719-d02758c3f822", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80fda9ba-a824-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675911025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911025, "uuid": "93ec8e3e-ec11-432b-9b8f-835667f29469", "comment": "Malware payload (DCRat)", "value": "5c5aedb715894304ca43d736d659039e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911025, "uuid": "a1cc489f-cb09-4e60-bd34-d577235ff981", "comment": "Malware payload (DCRat)", "value": "75eecc1c240eab0c4b458299338068a9f7c8226b983c5c303370db6fc2fd9dde", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911025, "uuid": "0ee6b9ed-ffa1-434b-a951-e899e01997ce", "comment": "Malware payload (DCRat)", "value": "ecd308533baeb8aa136deedf61e109ce5d8c9300", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911025, "uuid": "ab0d7381-6e7b-47cd-a680-aa518388798b", "comment": "Malware payload (DCRat)", "value": "88839a51f776aab97955cdf0367ec961e95de98a162e4c4300e89964e1d92cfc32b7dc65f0be174c3907937051355dda", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911025, "uuid": "203d07ef-96ff-42ee-b56b-a264b4f309e1", "value": "T1334539017E44CA12F0181633C2EF451847B4AD512AE6E76B7EB9376D59223937E2CACF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911025, "uuid": "0f9863c0-940d-4b38-8a64-ee2444e4556f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911025, "uuid": "c145bb9f-36d2-4ea1-a87b-8d80cc204ed9", "value": "24576:U2G/nvxW3Ww0tD3y/q8LXON68izAzqbXfjfz:UbA30Ty9LeI8izl7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675911025, "uuid": "2c194c5b-3586-47d1-b944-a67647f0fbd0", "value": 1166419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675911025, "uuid": "b1f76633-787f-4450-b7bf-889dc467098a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911025, "uuid": "972851d0-0d08-4c0b-b94e-8f9c16f9faca", "value": "5c5aedb715894304ca43d736d659039e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe11fdb6-a8a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675968358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968358, "uuid": "5aa100b7-1df6-490d-a83d-a949fd4e81a6", "comment": "Malware payload (GCleaner)", "value": "a4ca9b7dc4bc0ec7b1bb16321254afcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968358, "uuid": "82c85b8f-23da-43f3-8725-094e04d2fd2c", "comment": "Malware payload (GCleaner)", "value": "77e66d121eee004014330954fec3742808601702d6f5abbe8e24a41c5ecb035c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968358, "uuid": "44b34f10-8c02-4514-a5da-31ae38a2b244", "comment": "Malware payload (GCleaner)", "value": "3e399a3f7f3a2f0a8239d283ef6069331569ccb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968358, "uuid": "3e889b65-c539-406f-a5bd-53a15eb09a7a", "comment": "Malware payload (GCleaner)", "value": "d42c4b6162f65be4dedb7758d3d7820527e939d15cc3eab93bd103211c8db4f551d3630e994dc2d9ae93048059e60e60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968358, "uuid": "ba4525a9-f9e7-4228-a396-a120bc1b25f6", "value": "T163C5127C7115C86DD280FDB4CC2AE8E75CDA6DE3E8E0A46270D97F3F417A2859A0A117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968358, "uuid": "3e8eadc1-e0fc-4a89-a0f4-354ade3bb187", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968358, "uuid": "40f7e29e-93ec-4711-b227-49e606ce9e36", "value": "49152:rdH3Cok9W0upm3glXvQXgBlWBluHJL+axAnEhglLCgv2MR:JHyjWhz1iWEYHJL+axAEhyv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675968358, "uuid": "098fa3ae-011b-4817-9b1c-01ee86aab6b0", "value": 2643140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675968358, "uuid": "d64cc51a-b751-4d99-afb0-14aa875e8b85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968358, "uuid": "784fb2c5-b1df-4391-87b0-96926a48a6e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe2cbee-a869-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675940732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940732, "uuid": "669703e8-b6cd-4761-b898-cecce0c45f87", "comment": "Malware payload (Formbook)", "value": "3f3aec461c297fa8cf584755267eba19", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940732, "uuid": "b3ddcf8f-c784-4140-90af-d21884c022aa", "comment": "Malware payload (Formbook)", "value": "78643c835e9bb2b7107af948f698292e07c0535b9e109440b7cb34fd76d461bb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940732, "uuid": "e28d5b33-7323-4bad-b9bb-b9af4a7dc00b", "comment": "Malware payload (Formbook)", "value": "b4a8ead1d9ce5a3122c7b7054c0bb5a6ec943c37", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940732, "uuid": "c5f62266-c148-416a-8c22-070d367cbfc0", "comment": "Malware payload (Formbook)", "value": "854978d3fa1d9fe773166e777778c3d05e929cca463a0b8dd90fd90e5f214b1f0d1d8b76c53552b3a27eec0aa2530da6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940732, "uuid": "08c3f5e3-aad2-4a7f-9ffb-ed65e9eeaa8c", "value": "T1E3542372374A0F555987AA8929FD0F898D3FDBEBAE84DD694F2050330A014FE65B7122", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940732, "uuid": "690881a4-a17e-49d4-bace-e2073e7031a2", "value": "6144:R/jUb7sByjBEjA1yjotxgyW3ISYecQpdkBvOu13RkSrdzGAd:RrUbIByjBEc1y2OyyY/QpdoZ13RkSrdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675940732, "uuid": "6c67a5ec-b512-4f0f-9dc4-9b8214fd6b85", "value": 300540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675940732, "uuid": "3072a1a6-d31a-47e2-b176-7d18cf41872b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940732, "uuid": "7ce0b9fe-6bcf-4016-bd04-a876ee70e8b4", "value": "DSG2011001_INV+PL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fcb7b13-a84d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675928579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928579, "uuid": "e00f0adf-9723-4949-92c0-556e794bd4c0", "comment": "Malware payload (Amadey)", "value": "8a855526eed1b894e065104ab58440b3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928579, "uuid": "e04aefe1-96b1-436c-82cc-96a300e9c7cc", "comment": "Malware payload (Amadey)", "value": "788d4dd5fdc53bf654e98d2ba146e86a6c9d6294ebc19243134ba2e19c10fa8a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928579, "uuid": "92e2b4b2-1d91-4a18-8dce-514d23a0578e", "comment": "Malware payload (Amadey)", "value": "a13e755b7e5bd37516c5b757b36faecf43d6df5d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928579, "uuid": "5ee26430-c552-48fd-9c10-96fc2da15b31", "comment": "Malware payload (Amadey)", "value": "aea59f2ea1b86cdf8b7720c6f5ff4acacb02dcceff6d5bc85feb29043d6b13a886f332a6776391d74074fbb4454e5851", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928579, "uuid": "96b7d916-c08a-49f2-ba36-8cf746dd9f79", "value": "T1DAB40207FBEC8432E9B5177029FA02D31537BD216A388397674FAD5E18B25A4A17133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928579, "uuid": "b0ab3ea5-6e51-4a7f-bdac-70315937da5d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928579, "uuid": "2f00f524-2617-46e7-8eac-4bf68c6df6f8", "value": "12288:2Mr/y90oYnaEbyclA53PNfWS8Bt/YlB5+:VyjEbyceVfJ8Bt/Yv5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675928579, "uuid": "85c021a0-d8e4-4b00-9b5a-d283184896ca", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675928579, "uuid": "1da3a1f0-9386-46c9-8ec6-e0bd13cbeca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928579, "uuid": "00064b97-603d-4c98-91d1-90ce30e29ace", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53f9d81-a84a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675927407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927407, "uuid": "af70651a-fe70-4c9a-90bf-7817b615db35", "comment": "Malware payload", "value": "21c8e2807df58ec1d9bfb730b8eab160", "object_relation": "md5", "Tag": [ { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927407, "uuid": "d6bb8ee4-bc08-44d9-b3f1-4e1d07d27f0a", "comment": "Malware payload", "value": "78b29bdda5218982aa86857a59142ef872c5966194bdfe800658d010f70d4ab9", "object_relation": "sha256", "Tag": [ { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927407, "uuid": "46188c96-4eb2-4c6b-b2a7-3501cd175516", "comment": "Malware payload", "value": "2ecd75ed4b09085bbf2c423e35b9c43fe6bc437b", "object_relation": "sha1", "Tag": [ { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927407, "uuid": "ed3a2888-c6f7-488f-914e-81d80270d848", "comment": "Malware payload", "value": "4f5c0cb00ae1ba1beb1780dab0ecd23c3b21d2f7b72a764d027c836914905d273a33e39beefa7a3aed5ccbe60e9194db", "object_relation": "sha3-384", "Tag": [ { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927407, "uuid": "ef039690-0b70-490e-ba97-98ca0e2401c1", "value": "T12D0523DD28E7F415C63177AEE50221EF661ACFEACBD003D6599B2B3279F2A14601C4B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927407, "uuid": "5efe99c6-feec-4e5d-8563-42f69676376c", "value": "12288:6ABAKtGq+lcTj2ebsf2mZ58amFVDqBHSmVBQRFsQITq5dsWBYdy1a8kuJt9UVcVg:6AH+lq2ywTuVmLBssygdyXKcVMU+ykj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675927407, "uuid": "1af87e7e-8972-4b1f-acdc-8f6b200d4495", "value": 809288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675927407, "uuid": "499b1166-4784-4162-97a7-704b25468d63", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927407, "uuid": "c88f0a43-c734-47a7-b775-404c5caa82b1", "value": "fedex invoice ISP4PgzBmVS7wvC.daa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7a496f-a8b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1675971951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971951, "uuid": "62179a62-8174-4743-940d-3c923711af1b", "comment": "Malware payload (Gh0stRAT)", "value": "28a27bca19ab62de889853b555a24e0e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971951, "uuid": "e32c40f4-e3d3-42d1-9bb6-c3bbc82b0bf0", "comment": "Malware payload (Gh0stRAT)", "value": "79032d8a9385dbb91b40f9da14016aa9a17e03833714bb48226e89010749d166", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971951, "uuid": "d8dc3145-4542-4d11-916f-67e17091ea24", "comment": "Malware payload (Gh0stRAT)", "value": "c04833a962eedd560fe70543f81e185ce50d5802", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971951, "uuid": "c88ad795-16c8-4053-89fd-ed868d15b27b", "comment": "Malware payload (Gh0stRAT)", "value": "abae6ec805a590b95b16629be7ac1945be49f6d6614dbecea45d47691b7212bbe72184991b10a51b0163194140c10580", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971951, "uuid": "a6675d11-9b11-4e42-9d2d-c90903ddc559", "value": "T1BE248C02E69045BBE9B720B444BF7B379E7A95A40B4C5ECBB748D7A104211D1FB3638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971951, "uuid": "0c8d440e-1ef1-4297-83ea-f00204899a85", "value": "a9208cbd352be04e687a14e0dfc18846", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971951, "uuid": "335d86ac-a5bf-4ae4-b7be-21779bd3d0b3", "value": "3072:MdQo6wtIptugitFof9zCPc4Mp77IxZa39TtsAneb/eZJH3tt4TSOB3c7TLby:iQoPIHi0zYOp77aZQ10/6JHzWSOBay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675971951, "uuid": "f998c2c3-0926-4813-8a9c-33e906eebc67", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675971951, "uuid": "1776ef07-75a3-4060-a8d2-2a12d2203fbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971951, "uuid": "0368de84-474e-4d49-896a-f69f5331932e", "value": "79032D8A9385DBB91B40F9DA14016AA9A17E03833714B.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9974602b-a812-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675903335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903335, "uuid": "1856320a-8c6d-4bf3-bef1-f2f4050a6cec", "comment": "Malware payload (CoinMiner)", "value": "41750225bfd34fb69addb9aceecb43e8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903335, "uuid": "9d6e9d08-a829-472e-8a49-878ccd4a82fe", "comment": "Malware payload (CoinMiner)", "value": "7948449cc99e4f19db2b54f27f06ba123c757095478ef4cf6881e67559487814", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903335, "uuid": "06cf1492-6ca2-450c-a4da-9412f8fe29f1", "comment": "Malware payload (CoinMiner)", "value": "fa24c9de5b99fd967401f1cd617b0c40a436093e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903335, "uuid": "bd4b16d9-e154-4abf-9747-a401a3ce2da7", "comment": "Malware payload (CoinMiner)", "value": "8d0de5d5a38991c4af97df648819b4d3bce65624b2b0f833e509a5f915341375c0d83c5220e7972df3e2aa12b7754032", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903335, "uuid": "d6d1596b-a8e6-4afe-839a-b10a15899c75", "value": "T170641A0393E17C80EB2A8BF2DE1EE6E8765DF5608E4AB775121C9B1F34B1172C563A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903335, "uuid": "14f14a15-90bb-4fa2-bfe0-2f3675388d1d", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903335, "uuid": "e73f2700-90fc-4d9b-a279-6437663c1fc0", "value": "6144:FM5uqbA8BvOK4LQvblGaMkxrdwQkeQGS9O:FMHbrdtcKb1Px2Qkei9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675903335, "uuid": "1090826b-798b-44be-9c32-a6b2721f1871", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675903335, "uuid": "ce147016-a18c-49d3-a920-a8a7c116eb1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903335, "uuid": "130417ca-a038-42a6-aa1f-4321e12df60c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6567cb-a886-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675953053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953053, "uuid": "747f7170-52ef-44d1-ad07-1bc3555a3c9d", "comment": "Malware payload (Amadey)", "value": "84e3c3374952c7905e3f5e5ebd31e11a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953053, "uuid": "cf60b2e6-ee22-46bb-a9db-6fee4a53d1d7", "comment": "Malware payload (Amadey)", "value": "7963dc2a72900d6ee19d11673f349f5be2df0ccff6f832ddfe64a67761062ce0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953053, "uuid": "0863f46d-cd47-4cf7-85a9-c7bffd72385e", "comment": "Malware payload (Amadey)", "value": "756576b9e8c94efdef9aade2be325d1eb0559df2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953053, "uuid": "adb7bc35-512e-46fb-b529-96e75046957e", "comment": "Malware payload (Amadey)", "value": "e5822cd11cde29136cc4487510665ca4b3991ccb9e66762dfdea1bc53f654feca56c60c39a3a0f18b615e4bf073801f3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953053, "uuid": "fea01af1-f11e-4171-bc9b-100d4311499a", "value": "T187B4021BF3DC80B2D9B55B7019F713C30A35BDA11B3C929A224F9C5D09B26A4A93177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953053, "uuid": "4dab825e-25a9-4a76-b978-fbdf97b1d27e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953053, "uuid": "bce30b6d-7ea7-4466-b8df-de56ca805f1d", "value": "12288:7Mrpy90Y+BwPBskqZz0lbUwffRChc/zYsjad27YUOqR6xM057:ayFcwZshQlYwfMa3j+fHqR6x557", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953053, "uuid": "3ba2bca2-bfa1-4244-b687-d33267681bf6", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953053, "uuid": "1d10147a-7939-4379-bc46-d37380ae3a7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953053, "uuid": "ed5253fb-6b40-42f5-9be5-a3cbd701f0f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a3830f-a8cc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675983265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983265, "uuid": "dbfb4953-05a7-4929-90e2-0c61a998f420", "comment": "Malware payload", "value": "98e855d6cc4879c19fe9e5b1bb09d49b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983265, "uuid": "69aaf1d1-2cd7-44be-870f-13540b9f6992", "comment": "Malware payload", "value": "796e0eef66d8d922881604da4916cbf8a034990c644e611bf8c6cc2059b48ab7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983265, "uuid": "2ae178d7-0996-4ae1-90ef-0fd81d63d730", "comment": "Malware payload", "value": "564ee0d94949f88a6edfe6fb1512c850391d76d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983265, "uuid": "e759b952-c281-439d-b860-6c1abba1d55f", "comment": "Malware payload", "value": "ab8266143dcfda6e05577427182265290f622ec2e7f0dec9263cb19c44843e06253a7628f68f905d8fed3d9971214da3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983265, "uuid": "3269e043-f990-454d-94f0-ca3edb11283f", "value": "T162B40107E7E88533D874177018F203D7093A7E609A78979B1B8EAD5D0CB25B4AA72737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983265, "uuid": "dd2828e3-ed32-4a9a-932b-4ba7f693262b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983265, "uuid": "7340fa82-6d71-40dc-ba83-e9a1ac7942b7", "value": "12288:9Mruy90W7xdR5lnKN5mZhliz6DmYKEvWIvOkJklvFTx:ry1dkKziUmY3GkJkr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675983265, "uuid": "eba58840-3551-4d7d-8541-a58f856578b1", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675983265, "uuid": "8e218bcf-07fb-4fe4-8544-d81978193f2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983265, "uuid": "6f558f6e-daac-42e7-85e2-39189cb7eb57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b00c19-a823-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675910702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910702, "uuid": "ce290a75-4bd4-4634-87c1-3def89d7165c", "comment": "Malware payload (Tofsee)", "value": "09d889701b3be4a73a1a7a67703b14be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910702, "uuid": "80ddbe92-1c50-449f-8d59-5fe27b4ca780", "comment": "Malware payload (Tofsee)", "value": "798a82f6a6b2a269f87718b2a90e97f53a9d894ea70be0f0e5b12fbd38f1e76e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910702, "uuid": "c62a5c35-05b0-480c-94fd-d62727223ab9", "comment": "Malware payload (Tofsee)", "value": "51933d8e48b254808631ff5d137bf37b2e8c634a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910702, "uuid": "4506fb44-00f9-4529-adbc-c9c7642e1c4d", "comment": "Malware payload (Tofsee)", "value": "c6b8c5823b4993e0c58c59c0c0b97c58fbd2d05903e3b2a6d45ad32abb76ad14d154fcbcc42e56a2c98dcedd7aa8d409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910702, "uuid": "5298b0d7-e14d-413a-bdbd-694708dcaa14", "value": "T15B640A0393A17C80EA3A8BF2DE1EE6E8765DF6518F4AB775121C9B1B34B1172C563B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910702, "uuid": "60983f19-54e3-4341-a449-bb57a1a4a6f7", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910702, "uuid": "0b521f1e-193e-4951-8dd9-9ca861a2efc0", "value": "3072:fPEPvCQSPRdN3mKaAWiooQhOLq8Jld+Ryg8ZSgCQENe+pGS2efz3:fMP5EN3mKgioGHJldmyQQkeQGSvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675910702, "uuid": "5042bb59-1c92-482c-9214-5a9f2519dad1", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675910702, "uuid": "39bbf2d0-f18c-4222-92c0-3dc85660052e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910702, "uuid": "22809299-b2f4-49b3-ad5b-c42222911d07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c691f584-a85a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675934335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934335, "uuid": "2b0c90c7-91c5-43da-bb5f-e69305e9fb59", "comment": "Malware payload (Amadey)", "value": "8fef332f9d4c4434c338ef373dafd125", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934335, "uuid": "4bd69411-628b-4648-94cc-82269009c6c2", "comment": "Malware payload (Amadey)", "value": "79c886eca0aab24de4bad1a35314284e139aa437e7c566fadc64c20eec4f0d73", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934335, "uuid": "7e4a6964-f45c-48bd-a54d-907b64acdfdf", "comment": "Malware payload (Amadey)", "value": "599d8afa9a131805fbeb20a3221885f26008bfc3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934335, "uuid": "a47c1ba3-9a32-44ec-bf00-641762770577", "comment": "Malware payload (Amadey)", "value": "6acf5d77fc51f97e1ff32265f4788dc8d0f3a842d219439e03027097eac20653805a25294684dd9e021ed3974259b8b6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934335, "uuid": "6e285d14-96af-4f8a-bcb4-e4a9a62aee11", "value": "T159B4021BEAE8C532E4B557B01DF706C30931BEA42B35435B274EA95E08732A4B5317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934335, "uuid": "4be77807-0615-4551-bf24-0d3e5573dc0a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934335, "uuid": "6535b1b3-65a5-463c-b8e1-d29c60c6066c", "value": "6144:K6y+bnr+hp0yN90QEQqnuZQo7is+z8DMV+Ypt7Rs9w5oGGeC9soBKQsQtVSj5T9W:OMr1y90aqcQltyuhtt5oGo9tMlTqq8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675934335, "uuid": "542a330c-65b1-4adb-9df9-9adefe34b7a2", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675934335, "uuid": "8b458869-d72b-43f4-a4b2-8f3c0899015b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934335, "uuid": "3a0de954-3959-42f2-a3a9-eacad2a79cf8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e7fbc6-a859-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675933922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933922, "uuid": "a4104f73-dec2-4ab6-8900-c52b53eed5e4", "comment": "Malware payload (GuLoader)", "value": "ccebf5cb91d448310a9c0590cc5502a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933922, "uuid": "19b1fcdb-579e-4c08-9e05-62f65dd55cd0", "comment": "Malware payload (GuLoader)", "value": "7a2a21ab077cb3b982bf1979ee467eb8d9092a203ab09936f5a79ac5f0d3ad1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933922, "uuid": "3c4cc102-2d5d-43a3-91cb-58500a437867", "comment": "Malware payload (GuLoader)", "value": "f89adcf45c10b39ea9c0da3bd5601a1c04a4ffcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675933922, "uuid": "878eb6f5-50af-4708-9551-b66942b9ac33", "comment": "Malware payload (GuLoader)", "value": "169d5f35d6ab7aab3f7483d5939f6e47b32072178bb519701ca8502bd4bd1d02bbc31d262ba5db8f94da46e6eb84eb00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933922, "uuid": "d359510b-fa5c-429a-9437-04d12e5ce596", "value": "T110C4E0574AFED8E1E94D8ABD4995C699A57B8C90E6CB47025F363C3AE430DC32F0E058", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933922, "uuid": "558d125a-c648-4880-99be-5db82835ada0", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933922, "uuid": "bf591137-f110-4f8f-b95f-065d4b41e84b", "value": "12288:qAfnwfpRz4LISOqCStPM9giMvKtqexi39rrftWj8:1YLz48SvCCh+Otcj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675933922, "uuid": "bad9873a-49f7-4fc4-b67c-b200a16141d2", "value": 596639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675933922, "uuid": "d95497f2-cbec-4408-91bf-a225dd49a478", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675933922, "uuid": "b1a45fb2-ecb2-49f3-b2ab-9da235c1d581", "value": "black.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb77fb08-a890-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675957509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675957509, "uuid": "6b5bf4e2-d4ee-435b-8275-0df334cc4e15", "comment": "Malware payload", "value": "584bfb0815404ce2a4545c98bd64e232", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675957509, "uuid": "b502283c-b9ce-4965-83ab-6bd60ccdbee4", "comment": "Malware payload", "value": "7ac6e6c05927543d24011017a129cce02fec97e38cc4a1a8e59b37d8f583b2a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675957509, "uuid": "346e67b3-7803-4fbc-b35e-dcbe4547a332", "comment": "Malware payload", "value": "c5233df1b30efea7da86d3339f27c7bb4d7bf4a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675957509, "uuid": "7c807ad9-a05e-45c2-967f-12b013a71b6d", "comment": "Malware payload", "value": "0221b62e7b34c0fb2edc250298bb29b1d89ce6c8931b4c9ce35e18ea97c709740fd3f7f38f11bf0b872906490e32133f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675957509, "uuid": "016e1a10-61b7-421d-af7d-8a7c581485ba", "value": "T103C37C5178C0C072E47629354934DAB15E3EF9340E709EABB39C167A5F306C19A39EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675957509, "uuid": "bd800af9-4432-4bcc-bf46-4c0e4e5c1ab9", "value": "f3c312995f2346ee13ae5ba9b2c9a9d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675957509, "uuid": "1019302a-c474-444c-b3ce-f446607b044c", "value": "3072:vO9HnbxJtsvSRrKBwlM6zerg+huGCH/c25U/wdijnI3vfqjDPjaqKr:mnJtRoBH6zergb/c6igKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675957509, "uuid": "ae7ff27c-b333-4b83-b5ea-825a0738adcb", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675957509, "uuid": "c8c37699-b80b-47b0-baf5-4ca707164829", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675957509, "uuid": "5bbbef06-974f-4b8b-a6bb-a79ed85132d8", "value": "SecuriteInfo.com.Variant.Jaik.95172.7662.2217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56d6216-a886-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sodinokibi)", "timestamp": 1675953257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953257, "uuid": "fcb6990a-b973-4b30-bc62-3ec83077fcfd", "comment": "Malware payload (Sodinokibi)", "value": "918a5b890f6b160d75030ca89cc5117b", "object_relation": "md5", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953257, "uuid": "9bbe97d3-9730-4425-a6bf-62393a6dab73", "comment": "Malware payload (Sodinokibi)", "value": "7b0673e022585bf4aa208b1e3d215549842fabe78dfeaf9ae0a074a6c05c07fd", "object_relation": "sha256", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953257, "uuid": "9d6e1e48-3e1c-4880-8105-770545cf5146", "comment": "Malware payload (Sodinokibi)", "value": "be0bfac0f56a1e1ce05e49d006d9c7f694983aff", "object_relation": "sha1", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953257, "uuid": "471dfcc4-611a-4763-bd72-70cb8cf6a5ba", "comment": "Malware payload (Sodinokibi)", "value": "e8096dc24ec98a2828f9195d92f018c02c24be4b02c22d410372d436408a7a8a9b501da9b6290a2828e9784d40ec0d97", "object_relation": "sha3-384", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953257, "uuid": "0cea6452-9cd6-4081-a2d0-7dd1cf6461e9", "value": "T1B264AF6FF7C10372D28202F2261F5ED6FB3FA935222A55A0566C805D1367E68933B3D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953257, "uuid": "55600a6c-b634-4c74-bdb1-205f94df2647", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953257, "uuid": "d861570e-9d45-42d5-8d46-c3562e253581", "value": "6144:k9eS63VE6F/M4qE15NENn4F1zZeFHi2WGP4rKcO66HKwYmI:p5RqE1Ta4FJQFfWpK7HKZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953257, "uuid": "94182be8-662a-4631-a029-54819a4410aa", "value": 315154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953257, "uuid": "bbb75560-3173-4301-85fe-123c0b72c88b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953257, "uuid": "8e163b3e-94a6-4045-8118-caa2cf82afc4", "value": "2023-02-08_918a5b890f6b160d75030ca89cc5117b_neshta_revil_sodinokibi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b29b45e-a852-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675930611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930611, "uuid": "31bb49c2-499c-442c-92dd-b464de41c4c0", "comment": "Malware payload (AgentTesla)", "value": "9e82ac2db5119e92fe7daae54c042129", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930611, "uuid": "1602e991-6c65-436d-955c-c9d68f4db566", "comment": "Malware payload (AgentTesla)", "value": "7b2baf3d0f7c38c2e213dd358ff3375f01df9e332cfd5f14739197a14aa5786a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930611, "uuid": "a14df768-9ba8-48c0-939d-076572d2d246", "comment": "Malware payload (AgentTesla)", "value": "aa4102427b09c6a5a26a53be07e99ffd6c6e6e29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930611, "uuid": "25144ce3-8d83-4167-8f59-1d7822e084e6", "comment": "Malware payload (AgentTesla)", "value": "0018316140d6f01a9735051b8637d470ac54b4005c526718940782fc09b0144de853889634adadcaa7c66a837d4a3063", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930611, "uuid": "ceffa994-5465-4563-bdc3-9855a03a3373", "value": "T1316423CF80EC60D39BB79A386ED60F11965486390C6AE5E43242D1A2DBFF3417FD6245", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930611, "uuid": "3a2f1f30-19ca-400b-a79d-e0cd04fc0bd6", "value": "6144:bfiCv30Wq8tgMQam40sSV8LCeGsL1U110mY8sx+Wnx:h9q8CXKnLeqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930611, "uuid": "af4c47f0-3b46-4508-a78c-2408d37a4214", "value": 320669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930611, "uuid": "e8324d4c-68c8-4ee7-b66c-d8285608a4e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930611, "uuid": "146ea6cd-c8cd-4b0f-9314-d245a3f86d83", "value": "payment copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a446f6f-a884-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675952299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952299, "uuid": "9e872abc-0461-49f6-adbc-7ba52c881c12", "comment": "Malware payload (Amadey)", "value": "4cb307d4bca6df34c2d578e08d51bc35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952299, "uuid": "49518a3c-afd0-452e-a678-e73e0e306d0a", "comment": "Malware payload (Amadey)", "value": "7bb23e2779d6249c8caf14eee7447b0dd5e9fd0149a5b7fbd87c13910557a90b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952299, "uuid": "a02f41f5-d003-4e8b-94f2-c6495034c78a", "comment": "Malware payload (Amadey)", "value": "04be7cd4a3e20730d60ad43cd4c466eb47b7b69c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952299, "uuid": "3279fc35-ced0-4441-8090-c4f7f5a640d8", "comment": "Malware payload (Amadey)", "value": "cbe7116dcf8affea703e960c394ac5b2bbadc77ef084c297ab680c35740d92c059f519edd28c4e5b9e074930905abb8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952299, "uuid": "3181f598-b561-4434-beba-e73e263e3afc", "value": "T1D8B40207E7FC9472E9B527705DF703C31B35BEA11B38829A274E9D9608B25B0A631727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952299, "uuid": "6bcffe7e-c5f7-424c-b2ce-2d243a5a47c5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952299, "uuid": "ae373e8c-f22f-4850-890b-95b1329e4527", "value": "12288:hMrBy90P+35LGowILYbWmhHIRFIv5Lwd2Ifeti:kyEoUaYbWmHIFIvYf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675952299, "uuid": "5ff49d68-de7e-47a0-99ff-99e1bd81926b", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675952299, "uuid": "b5bb9b4c-a7d3-484d-a358-606ca9fe8faa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952299, "uuid": "fbb5670a-3da2-4645-b926-f7aa5dfd5694", "value": "4cb307d4bca6df34c2d578e08d51bc35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad646410-a887-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675953620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953620, "uuid": "75d25628-3850-4323-a3b4-ac8f95c860a5", "comment": "Malware payload (SnakeKeylogger)", "value": "16518717490a9378b8ce9e4398c22bba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953620, "uuid": "778d99c2-f7ad-4e53-b128-fdf96badbb3b", "comment": "Malware payload (SnakeKeylogger)", "value": "7bcce65d6166d096b69e5cd5e4a1e6a3991ff77aed3495da1af2b4f9ecbeef93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953620, "uuid": "0fabec8a-563c-491b-b8e2-c483c659570e", "comment": "Malware payload (SnakeKeylogger)", "value": "94199ea9d1227a495d09fc77a63088d25829b022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953620, "uuid": "48c7979b-78ac-4b27-b4ca-23a1a4911dae", "comment": "Malware payload (SnakeKeylogger)", "value": "2741130017695a4c95b0849725072ee619eb2056c582114250e7353d5a8ba6a7867cdad3ff88f6b9d6babcd75077256d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953620, "uuid": "8a911d0d-eaed-4c85-a4fd-83e7a727a24c", "value": "T191F45D243AFE5019B1B3EF696FE47596CE6FBA733B06945D1060038A0723E41DDD1A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953620, "uuid": "ae5f7aab-0f1e-4ac0-8907-f3867a1bfad2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953620, "uuid": "7f2002a1-7bb1-411b-ae9c-8176e179e5e1", "value": "12288:/UNSgr0oFGV/nMA1uSx8AevTsff0a8Gt3w8sqz4XRKyghCS09QPi/4mJoHpqf2wt:/UtwfTo1f7wCtxzfJGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953620, "uuid": "f464912a-1cff-430f-9331-985603c35ccf", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953620, "uuid": "79a674bc-b0ec-4640-ac70-40eaa0a5e79d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953620, "uuid": "03385cf4-8ab3-4288-992a-e227a7b7f7d7", "value": "PO 732001_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909ebbf0-a8bb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675975905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675975905, "uuid": "80cba046-c94b-4b20-8418-0c3f2f8c2daa", "comment": "Malware payload", "value": "5f885b6cb2a3bb34671cd27411e34dcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675975905, "uuid": "9681e295-898e-48e7-abd5-a510ccb4656d", "comment": "Malware payload", "value": "7bf368eb69281afd2f6847d6ac71cfe202ef22917fe373d03b8c519991f3b422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675975905, "uuid": "2e30215a-59bd-41c6-967e-6e0c4346524c", "comment": "Malware payload", "value": "9a9184d17076f1e4abd5e5bdebda45dcf6d011d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675975905, "uuid": "a1d18b0c-0398-4edc-80a9-f70242c9d40c", "comment": "Malware payload", "value": "32e8d93b043f1b6a3db14a87756010b143c3396001bd417e2fc7a8897dfe164038f84bd8d623436027a438c419c8e881", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675975905, "uuid": "9fc40538-7ab2-46bd-97cc-94ce2ee70ac9", "value": "T13214CF1232D0F872C0F2B6305829C6B56B7DB9314A38ABA7775A273F5FB02E19671351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675975905, "uuid": "5d97340e-5783-4560-a22b-fd4def7ac5de", "value": "3ae714bb16df7ea6110fd4db3c856d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675975905, "uuid": "3b543e86-ace9-4f84-847e-580c61a5576a", "value": "3072:GmvxCA3LZUTzRFpUjsOTwZIFLakLn6tFKM6yvstsTRkPYemC:GmJCA16R/UjsOTwZIJ6tFisTRlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675975905, "uuid": "73e7dc3a-e6f4-454e-a3c4-baf9504ce6ab", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675975905, "uuid": "29ca657a-0832-4ccd-b9a6-1d97e07189ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675975905, "uuid": "c02edcb6-9efc-47c8-9b9b-4821dff5386c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06779a1-a81a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675906890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906890, "uuid": "4a68dcf4-72b2-41c5-b726-a53561502bb3", "comment": "Malware payload (Mirai)", "value": "80a14a733ffd2c7fd5f66054191a5dec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906890, "uuid": "461fb6d0-9970-43c7-b3cf-53e1374d24e3", "comment": "Malware payload (Mirai)", "value": "7bf37aa11cb4f8911b94b66e2e47705d7c88747c03cdd70503f319b3dea60af6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906890, "uuid": "40615c4c-f5dd-4329-a66d-f4d8229c1d76", "comment": "Malware payload (Mirai)", "value": "bae4dddf7d43472fa0a63c970b8e4588f6913d22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906890, "uuid": "5c0bb1ca-eb5b-47f6-b776-bc91aae09e88", "comment": "Malware payload (Mirai)", "value": "adcfdaba521df2dbe45d2779f94fe1ffcd8dfdd390432bf47c7b9eab43f58ed00ee2dcd8049593686958a53c5bb4ce65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906890, "uuid": "4e2341da-4d26-44b7-8d1d-827c72e2e7c1", "value": "T12763085AB8918A01C5C513BAFE2E118D331753B8D3DFB212DE106F60778A96F0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906890, "uuid": "5aaefbc3-16ba-45d6-b42a-e77b3380e9a5", "value": "1536:ehn+geJ4lis8JQAzTmSOnx3J7nxczKbCY6VyeifGEMryPKcjSLUIXiVN6WZWP:pgX5Afmx1J1czKMVsfGEsyzN6WZWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675906890, "uuid": "6cca6221-c9a2-44f0-86c6-bb8b6fabe20d", "value": 70912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675906890, "uuid": "96f73dc7-999c-4f04-a682-3f7c908c5314", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906890, "uuid": "e1a51e67-7ee0-461f-8f3f-12ae2a7dca6d", "value": "80a14a733ffd2c7fd5f66054191a5dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b7b4ca-a81a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675906865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906865, "uuid": "d3434b3b-4475-407a-aa0d-94703e240b50", "comment": "Malware payload (Mirai)", "value": "96a0c24a320ded0848c156d8baedfc54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906865, "uuid": "f4975e41-1ce5-4bfa-975c-f17d18169f61", "comment": "Malware payload (Mirai)", "value": "7c8e0c46cd2882ca0426821e1502b3242f851024f38c92792a7fb24b28a89597", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906865, "uuid": "d682b5fe-4b82-4a4a-950b-dc34b82fd5ae", "comment": "Malware payload (Mirai)", "value": "edd427535136577ebe47704c45182d106ad5ebc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906865, "uuid": "009ba8cb-a05c-481b-a77b-181b5af00b91", "comment": "Malware payload (Mirai)", "value": "b01d9cf0e4cd28effafe0aaa4b2a1532a4033276a4cad5a19f43f94a619abe8463393d29d21674bd5da25043a2f6a21f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906865, "uuid": "221452a5-a4ba-4719-aaa6-21501be6a7f1", "value": "T1C473840E2E619FBCFBAD863587B35F209248339226E1D545D16CFA011E7034E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906865, "uuid": "46652347-7a13-4cce-9db7-fce5980d9936", "value": "1536:G4Z8LUay6+vl/R1KIdysUmR9EiYHXwomyJhJqYAFjDETCi:B6ry6+vdGIdysUKNyJhJ3ANDICi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675906865, "uuid": "6739b3f9-77e3-471d-9f0b-011f0075c028", "value": 79804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675906865, "uuid": "f0745d5e-a416-4f46-88eb-8de0725ca245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906865, "uuid": "ed2d288d-9103-44e4-87b6-e03d57ccc59d", "value": "96a0c24a320ded0848c156d8baedfc54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be400402-a866-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1675939475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939475, "uuid": "03391250-15d6-4779-9b52-ecc8de4062a2", "comment": "Malware payload (ManusCrypt)", "value": "913e4d2ea6726c3d7c36c462250872c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939475, "uuid": "77c0da94-8961-4301-9896-bec0af12688b", "comment": "Malware payload (ManusCrypt)", "value": "7ca44b0fffbf47b3d0ab869ca137832224aa3d6d98c29e86587f2defe98585ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939475, "uuid": "06a909aa-676b-453b-9cb7-bee59e379bb2", "comment": "Malware payload (ManusCrypt)", "value": "d57fe09e5ee453c41b218bc590648a4fe444704e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939475, "uuid": "2bae4a28-fe69-4a64-b701-8cb79031831d", "comment": "Malware payload (ManusCrypt)", "value": "66cb54345991f13b9f2b0a71123287d2157e24ab9b348783e0472caf8f1b726bd2b38bf7321fb09ae5e54b4b99eab148", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939475, "uuid": "d1798f99-d9e4-467f-81d3-8976c4542df4", "value": "T17B841243F3E15839E073CEB06C90E962493F79214DBC640836ECAD9E9F3B5829256793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939475, "uuid": "1eb139da-19ce-429d-a0b5-6f1d38fd1982", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939475, "uuid": "4179e25a-54c5-4738-bee9-73c138bee051", "value": "6144:x/QiQXCgkm+ksmpk3U9j0I3MOGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZoglM7LT:pQi3gP6m6UR0I8lL//plmW9bTXeVhDrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675939475, "uuid": "d025d9d2-6f59-4c81-a326-d297a5d6d0d3", "value": 390097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675939475, "uuid": "21ff8551-a333-46de-876d-83d6c820d6f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939475, "uuid": "df3ba997-b18d-4828-812c-a64360e60aa8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505631d9-a866-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675939290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939290, "uuid": "165d8dfc-fca9-44ac-b2ec-1f2c3160721a", "comment": "Malware payload", "value": "212e06f09b32e00b23c428878abed4a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939290, "uuid": "08c87673-4a35-4f06-9522-86e3a1edbd80", "comment": "Malware payload", "value": "7cbfea1b9b50cbfac74e6df1d8e2b364574a6fe2317f5f5f67a01df6707d609a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939290, "uuid": "9ee9451e-43f8-4667-89f9-487cd8697053", "comment": "Malware payload", "value": "26f92bf21a1d7b3bd0ee16999f69d5a2a644e64d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939290, "uuid": "724ad592-6f14-4477-ab6b-64587e10ac5a", "comment": "Malware payload", "value": "2d2aa748d4c936bb75782e9a7ca0abb6235cda163925881904d585a89f9296f06c38c0c0a2d06ebd83d624b0308ee2a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939290, "uuid": "07f20cd7-d937-448c-8f28-5c8818499704", "value": "T11F76332238F4C179D9BA5A33E45967C1E2E6EB060E72492BB3CB6C8F756C414FB1C112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939290, "uuid": "2dd01b04-d88f-4b1c-a0d6-f9c84dd83e13", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939290, "uuid": "4af1420a-e4c0-44bd-be76-064d24e0c161", "value": "196608:91ORWAqJeDkVuGhMkNVOdgEVWIklj3f5usqOP:3O8XCkVThFfOdgEEzl4JOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675939290, "uuid": "59c0fe6e-30a0-4cd8-9abb-861dc9d8f216", "value": 7614242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675939290, "uuid": "490a4204-9750-4689-be69-11ab36352cdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939290, "uuid": "4b285a32-1189-4189-baf9-b85040dc311d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0e04d5-a852-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1675930747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930747, "uuid": "511a5bb0-e091-42e4-9b5a-8831a78a8ce5", "comment": "Malware payload (SystemBC)", "value": "5cacf2b43b8d5578156df066f2181117", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930747, "uuid": "28781423-3c27-4578-80c3-9e10d1d1369a", "comment": "Malware payload (SystemBC)", "value": "7d17668ad7a09802bbf39bd76093ddb9658d74cffaefc3528463b77573802728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930747, "uuid": "cd1fb7d1-77cb-45c5-86a0-782f8efbeac7", "comment": "Malware payload (SystemBC)", "value": "7e4e1385713db3e859bdd5ad6b503e7013b37796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930747, "uuid": "2f57c881-925c-4e3b-abe3-0a7759d6973b", "comment": "Malware payload (SystemBC)", "value": "3287c2f4f93e8d7e0a73acc98fc6125b95d2f69a6fa8aa0341593141e522e1b121eaf46879e123c10f6da8c2ac6bca1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930747, "uuid": "26285304-2c2b-4539-bd47-57e3110671bb", "value": "T116240210B685F809E8556A32CE17EAF94823BCB5AE0543537FF17F9FBF31681AA05211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930747, "uuid": "49a5632d-f5ae-4a4d-ae79-e2c702744cab", "value": "33afd3b272ef3aa125ec56f23f7e51a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930747, "uuid": "344ad06a-23f0-4e17-b588-aabed15cea6f", "value": "6144:YkriDRJpv8UfcWtfJOxM3zeKqjrdySHy:YkwRT8ctROxM3z/CrcSHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930747, "uuid": "eff4d9b3-4d1d-4471-b63e-7e3576e6bcbe", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930747, "uuid": "4e4e9890-98f6-4f9b-b7d6-0f3cddd662db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930747, "uuid": "951aecd2-6517-4f38-9354-e50e0a63b2af", "value": "5cacf2b43b8d5578156df066f2181117.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581a3a54-a8d4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675986548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986548, "uuid": "89559679-2423-421f-8629-a21ec2b127c5", "comment": "Malware payload", "value": "d7c4e9d036216e956bded3dadf2bc46e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986548, "uuid": "1b4ff9d6-1da3-4af6-bd5e-0b73bd29f5c7", "comment": "Malware payload", "value": "7d233e48a09b4508a0b5fd3e64bc14414377b187616eab4c7c88e4e0b7f1292a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986548, "uuid": "6e2a5aa2-f7a7-43fe-87dc-87ac21a4afdf", "comment": "Malware payload", "value": "c3ec2d0c93f6b008b92915ffaa6625c57ce00e4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986548, "uuid": "20082a23-db5c-481d-8abe-637a18f72bc1", "comment": "Malware payload", "value": "6b1395970d25d7d421c62c3bd02ae2769f72db07e58c493c701ff70f1245828f605c30a87ee67b605255b8c90d56d995", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986548, "uuid": "cb92fb18-6f2a-49c0-b4e6-5c7dc73d352c", "value": "T11BB40217EAEC8132E8A157701DF207C31536BEA15774839B364FAC6A08B37B5A236357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986548, "uuid": "b691f054-6794-4fe6-8cef-c56a6bedce6c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986548, "uuid": "7c809fe0-aa13-4724-8081-5f9ae8f45e84", "value": "12288:+Mrby90Ji0slcuI7MJltRFPgxI3AgRwHEKndNaAumfye:Jy0cjtXGIwgKRdNaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675986548, "uuid": "b9481c54-9c25-49ea-857a-a11d3dd366bd", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675986548, "uuid": "2546b068-a4e4-4e6a-8471-0c8da74e0837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986548, "uuid": "4ec24820-aeaa-4188-9ccd-1effdd88f047", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57807a3-a895-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675959754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675959754, "uuid": "d941e8d5-1110-4c69-a5b1-8155a30270c5", "comment": "Malware payload (Amadey)", "value": "aa379b82a4f86f87fac769595f0b3a1a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675959754, "uuid": "cb53ea57-8ad2-450e-92fd-3d4a45c149d6", "comment": "Malware payload (Amadey)", "value": "7d7d35e6ea2272c3e09762b15c86f5d267b65220d68f4e513641cc61e8ea4bff", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675959754, "uuid": "3e79f6c9-d598-4935-807b-2bba387e55ec", "comment": "Malware payload (Amadey)", "value": "7da8d5060e77e3217974a85077ace94342bdea31", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675959754, "uuid": "9d33d642-0344-4058-85d3-6c22504ceac7", "comment": "Malware payload (Amadey)", "value": "1d010013d138c79222ac6c34ad055f4b2c54aeff347ccfdde83f52f1992909e654c263ee308a2503c627267ea3d23610", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675959754, "uuid": "9209f86c-80c9-4f61-a4ce-25b16511f073", "value": "T14CB4011BB7EC9072E8B1673059F606D31932BE616B38965B334A5C5A0C732B4B73172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675959754, "uuid": "d09500c7-7e89-420e-ba2c-75592df17c7b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675959754, "uuid": "44b80326-3c42-411f-b178-5f78870aaf72", "value": "6144:KVy+bnr+Rp0yN90QEu8TRIVxo9nZS1v2EeSDmu1px/uz5bCHlBILaOcFm+vT+CTy:rMrhy90n9IVu82UXDJ02FzDf7+FKAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675959754, "uuid": "babd180d-adea-4da5-92c8-f07ca4b2ca26", "value": 531456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675959754, "uuid": "53d0e0c3-d484-4373-aede-1bff74ad6cbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675959754, "uuid": "b45bfc71-b7da-40b2-9923-95d537a35398", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100fb797-a816-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675904823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904823, "uuid": "ef46bb50-69e5-4e80-9a3e-f1c65893327b", "comment": "Malware payload (Mirai)", "value": "06b7548ef3272db9b09a67c503e3dcbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904823, "uuid": "9c0e5f58-52b4-40f6-801e-e927669e151a", "comment": "Malware payload (Mirai)", "value": "7da89bb8af4a1f78d580dd240154f263b7b1ea66305cdd43370a68584f1134b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904823, "uuid": "049a8f75-3720-468d-ad18-c0aabc2147dc", "comment": "Malware payload (Mirai)", "value": "60abf19b84766cfc828521cfc0e81e7b7d364dc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904823, "uuid": "dd97f099-d7fb-475a-b321-2e04441f8cfe", "comment": "Malware payload (Mirai)", "value": "20c94c3617a9a8c6ba8cbe7836abab20b610b183089efbabdc43e98b0976f2b2bf763b0b7dbc188f0aa2ec5fcc96b166", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904823, "uuid": "d07900b9-c02c-42cd-bf0d-4b0011d66500", "value": "T14A435ED5B800DE7CF94BEB7A80260A09FA35721154A30F27A267FD93AD721564C6FD0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904823, "uuid": "26f090e5-7944-41da-960c-f74d68c43b9b", "value": "1536:PtCdFUWySs6CANPo75G4zCktnSygjVJstg8w:Os7ANmGwLJuJqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675904823, "uuid": "aab03b18-b04a-40f2-96f4-37e8fe7a9c18", "value": 59716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675904823, "uuid": "76244b39-cad2-42e5-a23b-73a1ac20dca7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904823, "uuid": "d3ff200d-b7fa-4312-b783-e289c6266005", "value": "06b7548ef3272db9b09a67c503e3dcbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929e5ffd-a811-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675902894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902894, "uuid": "7894d1d0-bf9d-4197-9594-152d68755b80", "comment": "Malware payload", "value": "0c45fa3e471ab84f6b83d51391bd4ee1", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902894, "uuid": "2b44585f-4b26-4fbe-9840-8cc4ce011116", "comment": "Malware payload", "value": "7dac120310cd3b4837c0eb6aa95446836d046c0f4df384f6faa8d32dde401f9f", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902894, "uuid": "30dc354c-732e-4a33-bd75-ec8696aacf83", "comment": "Malware payload", "value": "93f911b8778a578a3c7881c630778fadf9de225a", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902894, "uuid": "df4442a6-80ac-4aa7-a735-250bd090ae0c", "comment": "Malware payload", "value": "897e18dd2632b8d32159384c94ccd02944ab8e7ebf4660162ee4999babbec91cba8176ad8db1a503b1aa8443be70797c", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902894, "uuid": "efcc5832-676d-4769-a78c-a94cabddc284", "value": "T168B42325F07F0A9792BA6B7C8545E19B3EC8F047F46AB8215BD4113DAE126320C5E6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902894, "uuid": "0903751f-9607-4067-a7a9-9e452cd45977", "value": "12288:1BiK/qTKPf9gUZx+U4raTRPxOPsrA+5nHzwdoSf:rj/qM1dZx+U4rYNxwFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902894, "uuid": "0f7ab1a6-9d2e-4d2e-96f0-9b9de085b4a7", "value": 507940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902894, "uuid": "db328cba-a55d-40ea-bc37-93e64d1a9247", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902894, "uuid": "527315cb-c71e-4b4a-9876-6f31681f7327", "value": "st4rlight32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7181bb68-a887-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675953519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953519, "uuid": "5898372a-0286-452b-8b79-e55e15ecf32f", "comment": "Malware payload (Tofsee)", "value": "8faed2e532243bfd851c6cabb9abe689", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953519, "uuid": "433a4256-0c91-4dfb-919c-f53a25488028", "comment": "Malware payload (Tofsee)", "value": "7dcb669fe4464d835a573be2c291b13ba331626a6b111dfc881774b35671cc8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953519, "uuid": "f77de064-3f12-4916-a190-6b8a3ab17e27", "comment": "Malware payload (Tofsee)", "value": "aedc4394433c25e7de71045506e8c59af5517ac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953519, "uuid": "70e9c45a-3feb-4141-abe7-c5b0310bf9ad", "comment": "Malware payload (Tofsee)", "value": "39bc147c30f1c92555abcd0cdc0ab32f27a6cc83e836a766725ddc292ed5b1682de19dd1df2fd15036aeea329ef3c925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953519, "uuid": "d47b2c7a-d95b-42b6-8d8e-81cfb3fc3dfb", "value": "T19A04BE1232E0EC31D472B6309C69C5B1377EF9214A786A9B3718273F4EB02D19AF6756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953519, "uuid": "e931c3fc-890f-4a99-a657-ec8c47ee49ab", "value": "910163c173a5611f34260e641a94d790", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953519, "uuid": "2f64a8ff-3927-4146-b179-8107503d5757", "value": "3072:xfQY9GWyURE75yHwd+y7TqwJZ8EkeK6lUJADpCQG:xfRd+78HwP6wJDkbfJIp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953519, "uuid": "04c4788c-3b67-4f74-95bd-ee651d118224", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953519, "uuid": "437ef3f8-4647-459c-8299-4ff33c24542e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953519, "uuid": "114a323e-7c79-4344-bf52-440fc59ca903", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad44c9de-a81b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675907234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675907234, "uuid": "05841656-f6c4-4a68-8fa6-7e987842d575", "comment": "Malware payload (GCleaner)", "value": "63e51330e326024caf1962a6b3b639c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675907234, "uuid": "1ea33c91-2f8e-4415-abfd-ea6f832fbfd5", "comment": "Malware payload (GCleaner)", "value": "7e4dcb69cf7174b50b8122296afa5b84b8aaad494a0b748e4f81b7cbcd86d7ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675907234, "uuid": "dd485df8-94dd-4b26-b756-5c3a6b70996c", "comment": "Malware payload (GCleaner)", "value": "a78a5948a9dfdbb00652e4998d1ed86095506112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675907234, "uuid": "5d1c88b7-9b17-4824-9d91-4e44fb9d815a", "comment": "Malware payload (GCleaner)", "value": "360c77a67fef93290fd679fdbffcc4be4e71b383cb9d33d318b98f39ac93432e97ce83f9ae1a67e98fe170431aae723d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675907234, "uuid": "2658c8cd-44a6-4685-a82d-a112068b54d8", "value": "T150C5127C7105C45EC680BEB48C3AD4E75CDA2DE3E9E4A52270DD7F3F52792885A0A21B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675907234, "uuid": "3e35393f-c414-49b6-84aa-67046aa3d448", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675907234, "uuid": "47368845-fc7b-46d8-a9d9-ccced05bb3d3", "value": "49152:rdHeWh/KqwzXnK/+uklho5E3sYY6LDEZM4SqX8gWGSsBeE9y97TBVLCgv2MR:JHrh/KqwzXnyPklaRYp4SqX8gWGSs99k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675907234, "uuid": "cbabad48-7dd6-4586-b09d-418feb9f7562", "value": 2708611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675907234, "uuid": "b8b525be-7f8e-4a5c-9bee-91c82d48d46c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675907234, "uuid": "f5e193bc-bc66-4172-a5eb-1002e1a25037", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1d010c-a87b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675948326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948326, "uuid": "19e48638-fba3-44b4-a270-904b2802b845", "comment": "Malware payload (Gozi)", "value": "9c343a1007be4bd9b22c13ee5b404a23", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948326, "uuid": "94c3b3aa-c43b-4d96-94db-9554978006dd", "comment": "Malware payload (Gozi)", "value": "7f37295cb201aab2e0e868f2737b7a4775565caa38cc0fe7c05a2e8d6a74cd90", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948326, "uuid": "d47ae534-07ef-459a-a129-410c3f8b4a89", "comment": "Malware payload (Gozi)", "value": "b250d32756eba1faa59135300d5fdf78a34bb62a", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948326, "uuid": "a53ce069-e339-43e5-867f-629b0e15e46a", "comment": "Malware payload (Gozi)", "value": "b41a967e639a2707d513d9a8f512494865f565dd94b72ba3034d11ec96c36cddd3dd469f3f85f5c68470d5da36e09a03", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948326, "uuid": "a1fce50b-48a8-4710-bf49-bf0252af8e97", "value": "T163F05C948F004B26C005C5B6D9C38176B762520E2977B8BB1149452F81085DB065F1AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948326, "uuid": "52055d6b-fd73-46ac-b9bd-6fccfa2f3ff0", "value": "12:5jocZr8lFrN8+OnXeVtJDWBj83gAyJCry22QlirN8+Zh5tJ:9L+yZnXeij83vywy/yM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675948326, "uuid": "13bf27b7-f6e5-45dd-8f6c-4a169b408d51", "value": 509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675948326, "uuid": "60a79037-565b-479d-b5fa-cd051c5a6240", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948326, "uuid": "51baddec-ab1a-427c-a69a-390bb9ad612b", "value": "AgenziaEntrate.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0af8bb9-a862-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675937734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937734, "uuid": "38c475a9-63d9-43cf-bd0c-dd95a96eaabd", "comment": "Malware payload (RemcosRAT)", "value": "717445cae48a9d1f360cbb33ebf6f13e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937734, "uuid": "36a4ffe8-cec7-4414-a1a2-e59686ee2820", "comment": "Malware payload (RemcosRAT)", "value": "7f957a63ff320cf43b53f9f8e7a11ffd327c12a63704cc7fdf11a9a1111ed8f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937734, "uuid": "ef032d78-d669-4014-ab89-cfaf56f5235a", "comment": "Malware payload (RemcosRAT)", "value": "62babaeb13830077f391e02e5549338361e634c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937734, "uuid": "51d5e566-8205-42d3-bf81-417d6a3aef42", "comment": "Malware payload (RemcosRAT)", "value": "67188d1a8dfe8b27d0ff36b13a2538796b8082b8cb01624f728ceb7130e970a46e560330c427afd2e6ea49775f0fb4ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937734, "uuid": "c24ff2bf-04f8-4a44-8190-c69734ce7f99", "value": "T13AC423453A81F78BF0D1C5328F29AE7456E39C391816975B23007E2F7F61682AA9F349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937734, "uuid": "b370cd31-f2b5-4069-91b6-267985627a12", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937734, "uuid": "094eac5a-52c6-4ffd-9960-14ec5d118cdb", "value": "12288:+YbZtLo6pUwdDF0jDqRqctH1UO79pwRpkF0gaC:+YbZVxUwdDF0fQdH1xhpwO0gh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675937734, "uuid": "a605c7f3-a075-4826-bb3c-3ac6d9d274d6", "value": 567534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675937734, "uuid": "0442b962-3ca1-4278-892b-80ec2a7c892e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937734, "uuid": "bde0e797-51b5-404f-9ff0-e8bcd434a047", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec747fcc-a84f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675929674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929674, "uuid": "3efc2fb2-708a-4d1d-bd28-1b7778c8498f", "comment": "Malware payload (Smoke Loader)", "value": "7ff972b22c38b488c9bd8faaee20f191", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929674, "uuid": "dabfa047-e675-4ff8-80b5-453cab602c47", "comment": "Malware payload (Smoke Loader)", "value": "7fbdcce122af8b4fe1638f1ddf87c738a7499d89d52db78d3f86a812171b6454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929674, "uuid": "65eae2a4-f37a-4319-870c-c816f35f8ba4", "comment": "Malware payload (Smoke Loader)", "value": "70cc8dfd8fb9a70acf149627ca0a5af48bc869cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929674, "uuid": "3281fca4-dae1-48a6-99e2-9e8bd9ef687f", "comment": "Malware payload (Smoke Loader)", "value": "e521866412fd5b3aef6b566971c88ec545917183f0e5ed0819d2191e90fa6e57e667751f24c0401b606444290b57bd8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929674, "uuid": "d71f784d-6d57-4f1a-8d3d-17400e2af2d8", "value": "T1C214C032F6D0C072C17A14345860DAB977BEB83156B9894B77AC3BAE4F713E05636386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929674, "uuid": "f2c33785-94ac-4143-a639-8ba7aeaf0fd5", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929674, "uuid": "9607117c-b9a4-4069-8d08-887bfa2ca4cb", "value": "3072:nGsO7VZUS5qUw1LmblWuzd5TaXC7v6lTj8ViAXFj6rBQWL:nGschoL2lXSD5jwHj6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929674, "uuid": "68bf8514-a5f0-40c7-834a-a7fd946db81b", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929674, "uuid": "ee3c09ec-cb2e-4e4e-9a96-f81e191b0ee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929674, "uuid": "ca843aac-5760-4107-9f92-25d533eb3a04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3cc476-a888-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675953997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953997, "uuid": "59d17620-8886-4218-b406-20b52aa2d5fd", "comment": "Malware payload (RemcosRAT)", "value": "39f81bccec8d7503c13e8926e27f1928", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953997, "uuid": "3b3f981b-4163-4d32-88c3-36ec68e36587", "comment": "Malware payload (RemcosRAT)", "value": "7fce1a191ece0edf0982a5bfae6d6d2751c30b5d49f31d5fc39b719c25c0ce05", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953997, "uuid": "cabf6bb6-5021-48e8-bda5-513cfb33b0bc", "comment": "Malware payload (RemcosRAT)", "value": "d46dcc628454ba3314c50337c765bdd9cde56fde", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953997, "uuid": "8ca9cb20-5e63-44ab-8c55-e1d20c7acfde", "comment": "Malware payload (RemcosRAT)", "value": "91260b5624b0b0a0852c887b8da6dddfa2ac1f4aefce169316a7709baada5dd68412fbb187c18554bd1640bccfa2a6ec", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953997, "uuid": "44b1d1a6-0aa2-4cfa-a4cb-80dd57a3f3e3", "value": "T17AE4332F51524330DB0BAC3B43A30AA99579BE227A65D4DB6C38143C9D3F6E91C05E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953997, "uuid": "0e775dc2-fd50-4149-9b6f-d2957df4281b", "value": "12288:U/h92rQpr0R6155Q88DAefA9GM+6ZhEm2oVv4xMT6AGGudwWgxArX:Un2H44bM+6ZhEkV/GGmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953997, "uuid": "448ad22d-aef7-44d3-bc75-4576ee089060", "value": 709548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953997, "uuid": "547f0698-35f4-4663-aa54-86971f2353a3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953997, "uuid": "9937e7e9-0502-40ce-a4fd-a690289c7a9a", "value": "PAYMENT345678.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce7c824-a83b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Satyr)", "timestamp": 1675920735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920735, "uuid": "ab065f80-e563-4f43-99e8-3843f0b9d37f", "comment": "Malware payload (Satyr)", "value": "f31d6529ff4ad98053f9a8a9832f95e3", "object_relation": "md5", "Tag": [ { "name": "Satyr", "colour": "#E00564", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920735, "uuid": "34dc04b6-639e-4c1e-b820-f81e366f8101", "comment": "Malware payload (Satyr)", "value": "801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e", "object_relation": "sha256", "Tag": [ { "name": "Satyr", "colour": "#E00564", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920735, "uuid": "9faf97a4-8013-44ba-bbcc-5c029500e92b", "comment": "Malware payload (Satyr)", "value": "abdd5ce48e2d11a4c82fc90d9e9beeb14b437cee", "object_relation": "sha1", "Tag": [ { "name": "Satyr", "colour": "#E00564", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920735, "uuid": "b1721945-cc40-4735-ab78-6ca6d5199eb5", "comment": "Malware payload (Satyr)", "value": "1629350abf9dca5dc3135d80430a77c8df0f9576f23d41b2133a80aeddec492f81433af0470730a9cf42244a5d11fef1", "object_relation": "sha3-384", "Tag": [ { "name": "Satyr", "colour": "#E00564", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920735, "uuid": "a8c150c6-41d3-480f-b94b-08433c5f92b2", "value": "T126820A163BFCC332D5BE2BBA69B265400775FA839839D72D1C85218E5D137488AC1F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920735, "uuid": "ccc979c3-0985-4449-9b57-a74905dbc23e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920735, "uuid": "8f1e62d9-41c3-448e-8e52-0fb8457a617f", "value": "384:imwIxiBDXgRUV7JCGgmxt8mvA4ILbfNGHEDPUw3rXTXLazK:i6UVl7twPbfg2Uw3HXAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675920735, "uuid": "1556a79b-fc31-43ca-a7d1-4ac7aed2f8af", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675920735, "uuid": "3efa2646-efe5-4e4c-bba2-80f2384381b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920735, "uuid": "d960908d-ba65-48d5-ab04-50dc23545ee0", "value": "801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50520fdb-a8b0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675971073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971073, "uuid": "d0be96de-4de6-421a-a184-5fcd3b1a7fc8", "comment": "Malware payload", "value": "14433742264221d726e8ed16553ea7e6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971073, "uuid": "f54cbc5c-b97c-4250-bdf9-18cdf5210676", "comment": "Malware payload", "value": "80244502717c6697f702385be0f92731b7a7bbd741d1df92330870050bcfb28c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971073, "uuid": "6408d74e-7e9f-444d-949f-8ba74c330380", "comment": "Malware payload", "value": "f7c329e32f25f06fe8672900d60eb825c5ddf3de", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971073, "uuid": "21dfaf18-863c-4437-83d1-ffeffa72bc56", "comment": "Malware payload", "value": "f1ced046dae71013723a7dda8959306f2e12aeb087fec14ec29d46badf342ee5fb2bb5c4332ecaa640d846bf127f89c9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971073, "uuid": "df669734-7eb4-449c-a13b-b548cf54d12f", "value": "T1A211ED3A3EAAE92DE14771B2C772530ADBAA30481B5A92471D8A10246D94A4E1786FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971073, "uuid": "a4604f92-4a42-4615-92b7-fc9a3ece85d2", "value": "24:9vKGtvlYQTvZpOixvbzLTSFj/5jv7rH358EYwOp9xJ4J4xDj/YWpi:9v1tvKsvZJP+p/5jv7b3969xJ4J4xDja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675971073, "uuid": "a6c22d50-6e89-4454-ba0e-d62adda0ddc8", "value": 1036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675971073, "uuid": "72136e82-789e-4847-a91c-fa067bc9f7ed", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971073, "uuid": "500d11db-2f1d-47e9-af97-ba4f03bd8cbd", "value": "local_policy.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ac7469-a83b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675920723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920723, "uuid": "defc315a-51e3-4e98-bc08-fd60a31dfb30", "comment": "Malware payload (GCleaner)", "value": "e79468e3f6ccea051273132fa4bafb71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920723, "uuid": "8cf4ac53-d62c-4a41-a7e0-b3b103c1bf1b", "comment": "Malware payload (GCleaner)", "value": "805dd517b43a7a9092db1210c3a06fe09e14f65a530381100e15bf0e1224d5ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920723, "uuid": "c49a89b3-1895-45f1-8f15-6bd10504dd33", "comment": "Malware payload (GCleaner)", "value": "3ef42e3751984c900115d02b37d3f37b8992ede3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920723, "uuid": "ea5913ff-46b4-4994-b6fc-533d5cb12363", "comment": "Malware payload (GCleaner)", "value": "c9d5d8a533742df41cce6a3d6a1afb41164cbd78615955d8bd1b98d3c957e103407060f679d8ed925f630caa71d9edaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920723, "uuid": "4f103808-1af3-4b11-9855-b3ba5c1d07b4", "value": "T12BC5127C7105C46DC280FEB4883A95F79CD76DE3E9A4A11270CE7F3F62B91849A1A507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920723, "uuid": "e3680772-abea-406d-97a9-92d3fe42c2ce", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920723, "uuid": "984ff1bd-6065-4773-8c05-037b6da785e9", "value": "49152:rdHhIQm/oLSSvv+KTEcyhdYup5zC6KB44c4iut8npVJ5cQ4HP9DMM/LCgv2MR:JHhimvvFAca7e6KB44r895cQ4HP9/v2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675920723, "uuid": "26fcf1d2-b9d6-4fa7-b2e2-333702090298", "value": 2686279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675920723, "uuid": "56356443-4e0c-46f5-8687-f785aec2757d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920723, "uuid": "797a6406-0857-45d3-a050-aa4e749e20d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078e1c40-a897-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675960213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960213, "uuid": "45d638b5-c8af-4259-bcba-6da94dbf0953", "comment": "Malware payload (Smoke Loader)", "value": "612a98ccb8d4d00e2e38c9ffac4626da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960213, "uuid": "b4feea0f-0619-4527-8c66-617010411caa", "comment": "Malware payload (Smoke Loader)", "value": "8068ce6b0c5877ccedc9070e47b4f4a7fddbde90d56e30f67924729fd6bab593", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960213, "uuid": "f85c43c9-5686-4c04-9b96-f627d8018af0", "comment": "Malware payload (Smoke Loader)", "value": "27d9ab8bbb79c498238535a5cd93695ada5e4414", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960213, "uuid": "39059b96-a1f3-4d58-8af5-e89363f664a0", "comment": "Malware payload (Smoke Loader)", "value": "199817adbd64927a3e61658223477a7e937b756c05aa56175b4ecfc81e2bd2a2d4b75165ab6fe3d5f8bc51f33469a912", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960213, "uuid": "1800dae8-048c-4006-89d0-2bd2ec648af2", "value": "T19E14CF1332D0E871D072E6318C6BD9B17A7EB8214A389ABB7758277F0FB02D196B5351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960213, "uuid": "b4b92640-8548-493d-9b71-baa16041343b", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960213, "uuid": "60185748-2d85-4db3-8f63-2df8b9a6a5fc", "value": "3072:TFgNT2znITO2LMWqKvNM3DNH2m2VcuNeSqkSnvuw1Wvj9dBiePE9pK7KpAn:TFZ7ULlqKmwm2SuskSvh1qrEK7Kpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675960213, "uuid": "f13411eb-3697-47ac-9b57-4745c5fd57d8", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675960213, "uuid": "b6613efe-ccaf-4cde-b479-a6f07f79d439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960213, "uuid": "ae54b6c8-e0a6-407c-9273-63d918f3b2d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035bcf28-a85f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675936155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936155, "uuid": "f3e1347c-1a6b-4192-af07-d10f83efc91e", "comment": "Malware payload (Amadey)", "value": "3e92e3dc0638bad48a708ca10a3c7ae7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936155, "uuid": "72fc0f21-f653-444a-a63c-48796337286c", "comment": "Malware payload (Amadey)", "value": "80f6376e31b4a05829f654abb9a61e4a46dde84393433b8745976bbec787c900", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936155, "uuid": "212b3c86-e863-463b-baee-3b5328d0296a", "comment": "Malware payload (Amadey)", "value": "650c08f93e28aec1deb0d23f58f9e6c697e23842", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936155, "uuid": "cc60993a-e1e2-4499-ae82-1fd715ea1be1", "comment": "Malware payload (Amadey)", "value": "c5bfe60ec1d75e8c56b33298b7b8dfada6cb8323cf035443157dbe025064f71c5ebe003b3e2adcb2c70847f1e21205d6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936155, "uuid": "06087cd3-3711-413f-b1bc-755f466394ab", "value": "T198B40107E7EC8032E5B553B049F607C31A3ABDA05B3A475B234EAD1F58B35A0A53176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936155, "uuid": "8a75482f-6e71-4725-bc08-e0bf75d71901", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936155, "uuid": "35c266c9-49e7-4545-980e-31fb2244b13b", "value": "12288:9MrWy903MmVn1CZZIS/eS/0CXsY5oGobTHisa75rx:/ywJd6Iye6LF+THw5rx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675936155, "uuid": "20366c32-199d-4aac-b63c-5bdc475870e1", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675936155, "uuid": "f26f81f7-99fe-47df-b55a-92bd3d6878bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936155, "uuid": "cc9c24fb-6396-4c8f-a8b9-01391b9c40b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38367f96-a824-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675910903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910903, "uuid": "f9cfe1a3-5c04-4f3d-af72-5922a2a3a536", "comment": "Malware payload (Amadey)", "value": "dd8c8b0e72ae5e8b4aa65d05c5599e74", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910903, "uuid": "1b455c20-76ad-43f9-bf4a-d010af2e742e", "comment": "Malware payload (Amadey)", "value": "81c87773f7f1c9f80c16b4c185e773303cbf3b0f2fb704328b59ba77a430f846", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910903, "uuid": "ac3784b7-fde0-4661-913f-f6220b1fec46", "comment": "Malware payload (Amadey)", "value": "118a79b3f087f306e743cd73e2e43428898485f4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910903, "uuid": "c5a96866-d671-40b6-ba30-418c052e7a6e", "comment": "Malware payload (Amadey)", "value": "04f4a7a81c96045f29452a056b758f004b7392bfe0f4adfd7d20153e3521af5556b1d07e6184c0198e7b4b267833ca34", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910903, "uuid": "76ce0cdc-9de4-41bb-9ce0-b8caa4ded454", "value": "T121C41243E7FC9026ED745B706CF603C31A32BEA0463C875A638E6D4A18336B4667576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910903, "uuid": "1333dfa9-f0a5-4bac-a0b6-977d476d8d9b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910903, "uuid": "02f934ee-1809-44ba-af12-d74a7f529451", "value": "12288:OMrry90pCBSVbN2/YxRvHcr8BLFBn7D/FpU91YmU6:dyLkVbKqRkKL7X/Fpjml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675910903, "uuid": "0b32c7fe-3715-4378-aca3-758f0b7f28d6", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675910903, "uuid": "25e42992-1ad5-4274-8aae-cbd7687f4e71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910903, "uuid": "46271ab5-5311-4e45-b927-baf053985051", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfce5e1-a887-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675953647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953647, "uuid": "86e8fa35-1c6b-400a-a1ab-0e4959e6394f", "comment": "Malware payload (GuLoader)", "value": "d74fd6ed07181f2d8c67708af84a0342", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953647, "uuid": "2baaab02-6fb5-4666-87f8-0359f415ba83", "comment": "Malware payload (GuLoader)", "value": "8214fef9e3cba373f5c92b48fe8535760e67cad89abdf07a7d60f69b2c37a018", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953647, "uuid": "81287a02-431b-4889-9a94-c82f273470f0", "comment": "Malware payload (GuLoader)", "value": "8a564e7c684069e6ab5f72faa1a7fc5e25985cd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953647, "uuid": "0634d5ac-f936-4022-a5f5-cfec784782ec", "comment": "Malware payload (GuLoader)", "value": "7c4b442bbcb1850309e89266d464488e814aaaf88f80ba1f2bdfee4fa2bbd48c527c89b7c3dadc346083c3e605bcebed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953647, "uuid": "1cd7fa78-8419-4012-a572-6a99e9229055", "value": "T18FA449D2B845528CE9795E73B12B1C2217751FBA662C101CB6CC368D09F91723EEF86E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953647, "uuid": "bfcbd920-2b30-4a11-980e-60d72aec3a89", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953647, "uuid": "95c92db6-0a91-4416-bf7e-76bafcba7631", "value": "6144:qp0+DpuPJFjJYILWt3NwuLk5TvTobml6n6HOxLNoQyhocxiDLW9M:qwFjJnKlNwuArobmljULUXxiDLiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953647, "uuid": "273f7f4e-bbc3-4ed5-91d7-9041da131123", "value": 460352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953647, "uuid": "8f4269be-518c-4734-a9cf-8aaed25a6e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953647, "uuid": "27d806a4-ab34-4933-a117-52c60d34f908", "value": "LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf6c499-a818-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675905702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905702, "uuid": "7bb8526b-2fb7-4564-bcc7-3d91ade72794", "comment": "Malware payload (Mirai)", "value": "7375fa145ba100ed42aa87b832b0556b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905702, "uuid": "c0cabd11-5153-4b2a-98fa-24a6a3dbe3d4", "comment": "Malware payload (Mirai)", "value": "8221ab60378d65fa0ad8cd8eb3f6fe03a759bfe2b4248edc2ee171f8d56b3ebb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905702, "uuid": "a0cfe384-06e7-4978-9ca3-69b998b77ed4", "comment": "Malware payload (Mirai)", "value": "ba25f6534ad7103af6f08b3c3e6bbceceaa483d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905702, "uuid": "a9b974f6-7849-414c-9c04-6cf0e132ce0f", "comment": "Malware payload (Mirai)", "value": "25e585544560cf1c19d9b98c0dd100752e8bc43c946bfb582c422cabc66ededb022fe9e57c985e608dbfe73f8e224aed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905702, "uuid": "be887683-6c5e-4090-adb1-88ec595198a3", "value": "T18F639E7281B9EC68D18809B8B5A8C9789713B5045AE73EF2DA04C796A40BDFDF10D7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905702, "uuid": "6bca1b98-d6cc-43c1-b339-3d01cca67cb8", "value": "1536:P/MwZrjavhCVNyWLvN7yjsbI3w3VQ+pBP8nsCdIq+1:Pk+vkMDyWQjseKVRpBP8nsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905702, "uuid": "076abca3-6584-4e10-b310-c53137fb453f", "value": 68612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905702, "uuid": "02976abf-5b49-436a-80aa-c2507fea7db7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905702, "uuid": "56048ccd-62de-43e1-a700-1c7bcdc3cdb9", "value": "7375fa145ba100ed42aa87b832b0556b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d3d6ad-a81f-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675908855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675908855, "uuid": "28e21bbb-d031-4e55-8452-cf830bbece37", "comment": "Malware payload (LaplasClipper)", "value": "4b952834599b9a867a3b62bf6ef1c1f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675908855, "uuid": "475e4d7a-fc9a-4c3e-a2c3-2d501f0d193e", "comment": "Malware payload (LaplasClipper)", "value": "82d011953a7743aef8d380c46177a5c9c9c56e0d9408f47a11eb7443be912e51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675908855, "uuid": "7b56f398-ccba-4b74-a2aa-15827e8978a7", "comment": "Malware payload (LaplasClipper)", "value": "fd8ca7a180a3ed308a14dc9f627f1031043cf212", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675908855, "uuid": "74c7ade3-abea-42c5-a24e-f2480d9e245d", "comment": "Malware payload (LaplasClipper)", "value": "f1841e0309c53c5d574fbac2a53f8cabcdaf34d9a0c31372aa3d79bdad2c29f6f71822583067158bc8b3a756a2fb6624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675908855, "uuid": "33712e71-ab14-487f-aa9b-b9677f18244f", "value": "T19F95121393937C80E966CBF2EE1EE1F8765EF5418E0ABB6511189F2F34B2173C562A11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675908855, "uuid": "30090a97-6176-42d2-a489-396a47496e29", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675908855, "uuid": "55b2d5e1-0d5b-40be-aba7-2d5bfbf05ff9", "value": "49152:L5V4A/XG5bp16JpYsrpquWxtrotebt6m9MNu5TXp6bGdoWYXe:L5VLUKpTF4rAmW2TXgyduO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675908855, "uuid": "d7622c4f-e923-4c2b-87b2-5b6047d9a57a", "value": 1991680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675908855, "uuid": "d039ff23-d6d2-49ac-b091-ae766c257f4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675908855, "uuid": "42e87426-57f7-4853-9d23-220e97b420cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44a572e-a831-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675916775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916775, "uuid": "50d04d3b-b2bc-4022-a87b-06807ce04edf", "comment": "Malware payload (Amadey)", "value": "e0d0c3d27f2458903d3f557ac6372032", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916775, "uuid": "65ececfd-3ddd-4644-a039-d40687b4825f", "comment": "Malware payload (Amadey)", "value": "834e5064629b650ad696109a835d801c4d63cec1752a8ebe61704a20647d8447", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916775, "uuid": "6e612294-66a2-40e1-b620-9f3b5e44e730", "comment": "Malware payload (Amadey)", "value": "481b96b377486db80d8aededd211137cc2645d38", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675916775, "uuid": "0c28382d-00ee-4804-8d89-3dbec3b7aa4f", "comment": "Malware payload (Amadey)", "value": "9f49e9066d7cc98f8346a08f65cc7d6611c888a4a278de808e0cc636d4a15978008789721b90caa1c792192a469bc8db", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916775, "uuid": "12ffcf61-dd74-41cf-a22b-365882333a63", "value": "T1E9C40207E7D84123DCB1577059F603D30A36BEA15B3583AB274F2D6D18B2AB0A63179B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916775, "uuid": "97efe8d7-3bd5-41e8-927a-db76294406d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916775, "uuid": "e9a0e468-4843-46a3-a0d8-a782bc84ed67", "value": "12288:MMrFy90lX3ej/kULKlnAzU5pVhtLK6iI4GCRDuYR02Dll:5yGu/k2VMfK6dSE27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675916775, "uuid": "315cbaa4-3ce6-488f-b27c-73f02e12e976", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675916775, "uuid": "aee7caa2-64e0-4852-9f21-f129887c568b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675916775, "uuid": "4bd4d7be-fa81-4af7-b17c-11299df8a7da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d647a3b9-a84f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675929636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929636, "uuid": "cffc4a56-814e-4851-8a91-2ef993ecc671", "comment": "Malware payload (RedLineStealer)", "value": "fae4a00bfddca84f1f568c4104596123", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929636, "uuid": "1c6a910f-7950-42ba-a323-d6cfc7a8fa55", "comment": "Malware payload (RedLineStealer)", "value": "83597e21dba6e91da62f5ad48ef0220787c5e18c8728b05e7417840bdfd94a46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929636, "uuid": "661b2ae1-3b90-4d1d-94df-9bb8c9e0db43", "comment": "Malware payload (RedLineStealer)", "value": "9ee932c9adc8acb12390b958ef3e8ba805dccd87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929636, "uuid": "79c24867-8d18-4782-9f58-1fe2a054031c", "comment": "Malware payload (RedLineStealer)", "value": "edfe4e4a59a455b20c16695db946ea3f8bf5fab85fcd5573168e19403cd57eae2a734f21cd1f949f8da290d34c5a160b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929636, "uuid": "0e6f16a7-d7e9-4380-b4b4-4946d483ac6b", "value": "T19464F12239A0C073C0565574A835DA96ABBEA830367449BB77A727BCDF303D06B36356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929636, "uuid": "942aab6b-c1ca-4816-bd90-6fbaec6e1b70", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929636, "uuid": "ecd2201d-a294-420c-8d73-21736ae016f9", "value": "6144:uql2qSL+qj5y0MR13hnD14svrC8BDhvfG2z03:uql2qSKqj5+jB4AVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929636, "uuid": "9efb618c-4831-4ccd-b410-0c216215bf1d", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929636, "uuid": "0c8b61b2-ba18-4597-8c27-53181e9f1692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929636, "uuid": "49ee2b00-c443-4bc8-bbe7-c23df469550f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008ad95e-a87a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675947746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947746, "uuid": "8cc1b273-81ee-4eb4-ba3f-4ccea299c0fc", "comment": "Malware payload (Loki)", "value": "9440bad2a57747bf88aa508e26485ddc", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947746, "uuid": "05e92ac2-b459-4963-b930-cccb37335b69", "comment": "Malware payload (Loki)", "value": "83b5e2491136b593198de29997b791e88e7d5a3e6472caae44902191e6266e52", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947746, "uuid": "ba196a66-85d2-4e30-b270-498d4e9f1a0f", "comment": "Malware payload (Loki)", "value": "a3242607f6570536eafda3b6f4d3f30da560e2f5", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947746, "uuid": "6f824793-2604-4cda-a9ff-e245ad46ef64", "comment": "Malware payload (Loki)", "value": "0815fbd215a5962fab51ec8a6e270b0a37378ce7be5ba7ac520cceb5529be479a38638c2b392e74766f19acc7f9848e9", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947746, "uuid": "68e12e32-6c40-44b8-bbc2-1e280b56287c", "value": "T16F35E007E57AEE26DC23C57CDC4F108282529C79B914CA4E21C3BB1E9636BF5593EE60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947746, "uuid": "13f38d18-dc8a-4280-9593-0ffd0d3c8aaf", "value": "24576:bFefqLFRIcBFe3MdGoo5ncQVSyjAcZDek:5lpzGEtQV9fll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675947746, "uuid": "0a0aef6f-159c-46da-ac31-5ab5a49c6673", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675947746, "uuid": "30facfc8-6cea-4b87-9e2d-21c8cad3008c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947746, "uuid": "2b3463f1-2ece-44ff-b848-ca4e5b6493d9", "value": "REMITTANCE ADVICE [REF0000360261].xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09797a20-a86e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675942607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942607, "uuid": "3095958f-8b26-4e05-b833-5e365dfa76d6", "comment": "Malware payload", "value": "d7f4751e0cee2d8120bdba38bac7c464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942607, "uuid": "769295e2-e319-4eb7-9641-d2e950737725", "comment": "Malware payload", "value": "83d072c29de9ede240bd1a69c347f8fe7f42a3472dc2a1fe404058e1cf7051b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942607, "uuid": "0cd7f51d-4997-48e8-a845-7b93302719cc", "comment": "Malware payload", "value": "43ed503448a0fedb606adf47fbcf28d3728ea295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942607, "uuid": "ba4d4203-a39e-4bf3-827f-17fddfa63fbe", "comment": "Malware payload", "value": "88352cf8a67e6e5927533dcd6adf3f397c4b0ed4a5951df41bdeaed4405f88f98191fa91e7c41c376af486279d045294", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942607, "uuid": "4304ba9e-22f5-4cf5-81b7-e76fc2bc76b9", "value": "T116C37C5178D0C072D46629314878DAB05E3EF9340E749EABB79C167E5F302C19A39EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942607, "uuid": "402a661a-58bc-4004-ab63-3ed9d29909ec", "value": "975cca30fc6fc8cb327e3c61bc677b38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942607, "uuid": "69b8174d-c9fa-417e-a117-b5e0af9f2506", "value": "3072:whfSAPbxJt8vSRbKc2lMn/ez7W1YyqDzkydo/8NiEXIgdKPvVaDAi:IJJtBYcpn/ez7pzkCi+Ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675942607, "uuid": "61d3b51a-cd31-4a88-8034-e91eefd9688d", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675942607, "uuid": "29b6ede6-15b8-42d3-b89a-e678540f457d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942607, "uuid": "f8ac9c74-70f0-4a46-8009-57f45e8aa37a", "value": "SecuriteInfo.com.Variant.Jaik.95172.12485.20559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe29757-a886-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675953114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953114, "uuid": "8da818c0-c6e3-46e9-b49b-b96805503b88", "comment": "Malware payload", "value": "60c415f1a2074f925b165c89f83bc6e3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953114, "uuid": "5ea8352a-cd24-4e30-8d4c-8ca4158b5c0a", "comment": "Malware payload", "value": "83ff194b9c5f6578343114e644a07da49ee29f291570eb7315299cbd4d618403", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953114, "uuid": "63c3d0bc-01c0-415f-842a-4bdb79f2de9f", "comment": "Malware payload", "value": "50bb2e80ed492a188dbdbd59df36ad51eb33cab6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953114, "uuid": "840aba65-dbad-42f4-bda3-b7a31eb5df76", "comment": "Malware payload", "value": "3e1b8698a4268e464bfe1bd79fe7bf9f5d65060541a4101a46627f1241bd78b2e99ee86aa149a967ca06e15094ecd75f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953114, "uuid": "18217078-29a7-473f-90eb-797dc025b9c1", "value": "T1E2145B1773E821F8E636C235C8A18506FB737C355B209B6F16A4467A5F222A0FD3DB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953114, "uuid": "c4ae5039-97d7-45c1-93eb-718ed0ba31cf", "value": "5e3b4d8c96aa634f8a6d6adf6270d0eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953114, "uuid": "3c342ee5-c432-40e2-beae-726bd9c6e05f", "value": "3072:b6FeVYPk00Gz+Wc2xlm+I1Ywwv0z0e1cHO+SnfUepYl7Txe1/UPJu2MA:bg+k7c2ohwcz/1cHONpO1AA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953114, "uuid": "0ca7c6fd-9a4d-42b0-8f57-2a9b4d2e5baa", "value": 194560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953114, "uuid": "8cabf0bb-2566-450c-95cd-7df7b3704c73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953114, "uuid": "e8ce1d4c-99ec-48cc-91eb-0141fc668764", "value": "2023-02-09_60c415f1a2074f925b165c89f83bc6e3_lockbit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531e8861-a8b0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675971078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971078, "uuid": "c9cd2250-08bc-4e32-b691-c5568801d7cc", "comment": "Malware payload", "value": "f6ad9795884ebe9f7902298819764d22", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971078, "uuid": "f80398f0-007f-4ef5-a0aa-668147713694", "comment": "Malware payload", "value": "83ff4837010c037354ce78c5fdec686bbf5d742ecfe3aa158f7daddab4d2ccd2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971078, "uuid": "547abad7-98b3-4645-9d00-fe2266b390ab", "comment": "Malware payload", "value": "a7755fd58acdddae40de6bfde6c596dba6350e42", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675971078, "uuid": "a6ed9cbb-aad4-4577-8f1d-6d60d094a002", "comment": "Malware payload", "value": "2b3427477bacdd246192b88279284dbbb97d5f2f47221b2ad9fff6dd0550daa4ecf67a058bf8b267dbd3bc0a2bb64232", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971078, "uuid": "8312e933-42b7-434f-9c72-56e221a1691b", "value": "T1B2F0C93C7FD8C809E11A7230C2E3A307A756290C2A0D978B9C0A66200D34FCC1B47FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971078, "uuid": "1bdb52ce-4e31-418c-ad58-8a2d697878c8", "value": "12:5jvKGJjvGqN0W7w/bGjv0iHDuEq5DKxJ3IJP1x2qkQiiHC8Blt:9vKGtvl2WwmvtHa1sJ4J9xDL7HRTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675971078, "uuid": "b1a1632c-d3fe-42b2-ace6-84358c07d565", "value": 616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675971078, "uuid": "70f01f50-b062-4aca-b330-2e8932a6fa46", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675971078, "uuid": "10b49d7f-7522-405d-b881-6c75112808ea", "value": "US_export_policy.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84819e46-a84a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675927352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927352, "uuid": "fa2312a8-8a59-428e-8a79-57c12755e83e", "comment": "Malware payload (SnakeKeylogger)", "value": "dfd17b6d1336e31f7fdc3ed5b2373ee9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927352, "uuid": "54820c14-04dd-4fa1-9eee-8659bac48441", "comment": "Malware payload (SnakeKeylogger)", "value": "840841b31d3ffecc2d05b7860a327ec585c142e25067fdfee90f67993bb9cce8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927352, "uuid": "ac684ab9-7d23-4077-af60-aed227fa80c6", "comment": "Malware payload (SnakeKeylogger)", "value": "3158406da704a8a38c342bbd273e38999fab3a0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927352, "uuid": "8b789a1a-c65b-4a86-a3b7-48fd221bc212", "comment": "Malware payload (SnakeKeylogger)", "value": "6cc8f6ac7e6f6cd4224008a8ea84bd9d9c53436163a318754fc26ae678507d7af5b6722cc6b8924acfdd5ff1d7654605", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927352, "uuid": "f967a8d6-70c4-43c4-9bb9-c878ea510b23", "value": "T1141512506254CAA4E42847FECCB19AF053356EB9ED54EED72EC27ECF3A32B9140446C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927352, "uuid": "435ce4ad-5ab4-4180-a843-e92625b1e382", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927352, "uuid": "2a04215b-f214-496a-985e-226de403d333", "value": "24576:K1bgzPGhgzfY73Od551DUrKm+tZawMYeP:KZyPyyw73Ov51DSKxawMYeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675927352, "uuid": "76a12d07-461e-4566-ad7a-d47bb2ca3add", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675927352, "uuid": "bd331d3e-a813-4794-ab88-58cbee322ed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927352, "uuid": "3aad0322-d8e0-4aac-a6bd-345db1551fa5", "value": "854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7cc717a-a889-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675954469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954469, "uuid": "93360d08-1e7d-4bd0-9b2c-8b7046ba2920", "comment": "Malware payload (RemcosRAT)", "value": "e5f9fff610aaa0d3467e47a12dac32db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954469, "uuid": "efdb4129-601a-4b0a-8c98-8611f9030570", "comment": "Malware payload (RemcosRAT)", "value": "8453736e80df77744f2e82871bbfd9dcc62f166f5ed37e3f9e1e01a98bcef6e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954469, "uuid": "5dbf7557-19d4-49a1-8b53-e637867a0514", "comment": "Malware payload (RemcosRAT)", "value": "226cc82375b5705fa1f70192110999a92e72c645", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954469, "uuid": "693679c6-7282-4ec9-b443-2548f9eb1046", "comment": "Malware payload (RemcosRAT)", "value": "19c5da7cf8b4332d8a2094283df47af1cec23bd1bd6fa039a6d931a18893194d362fda1c8c8244afb3c8606101fcd59a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954469, "uuid": "0075d746-39db-439e-b9a6-91b39c82aace", "value": "T1AFB4237935B181E7DBE367764F3741254AA8DC26A075E20F27802E3EB033161A55EFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954469, "uuid": "cb2895fd-36c2-4411-92c2-891c1de16d1b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954469, "uuid": "c44549fb-fa22-4cc6-9093-54974b9743d3", "value": "12288:vYZC/DVA/1U0S+S8Z1D8LAJibjj731SGa/rf1Q:vYZyDSNUV+SwDEAAbjP31q1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675954469, "uuid": "0e730aec-a0e2-4ff9-b2f2-cd31791e3c49", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675954469, "uuid": "52383c58-21d5-4682-adc6-788688d96424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954469, "uuid": "27ec3a90-f7a2-4950-a437-1934420531d4", "value": "UPDATED SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3086ab-a8b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675973056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675973056, "uuid": "952564c9-3a0a-487b-a096-842f0231dd35", "comment": "Malware payload (Gozi)", "value": "8f055e79a2e55454c54e58de0219dd8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675973056, "uuid": "a790cea7-2bdb-4b47-9cde-b6e40fd5f4bb", "comment": "Malware payload (Gozi)", "value": "84908c9c014c59a36369a618dfc51316646d1dbc3314da3c66100b0706567d22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675973056, "uuid": "aa634ebb-bcad-4960-ac69-772a1a74a55a", "comment": "Malware payload (Gozi)", "value": "f2d95f53d10e0f1a76aa5b3f82eaa8975710d9f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675973056, "uuid": "884d0db1-5055-4582-834d-164479b4a508", "comment": "Malware payload (Gozi)", "value": "f5dfc86ca305e9ef624d8810bc7db00bbe3fbe5656ec269802edcc0ef1ce90005514707f8ca50e7d7bd1c74cb0ce2835", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675973056, "uuid": "c465498f-6332-4595-bcea-461046c5a541", "value": "T18914D01336D0E872D432B6309C68C6B12B7EF8214A395AEB7758272F4EF02E19676355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675973056, "uuid": "48445ba0-3f59-418b-a3d0-fcc29fb9628e", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675973056, "uuid": "0aa8c29c-4e12-40bf-a190-433f20c9ab0b", "value": "3072:3FgViTHQYI2m/IWZloyMX1GLvtoXUoDq51VGJ/Vw6jkORAK:3Fd7dmpZl4gTtokoDq51VG5GPORd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675973056, "uuid": "ab2fdc7b-3b4f-487e-81e1-35825ec35422", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675973056, "uuid": "0535d318-361f-4ec2-a983-8324eaa36776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675973056, "uuid": "af736e0b-17d3-44ed-831b-727bdfaee2db", "value": "8f055e79a2e55454c54e58de0219dd8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71dd57f2-a877-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675946648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946648, "uuid": "67b6eff6-fd45-43ad-a2b7-04a2d873adcd", "comment": "Malware payload (Amadey)", "value": "7334e8fe28e8714290bac0e8ae4b6be8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946648, "uuid": "142b0980-cf9b-4bf7-a851-eb0c4512ec0a", "comment": "Malware payload (Amadey)", "value": "84d7c39ac07b379d6099474cd35619ed7a0f17b39da33b0a97d81102874d5409", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946648, "uuid": "f6f64a7d-02ee-4552-8637-0f8a3dc5c5a4", "comment": "Malware payload (Amadey)", "value": "16beb780a5185fff832503cd5f38a064801e7ff2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946648, "uuid": "3fb40927-d78f-46c5-a1f8-951f93211c35", "comment": "Malware payload (Amadey)", "value": "17a9823fab4cfab9ee53602ddddc339204aa5dfafa174f9b51569db35db3df1922167e71db9c23ec4276bc05e214e9ec", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946648, "uuid": "7737f24b-410d-4e2a-897f-9ebd5b1bafa8", "value": "T1C3B4020BFBF80525E86057B059F647C30636BEA16B7483DA174FAC5A08B2570B63277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946648, "uuid": "a709ba52-97bb-4e95-b680-6d4110be94d2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946648, "uuid": "e4c790d3-1e90-4190-b76a-3118b3b6702c", "value": "12288:eMrVy90vLPUrzDFs+7bLZHajxLvkLbFoCkBQr5:fyqLPgFPaLAbFoCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675946648, "uuid": "0fa9824e-2f20-4deb-9953-173510138150", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675946648, "uuid": "4fda121c-50c8-46f4-8f1c-b222ca02bdf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946648, "uuid": "728f929c-2b5e-4901-90be-218b4b40fad4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63914fc7-a847-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675926008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926008, "uuid": "cec739d3-54e3-47b7-8b64-ac9dc8efbcbe", "comment": "Malware payload", "value": "01eb4c70f8ec0091523de7243d3ff741", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926008, "uuid": "02dfc714-ad2d-4c0e-a39c-92b54ea0189f", "comment": "Malware payload", "value": "84eb8bf4d207329b1f151275cd30b62dfe56829d915954831f943825f422fc3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926008, "uuid": "fc2f9bb1-b3fc-4621-9b8c-a29256917cb7", "comment": "Malware payload", "value": "79045acf1ffffe54fe74ea4de04418e6abbea5e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926008, "uuid": "8241a2f3-c017-4b32-9803-179b773eb876", "comment": "Malware payload", "value": "c868e38bc045732dc0a59efd22e22cce9ea68b7ae988d979af8344943dc72613d3d80cf84064b1b169317ba64b8960bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926008, "uuid": "42713890-a255-4dda-8801-78dcfa34ba44", "value": "T186C2BF04BBE48759E49E4A3C5EB7930061B2E1176213EF6F1DCCA28D5F27390014B6F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926008, "uuid": "9e7362e5-4124-4389-a330-871b9975cfa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926008, "uuid": "f7333f1a-b4be-4a51-b8f3-4402b9c4c884", "value": "768:s8fdQ95rnLnxPAv/H2CcXR5obDTjqW/9wu:3fdurnVPA3HPcX/weW/9wu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926008, "uuid": "8fa4e4eb-6c11-46bd-a692-4ab89d97dace", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926008, "uuid": "6133a6ab-dcd9-4438-9ced-0a70f8c7d66b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926008, "uuid": "824cee73-8c21-43d4-9c25-dfe6b8cf9c51", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9e5cd9-a852-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675930748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930748, "uuid": "e6b3233e-f912-47b0-bfcc-dcb150c8dd50", "comment": "Malware payload (Formbook)", "value": "057781bdb259491de3673944ec1bfae5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930748, "uuid": "26bc7ca4-fda3-42fd-bb1c-9e1c8a0a95ae", "comment": "Malware payload (Formbook)", "value": "8567848be5d0c2b75cc9a31ef7dbe966f351df4dc0b4320df0cb10ecf53e7b51", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930748, "uuid": "3b6c1c28-153e-409d-bf91-6dfae8d41766", "comment": "Malware payload (Formbook)", "value": "ff4d1d62cc3581b05ff56efb9281502558cc67f7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930748, "uuid": "dc62c0e8-2aac-4e0f-a39f-8fc40c223e25", "comment": "Malware payload (Formbook)", "value": "8b0a84a05884f574ba2a5189633769904617e78b50ff38ad6751c8254e74b6c7e96cfdd360e87b065f6e9ef5e042e424", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930748, "uuid": "e8c828fd-9a34-41de-858c-92568208d00c", "value": "T1DE5423192543375A062CD47BDA342F26597CAC5A2FF49FCDF50BE239D22F9160B0AE90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930748, "uuid": "deacc13d-3fc0-45d6-8d1e-201b34fcbe53", "value": "6144:eStJ7ftIDdvHu4cfg84/3LjWj92/Z0j+BZE2OdpF0ii2+Irxb1XaW:vtJ7fcdfu4cfg8IGx2/ZG2MnF0iRlvX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930748, "uuid": "fdb2f93d-d74d-44d0-9196-f3e7620b9102", "value": 301339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930748, "uuid": "62288a37-b33d-4eba-89a0-509bf552c331", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930748, "uuid": "629d593a-8cbf-46e0-970a-2749f8ae2dbb", "value": "TT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a81970-a84f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675929642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929642, "uuid": "ef8cdf0e-046d-426f-bd2c-5f0125302cc0", "comment": "Malware payload (RemcosRAT)", "value": "6a8db26870ed4984232a8008063a80d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929642, "uuid": "9e2237ee-f05f-4766-8409-a712b91baae9", "comment": "Malware payload (RemcosRAT)", "value": "8567e07de3353683246b56aa394e0551ab74df9eca84ff85a7e565c60bc20fca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929642, "uuid": "6900c931-2afe-4f4e-9d24-bf0ad5ccf8fa", "comment": "Malware payload (RemcosRAT)", "value": "688d3da895cc086f3306f0700a2969f2257c663d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929642, "uuid": "b7b73e84-b7d7-4870-a3b1-7a547dfa556d", "comment": "Malware payload (RemcosRAT)", "value": "e74b7319acdaa9e140b780b979718f765b3439f08a7b9e89d7057f65fb0829dbad191198f1d9ced27cd49f039496843f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929642, "uuid": "74316989-de58-4b31-9060-db06ca6d7ff1", "value": "T12E5561B4A4BB49DAE00FCD511ABCFCE901B775F3C8E60DA9832C77041E3AA947E4554A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929642, "uuid": "772bfe3e-24bf-4de7-ae3c-9937143c8983", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929642, "uuid": "6a505559-189c-4f27-a5f9-120fdb3b3181", "value": "12288:HX8j2womsP5LxH94yj95XGtrEcSqK5DEfEgLPn/sd1JMviatCfh:BGaOE/Hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929642, "uuid": "d7e20ee2-7728-4120-a188-ddfd09459c94", "value": 1368064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929642, "uuid": "666559c8-33bc-48ea-968c-6330b8dfb574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929642, "uuid": "441c4fb1-dccb-4838-a1de-00f671a02b84", "value": "Zeqsmzlxb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3abbb62a-a874-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675945267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945267, "uuid": "dc9fdd17-d9aa-4cdc-a750-d1f2538687fc", "comment": "Malware payload (Formbook)", "value": "cc60895f89b7413585f241229f37439c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945267, "uuid": "dc98578f-2ef5-44df-8c8a-057e4e6a06f9", "comment": "Malware payload (Formbook)", "value": "858efe218a2eeb5fda4f057a2d4f7cc8ad5ecb9237a1324dfad7bce76e06e869", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945267, "uuid": "557b9603-de2c-4682-bc79-34d30d58c058", "comment": "Malware payload (Formbook)", "value": "b5e8e48ee8398ff2be8dcb8b074ec02c7706ed9f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945267, "uuid": "33b17cc6-a7dc-4f20-83e0-1bdb1c837863", "comment": "Malware payload (Formbook)", "value": "88d0036c1fa5c4be190252bb0bd4e36f2e7179c4049bdc36925c659ae7714e7ede91aa490cd9db330de5796e79ab250b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945267, "uuid": "d1e1e522-0340-4b50-bafa-f9434f9e7ff8", "value": "T11D542392AE03D0AB024BA677CC335B5D58EE1D6580E93723B8C753B6D147E0B4D0AE1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945267, "uuid": "67d43ee6-dcc2-4372-a28a-0fdae1dca111", "value": "6144:6St59f1dEnjWIl0+aLr5M0/XXyqJT+5ed2PYtiXiLWumJu+Er6ff:btD1dEnnq+aLNMpa+5ewPIvmJ4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675945267, "uuid": "4d63cca5-c0d9-430b-bda2-242a910135e3", "value": 301412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675945267, "uuid": "a4ff9376-6e7e-4be7-9c22-e5d1da026d3d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945267, "uuid": "5f36d2e9-4ff4-418e-9a9f-8b51cd894dab", "value": "SHIPPING DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039443ac-a83f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675922411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922411, "uuid": "b95da198-e6b3-4d56-ae0b-b2d16049b7b0", "comment": "Malware payload (RedLineStealer)", "value": "a5219810e16eb292f899545b63e37662", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922411, "uuid": "864025ce-f131-4d2d-a2bb-19833e7a2180", "comment": "Malware payload (RedLineStealer)", "value": "85efcd2b30e38daa9af426f81ae9fedd3e5b154bb3257e5e1cafae7099f1404f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922411, "uuid": "d0b0b40b-6104-4556-bc58-4696ea1463dd", "comment": "Malware payload (RedLineStealer)", "value": "83b578f9852cdb8193f9525040c000a310bdf8ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922411, "uuid": "5e4480f7-b911-4209-bbab-f0a4a5705731", "comment": "Malware payload (RedLineStealer)", "value": "6fe1a8b90ea17e77c081a368cf9a846df9b50dcf4af0261981340560575b8cfd2a3516460d2f9814dd364374e24e23fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922411, "uuid": "9c8a9222-da16-4296-8f24-46a9378f3678", "value": "T18D64F1327680D032C56714B49864EAE6BBBEB4300675CE877B641BAE5F313D09B3A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922411, "uuid": "33bb3249-5c2a-439f-99fa-765d92fd2f87", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922411, "uuid": "52dbdc7e-252b-4c29-a972-0059059adc1b", "value": "6144:YqEn9HLDtQu7aORSa+y/aMOQwXcDqRVlT5xJDUNtf7:YqEn9HftDx0jy/NwXcCVZpUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675922411, "uuid": "efa26bcb-1cee-4385-aef7-18f1290b4093", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675922411, "uuid": "4616c90b-6625-49aa-8865-11f1e3179b1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922411, "uuid": "34fa4fdd-722f-4705-afc9-f99cdc7cdfd2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750408b0-a85c-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1675935057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935057, "uuid": "b42ca96a-b19d-4b8a-a215-ccdfb5745cbd", "comment": "Malware payload (PrivateLoader)", "value": "5d69e6efaab3c2ad8136038108de1a4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935057, "uuid": "83ae224c-f0d3-4158-a497-ab41fe0293fe", "comment": "Malware payload (PrivateLoader)", "value": "863907db2703e6650d2e9341ab975e67f889cbb4f8efba089cf421295bb100d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935057, "uuid": "ef954a11-b42c-44b1-8c6c-e6ff4ffb42ff", "comment": "Malware payload (PrivateLoader)", "value": "22d1bea7ae38e09b45b0090df91e0f1fec0559ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935057, "uuid": "60cc0f53-adca-4fbb-81bb-d74e45fcdcb0", "comment": "Malware payload (PrivateLoader)", "value": "dd5b7e1d70490f2291d6a78bc73fa3e8be4ab618e9b99bb9069c8a66ae65dc111bb8bc3c944d7f9a112341c51e236672", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935057, "uuid": "791a8568-c0d0-4be0-a2a7-7869692f1040", "value": "T181F59D12E9809035F4A301F297BE1A7A5E7CBF31231054D7D3C8689C9B658E1BB36B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935057, "uuid": "4301fe17-a2ef-468f-afca-42f098e49ebf", "value": "022b33510c2cc67820972fee66dd38d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935057, "uuid": "94945153-085c-4b39-a8f1-90d83bc4d8ab", "value": "98304:AqNHddSy2xT3SJ0vsw4AHCJpV/82TJNK+gT9/69CzFh7P7CbM5zD6sILTjblMS0u:rjV/pNK+gMwzbi4osI3jhMSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675935057, "uuid": "96c5f95c-3803-4bcb-b453-ab274da1358b", "value": 3640320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675935057, "uuid": "6b013cb7-4bd9-4409-b3ba-310aad2f4319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935057, "uuid": "da7170dd-4f1d-46cf-becb-bce45529cca7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d029dd-a846-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675925685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925685, "uuid": "0ed2815e-55d8-47f6-b282-bd73823fd96b", "comment": "Malware payload", "value": "ce202d2100fce2e26426f81fdfe06e66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925685, "uuid": "ba463d72-1568-4f2a-9ec5-b4c1781e1cb6", "comment": "Malware payload", "value": "865f3de4a49a6fc637e637d6f165ae6c7c8f8be8d7a79145ada708d82cd41a75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925685, "uuid": "a15bc95d-123a-479a-b9f5-48ccea75213d", "comment": "Malware payload", "value": "0860ef31d8731e1d0276f70c49c98a196d36c4ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925685, "uuid": "0b902f44-b499-480d-8975-836b7a27bdce", "comment": "Malware payload", "value": "4d3ae89c9deb39b8de558a22f426ed203ea87679ee7a2e9ec17d3854aea493e3b539dd6f9cfa6045eb83bb3ddbb7c056", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925685, "uuid": "418235ff-1acb-4ec8-ac2d-a09c15f09d4c", "value": "T100652312BAD148B0D6B319750AF2D670A63DBC702B758EDF53543B1EAE201D1EA36723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925685, "uuid": "80e2627f-91bf-478e-8b1b-56df8617952b", "value": "e92b2275a730f59940462780c383a1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925685, "uuid": "1b65997a-e4ee-4b22-83c3-7046cb25e53a", "value": "24576:VLeTtjJF5HrKKs0K9UeqHkGyOYAwB6s1ePmR/aAHvSrnciCm+yRAaIVf7YZ:VLYgKs0K7LHDZHv6cipNRQf7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675925685, "uuid": "7699d36c-4062-47f4-9f86-317ec5d75afe", "value": 1514515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675925685, "uuid": "d6037e4d-103e-4e60-bd95-e067d1473d4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925685, "uuid": "3f237f17-d1da-410a-9596-9abd19a2997d", "value": "ce202d2100fce2e26426f81fdfe06e66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d00f56-a86c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675942146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942146, "uuid": "3a309bec-7f9c-4b47-a638-05c44303afc5", "comment": "Malware payload (Amadey)", "value": "d0f97c994f778f5e868004c00dde7585", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942146, "uuid": "dbc98d8a-8834-46e9-9bfe-7e0bc223f86b", "comment": "Malware payload (Amadey)", "value": "8669a71f4b3e2c7efade6ad5c50d1b6ac42de52d560a0731909a9f68bbb303d9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942146, "uuid": "cad1c88d-0e96-4fb1-9a0c-18c728395744", "comment": "Malware payload (Amadey)", "value": "42953fe76cd1afd2b14033dd60e25657550bc733", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942146, "uuid": "58c528fc-ef11-4906-97f7-5ff50bcf1480", "comment": "Malware payload (Amadey)", "value": "05231a3a9a7bb905d75c2ceed083240fcd407d7c89016afe3a14cc520b2c0f4ccec8f77e0163d7e819f32ae042553c49", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942146, "uuid": "b018e4f2-40ff-43c0-8554-bc03310003e5", "value": "T143B40207AAED9076E97427B018F603D30A367DA09B74435B638F6C5E08736F0A636767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942146, "uuid": "8ea0601f-4b9c-4683-af30-ba1e96906a49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942146, "uuid": "8ae138c5-9652-4703-ba0a-664bcc66341a", "value": "12288:PMrey90eTOYHh2Qk0v7zmn0uxlSHb9NZg6seF1:tyVTOYHh2Qr7zm0nZjseF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675942146, "uuid": "f2d6cfe0-f0db-411a-b06a-f240b1fefc93", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675942146, "uuid": "3bc3f9f6-8b0f-4434-9306-c9df8dcfb107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942146, "uuid": "7ef728bc-4a71-4ad2-b3fd-910a76923a57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3802b8c-a8d3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675986272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986272, "uuid": "7446a487-b855-461b-bd9a-71150e6b536c", "comment": "Malware payload", "value": "4fcec065bd54ce4a2a82145cfd8c1562", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986272, "uuid": "ce7513e8-262c-4961-8493-c51a2d838213", "comment": "Malware payload", "value": "868f0c88c0833607909bc424e3d32f5458fd3d6dcb73f97e64f84926b131078e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986272, "uuid": "0f522e13-b405-47ad-af2d-68fd401ccedb", "comment": "Malware payload", "value": "aaa861465cb38d80315bb8b4cef3d316151e764e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986272, "uuid": "4986d1b4-22d6-4a76-95fb-f2ae889066ee", "comment": "Malware payload", "value": "7b903892fa801da57d18e354194b295b353136e3e24253e5dcaa39f16826672b224f423f3f94954a884918e5a84a35d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986272, "uuid": "1a832197-d746-4c05-8b55-03965a26e275", "value": "T159B4024BA7FC9036E8B4577019F707D31A32BE916A78839B174A9C860C735B4623276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986272, "uuid": "dfc4c648-24b5-44b2-9769-71ac8dde2334", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986272, "uuid": "b06db750-5fb3-48ef-a5fe-a0809fef0d04", "value": "12288:YMrby90MPwVoPleyHZQPt/CVtFpn3iK2X6kpHajhiZU:TyBYVvyHZQ1/Cjbn3iK2dHaMZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675986272, "uuid": "603d8f94-b162-461f-b5e0-f027fa6ca81d", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675986272, "uuid": "ae528173-1178-4c6d-9ce6-8cb220a0ff19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986272, "uuid": "cd0b05e1-778c-4f19-8270-b45b4f41b53c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39c91f0-a849-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675926974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926974, "uuid": "843dbab3-360c-488c-824a-766148b1306f", "comment": "Malware payload (RemcosRAT)", "value": "0c213c2a05158ce43c3269a10240a9ae", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926974, "uuid": "16399f56-5804-4564-9406-4a33eb0dee70", "comment": "Malware payload (RemcosRAT)", "value": "86d94623043d581be9f92fea67fc08a0622aa469130dfe0de199b50bdf587204", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926974, "uuid": "435389c6-fe2b-4698-8d6b-d3940f924550", "comment": "Malware payload (RemcosRAT)", "value": "03111b6b9d4526170c953aafad511c762fb82cf3", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926974, "uuid": "d4089ea4-22d8-407e-9cd6-a18e7ed6c858", "comment": "Malware payload (RemcosRAT)", "value": "83cae20fe70e7f679da06ceb79ec8aba2ccde8d76d011af0b12a9f291300026149b0e80dbd011492472d87e1ceb4a1c1", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926974, "uuid": "4bca2874-c36e-4631-bde9-8f269cca423f", "value": "T146653FB0A8AF45D6E00FC9B01AFCFCA501BA75F3DDD60DA5436C76445F3ABA86E0150A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926974, "uuid": "77f63208-4362-4aa1-8a99-4b0aa45b0579", "value": "12288:0utMCnSOSepN+l1vVG7euwvv/+VnSXgoZkWv8yx:doZkq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926974, "uuid": "d09c8003-acc9-4073-95f9-2e5758f96dff", "value": 1443840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926974, "uuid": "18fb52fc-9dd4-45c6-941a-42f69b7e3198", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926974, "uuid": "33851215-4667-40f5-881e-698b0c1825f6", "value": "RE Auftragsbest\u00e4tigung PO20E000432..img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597a8930-a84e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675928998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928998, "uuid": "07ab0086-4111-49cc-8836-3e234dc4fe79", "comment": "Malware payload (AgentTesla)", "value": "202befdd7ece5601bd9e549161f3962a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928998, "uuid": "efe14f7e-d01e-429c-9ad9-844bad5050a8", "comment": "Malware payload (AgentTesla)", "value": "86e32d0b2be7965753bf1ac1fa66397770db93dc79e49e88e8c8508ec79ee8f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928998, "uuid": "7f07365c-def6-425c-bdcf-0ba5a9fe03ca", "comment": "Malware payload (AgentTesla)", "value": "2a63a36c3cb4d2e6de4ca6ca05f89a8905bcd380", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928998, "uuid": "ee049722-b78d-4929-a1e5-33d303a79601", "comment": "Malware payload (AgentTesla)", "value": "3b84048884e9666004ffa200d7cb80a920e98dc8c9940a4bdc71aa762efbaeb123b3079ad7aa9f3058e7689bf8a4c340", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928998, "uuid": "8034496e-4ab9-4a57-a744-33f20c2289bd", "value": "T1DA45027525F84A5AE2BE43BD29F10206A7F5B582B193FB2D1F4C38E11F76BC0022A557", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928998, "uuid": "54d0a914-4402-47f6-9772-aaf6ce05a6aa", "value": "12288:6RlrMnR04RvapjXzkxZBD5Nsp/lKJYME4sKC218upMmQlQX:+3RDcZBNKxd4sKx+cMmQlQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675928998, "uuid": "ddb64c2d-cc84-4f51-b4f0-0fbb46bf279c", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675928998, "uuid": "f4be2485-3f71-45b5-9012-3f41225ef447", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928998, "uuid": "8d194bf3-e44c-44d8-8ae9-eed0ec7ce4a3", "value": "PO-000001306.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ac0d23-a82d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675915007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915007, "uuid": "9c71abae-af2f-4d44-b696-248b3717a5c1", "comment": "Malware payload (Smoke Loader)", "value": "e35e5eeff734155bc288aa6112c0850c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915007, "uuid": "5dcb299c-263c-4f2a-a90c-3b840f62532a", "comment": "Malware payload (Smoke Loader)", "value": "8702d592b997e23e35c898a50a6da85eccc74da1d29e4547e02ab98e694f90f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915007, "uuid": "44f4175f-8a1c-4726-bd1f-4490d20a0155", "comment": "Malware payload (Smoke Loader)", "value": "3590dd6c0992870da923b0b3cd0f7e67cad1a06b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915007, "uuid": "c51a1ea4-2dee-4ef2-9777-7d15cd659c30", "comment": "Malware payload (Smoke Loader)", "value": "7b9c1ec4fe212fe70491a27d9a8c86b6529b66f4e88a15686fb1c78d3c72cc9858f458ee0b5b75214c1a26a472d38cb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915007, "uuid": "3379b175-ca75-4154-8084-c353a534c505", "value": "T17B642A0393E17D80E92A8BF2DE2EF7E8765DF6508F0AB77512189B1B34B1172D563A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915007, "uuid": "45761113-8d63-4b95-afff-1ce708558c91", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915007, "uuid": "084051e4-44b6-4993-86ce-c39235707fd9", "value": "3072:YPEEp1dWPRdtuGUoKYelL+sIigInJ/m6CQENe+pGS6bOz3:YMEpLAwGjslaszgInxm7QkeQGS6bW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675915007, "uuid": "db722322-a1e9-42ee-b6d3-1e80ad2f7c98", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675915007, "uuid": "ac77248e-72f8-4327-839a-af9a851ec687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915007, "uuid": "ea545dd8-12f2-4b18-b3ee-2795471dcb46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67635066-a861-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675937181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937181, "uuid": "2c2211bf-6579-4eeb-bef5-af610627b7c4", "comment": "Malware payload (Smoke Loader)", "value": "566af9f42ed1844f0c27de35804f0b4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937181, "uuid": "a5bdb9e0-895c-421f-b116-c2dfbe45ef08", "comment": "Malware payload (Smoke Loader)", "value": "871ab36c805150e2cd1a4e25b19cb9955fac998f4e1433f8bec4757fe20eae5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937181, "uuid": "dd5fcf31-e152-4aa5-bdd1-9accd77735a5", "comment": "Malware payload (Smoke Loader)", "value": "b57f14c26e5b245de943a7928a696ade00771a77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937181, "uuid": "ea128ce4-b46b-431d-84ed-6a889eb28d71", "comment": "Malware payload (Smoke Loader)", "value": "69acbe3febfecdeffc0a3e1a60973cc30a4e114f3bc00173845c994ebe9af781421cf486e59d8b56ca916f3d17ca3292", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937181, "uuid": "449bbe80-948c-4750-9477-7685d9fabd71", "value": "T1E414CF32F690C072C46B15305860DAB56FBEB830C6799A5B77682BEE5F703D1573238A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937181, "uuid": "c9600bb1-3ff8-44b8-b8b4-ede859ac929d", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937181, "uuid": "fc9a159d-b4e6-486b-bcab-337b8ed39a99", "value": "3072:bGBOiHfYBpDXLh4DWEzd556OUrxsVV2s4A2j4EFMxdhmUBl:bGB9mLLmDhu08skj46MxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675937181, "uuid": "b9812c14-2427-4a92-beb6-98436f1d565a", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675937181, "uuid": "f19fbe69-c9b4-42b1-af8b-2cdae3ff6b8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937181, "uuid": "3c92127e-8165-4b2a-9ca6-df79c06aad35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed38e3e-a810-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675902405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902405, "uuid": "ae238b84-2cbe-4c1f-8908-8ab28915b121", "comment": "Malware payload (Gafgyt)", "value": "92ab89b61660de6f82411d3e79f46262", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902405, "uuid": "8ffa53ba-fd91-4b70-9111-8d3049e57445", "comment": "Malware payload (Gafgyt)", "value": "8730a62daf7a9339e2e200e6220962c706ef44049d454d7b0ff6e91de3ede1b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902405, "uuid": "25ecbcb3-6ff6-43fe-ba17-fdb11f988574", "comment": "Malware payload (Gafgyt)", "value": "7f990a1b971d36cfe6190b1639f19e8e74c81cef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902405, "uuid": "21e5dbaa-ec08-42b6-9a4a-5e4bc6712714", "comment": "Malware payload (Gafgyt)", "value": "379a72677cacc17415957b54c5b6ddb14fdd50d797f2b63afc02af7625ecb1f0a7fce5247622467a012e1b714dc08054", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902405, "uuid": "697e8de4-da8f-4d99-8d29-a26aa8ddfea1", "value": "T18CC32905E450875BC2D2237AEB9E465D37336BA893DB33115A34BBB42FC27D91E39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902405, "uuid": "eedb9f76-048d-4efe-bac8-9f0d96230177", "value": "3072:5a5QDpDeRWa25UO3R1DLRULp+mwQYY5QXhga:o5QDYWacB1DIp+mwQYY5Ghga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902405, "uuid": "0a012e53-d1c2-4756-80cc-66425b56c1f7", "value": 123743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902405, "uuid": "524cd7bd-7b69-44a7-9cd1-9bd76fb32166", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902405, "uuid": "2b416cfd-098e-40ed-b644-f2497daae4fc", "value": "92ab89b61660de6f82411d3e79f46262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a2fb57-a84e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675929013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929013, "uuid": "157491d7-1145-4ded-82c6-7edcf5dfcce9", "comment": "Malware payload (GuLoader)", "value": "312ba76ad9b57301b63b4dbccfd1b6ce", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929013, "uuid": "bb97b106-4ae2-4423-82d1-62d4b8c21b04", "comment": "Malware payload (GuLoader)", "value": "87c8198ecf3d5771ff9ee740f0e1f1b2a7de315243943b878f9dbf62aa0ade57", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929013, "uuid": "a1c0f306-587e-4ca4-8906-c721cb3ce6d9", "comment": "Malware payload (GuLoader)", "value": "f4c109f3eb1a84c22f2732cee24d8da54a93dd58", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929013, "uuid": "ee5f3f7d-036f-4c66-9900-ada0939a15c1", "comment": "Malware payload (GuLoader)", "value": "ed2858e7bc058dddedd2b607c7385d53afb95046cf0742c35ae80f5025f196f37d6a793554edf688eabd48bb60f7d63f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929013, "uuid": "410a1387-744d-4750-a34f-4c407b63bbfe", "value": "T1D7A42328F60C6582B51AEFBBB84207E272CD56B0E014EC0F5C5A79D66EDBC1059BDF12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929013, "uuid": "b66e9610-2b90-411e-bf86-ece066a3a23e", "value": "12288:TdNWlp2hRThyqK9kqs3ZPMQcvIDh9RS+Wx2y0+YMcP:3TTKIPxcv+h9bWx2y0lMcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929013, "uuid": "6fbdcc42-deea-456e-ae10-3a8a7e5b4456", "value": 468581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929013, "uuid": "7498968e-577c-47cc-9067-8abcc3720c64", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929013, "uuid": "05a6a0e0-3725-470f-9327-7b2255670466", "value": "Zahlungseingang 08-2023_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c996a14-a84c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675928197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928197, "uuid": "986c7330-05c2-4e50-98db-f9cf543db251", "comment": "Malware payload (Amadey)", "value": "592abaa29fb4a321be9aac07aa5b4849", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928197, "uuid": "00c3af18-11c2-41a4-bcaf-aaeec0ea2caa", "comment": "Malware payload (Amadey)", "value": "87ce1666ddd5a7e7df52df6ed89dc1f728bf4b4c6803be2f8903b19eceb7cfc3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928197, "uuid": "159f56ea-4090-4ec3-ac32-1dac5221df65", "comment": "Malware payload (Amadey)", "value": "4b69fa066c408c5def02a8a003b452bf5f03e3d5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928197, "uuid": "9e86ca8e-84c8-45ed-8c57-eccfffefc3b3", "comment": "Malware payload (Amadey)", "value": "a4b23591a3490fe824e0ae5a10e2c018792263f46581a71ec2b609f0e577b9bc3047e627beb9be8449cc0ab84f20e8e3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928197, "uuid": "5274f86e-dad8-4601-954f-7d591ad332a7", "value": "T140B40247F7F85023E5B0577019FA03D31A32BDA06F38825B679E6C1918B3970A63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928197, "uuid": "40ac6591-c1ab-43ec-8905-2748afe198f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928197, "uuid": "ae653d6d-fd4b-4173-80dd-8bf84779a3aa", "value": "12288:dMrJy90RdDR4D624euFgmdR6lAPHPNfWS8BtH2InCddt:YyoBeEetIR6CVfJ8Bt5Cft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675928197, "uuid": "640e94e4-4a12-4a13-908e-6af6a59aa9f3", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675928197, "uuid": "3041d577-dc98-4817-8d53-5b78a2b7d0fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928197, "uuid": "f35f38c9-95fe-4713-a70a-84ee5176092c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1176db7-a852-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675930836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930836, "uuid": "3716f67a-f78c-4587-aacb-6410dbcffe05", "comment": "Malware payload (Vidar)", "value": "d04a9ab037eebfa31314a30095fc9fab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930836, "uuid": "3b529495-c71e-4d87-a640-a66768fa9f81", "comment": "Malware payload (Vidar)", "value": "885bf26d34cc27b5cb9af85b7cc5fc78c52811c2f5cded1a8fd04183c5148a8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930836, "uuid": "0e480f4a-31ed-4d4d-92ef-4a826ba7ec6b", "comment": "Malware payload (Vidar)", "value": "1c8de25fbcf2eb839df3b375a8d030c960c31efa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930836, "uuid": "1f9e85b6-91ab-4bf3-b696-80c8d43b8229", "comment": "Malware payload (Vidar)", "value": "7d8ec274ac1a3cf9ae02eaafedc19ed0a1b3beeee06bcd9f8a8ed2f2c27fa6c6a2093847954b9a4f380c043bc3c2c740", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930836, "uuid": "6d2be1da-dce8-4bf6-9c0f-dda428ad438a", "value": "T174561252F8E754B1E90215320967D3EF2321B9091F368BC7DA40BFBABD729E01932675", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930836, "uuid": "073923d2-5d08-45b3-b619-63a27c831aba", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930836, "uuid": "7c9a4cae-867d-42cb-8cba-8364786dc735", "value": "98304:S+/7he6J6RKUMLmNI+xvAOq4XVcRRga2uKZcrEFPhqGz29mEM/pEAxXrTVHlx:Plb6RKUMLIIUvXa2vxeMECZxX/VD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930836, "uuid": "48bd7c4d-5755-4e7f-bfee-61b0b7e1224a", "value": 6040576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930836, "uuid": "fc994cef-b6c6-4ae6-a38a-33419dee11e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930836, "uuid": "0383b6b7-b304-4e6e-a2cd-69e2afd64e0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df74339-a828-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675912550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675912550, "uuid": "6d600e53-4e8e-43a0-8599-29e3702ef081", "comment": "Malware payload (GCleaner)", "value": "e6101a2e8986006b36185edab8d6d807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675912550, "uuid": "1ab2da4f-8183-472e-8675-c581b3dfb43e", "comment": "Malware payload (GCleaner)", "value": "8891a7962e4c1cf1821de39dfcc3514be8092d0b9d6c99475f3173984dc9753e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675912550, "uuid": "7802ad3a-51f7-41ca-aeed-4cdb5106e117", "comment": "Malware payload (GCleaner)", "value": "52a7ea3536690e9369e7b091ef81122c82d77822", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675912550, "uuid": "d23e3008-899e-4df0-b0fc-ec332d72748e", "comment": "Malware payload (GCleaner)", "value": "dfa6ca516927cae51eebf4485ff700fcd2a78640578cc5855454fe64655a00bffc0cb38d2f842aa9b1ed791899909814", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675912550, "uuid": "394d17ed-296b-44e5-9685-096b9e0669b5", "value": "T151C5127C7104C56DD290BEB4CC3A98E75CD76EE3E9E4A022B0D97F3F51B92885A0A147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675912550, "uuid": "24dfcbb2-d2b8-4e41-bbbf-d0f61ee3f773", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675912550, "uuid": "1edb7fb5-29ab-44a3-82c9-12418cfec828", "value": "49152:rdHNI3Wx1PmmSKe02aJZR/HPArQbosqxeWtUWaBdVOl6YLn4LCgv2MR:JHNImTTleaZCrsAO/lMwv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675912550, "uuid": "d698f482-7528-4d73-8953-f3c94a9e7b01", "value": 2741583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675912550, "uuid": "9834d725-dc9b-43ce-9cdd-67b683067b7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675912550, "uuid": "5cae5c3c-dd1c-4dd8-a0f0-fc0dcc003acd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9d7daf-a846-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675925621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925621, "uuid": "e8b1ca1f-02b9-4627-b537-dfe8ffdb7cd6", "comment": "Malware payload (GuLoader)", "value": "6e521ba4c4be6fed97fe1a0241e53112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925621, "uuid": "4828c137-1b1e-4aa6-b5fd-abf7cc8859ef", "comment": "Malware payload (GuLoader)", "value": "889467d707191852cbdc11dc684253e2d6ce574cf3763028ab4c3988e071a817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925621, "uuid": "6fbe5935-dd0e-437d-a9b1-1d318e484d1a", "comment": "Malware payload (GuLoader)", "value": "3a027bb8b69a4165cefe96e61b8e61923ab168ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925621, "uuid": "1d191269-a011-4e42-9c46-ab6049ce2213", "comment": "Malware payload (GuLoader)", "value": "c970952d55a5326f5b952582e861ca043bcd37c883949a0f49bbd10453a7c27b72683855b9d4d7c6d8d2742e4a72336b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925621, "uuid": "e99b35ee-719b-45df-b7d4-f8daba13c563", "value": "T179B4E1E67E00D153F06A827348FB0855B6712E52676F319E23ACF77B3EB63629316502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925621, "uuid": "85821430-4534-49c5-bdf0-5b5ad05ef48b", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925621, "uuid": "4541de89-6721-480a-a173-890e75c17295", "value": "6144:qDSoImdUguRbUi5Dk5irghgu4egfr6W8kMoJnFZzmvYC2SXuD3:vRp5D1Q4e4r6W85UnfmvSSXuD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675925621, "uuid": "ab1560d5-cf05-46be-908c-e2ddc229ffea", "value": 497521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675925621, "uuid": "3e6e0213-7857-4d0d-92e4-83e49aa6b775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925621, "uuid": "817a83c2-5cf4-4909-8b24-f1efcc31fcfc", "value": "Specifications photos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37812c4a-a86a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675940966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940966, "uuid": "15d8faeb-3703-42ad-ac57-87c0fe45f030", "comment": "Malware payload (Amadey)", "value": "6768983ae934d07063413bd94b5d710b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940966, "uuid": "b65bbf75-afed-4d12-9166-723f7cd53cf2", "comment": "Malware payload (Amadey)", "value": "890b0fe9cf8d797de3c3155c10f8f290ee7b235268922bb9314ee065ffac0bfd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940966, "uuid": "72ad714c-17e9-4de6-8553-81039bbedd85", "comment": "Malware payload (Amadey)", "value": "5f95c103624f99513b383e41efa1693c848e2d5d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675940966, "uuid": "133dff2c-e782-4ab1-8380-14d6af0d148e", "comment": "Malware payload (Amadey)", "value": "81908657ebd0fe2a109cdee1dd34d17429cd304dfc8e80b096fd7f698e7a97d2a3400a98984b45357605b6ea09e4233e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940966, "uuid": "6ac502ce-2de0-4432-b709-fd628457657e", "value": "T104B40203EBF8D032E87457B018F703D70537BD619A35926B639E6D9A08725B0B63176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940966, "uuid": "e6d20afd-5d85-4299-bd89-a254ed6c1c01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940966, "uuid": "e692da87-da72-4855-b78a-b8e83b6eed4e", "value": "12288:HMrBy90znzwxBQX3TKYk+vLwxmn0uxdCHbccJo3b:iyGn0xEDJtLgm0fu3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675940966, "uuid": "01a56c13-d6e1-47c8-ac04-f47be59a3f8e", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675940966, "uuid": "06d90c11-98c5-401d-a927-701651f59836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675940966, "uuid": "5bf65460-95cd-4f7e-b408-8e51e03f541f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3a25b0-a86e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675942882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942882, "uuid": "53c39180-4ddf-4e28-bb76-96d42c9b5645", "comment": "Malware payload (Amadey)", "value": "1d11420c6521440ad4a9f432d210fff9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942882, "uuid": "58f39f2f-33fa-41dc-bbbb-d6366d05522b", "comment": "Malware payload (Amadey)", "value": "8918b4c2de55beefbc933d79bebde7ed4d83fc08a531d05a8b7c92168da1da2d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942882, "uuid": "9113a957-5964-4d0e-9402-b5093e131a6b", "comment": "Malware payload (Amadey)", "value": "4c4936d4ebd6f2da039554b98e793037cd9a4ce8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942882, "uuid": "7c934877-e5ef-4669-9d81-dc76686255e0", "comment": "Malware payload (Amadey)", "value": "7deffec7e5a40f13085b03f778668904ac9f8adf5f09df494383b5f9947fc41126a6c1fd18820e1cdd5d1b4ca7924be5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942882, "uuid": "3c5c3965-883a-4bf5-a8e8-0550c58766f3", "value": "T158B40207F7E84436E97057B044F643D31A7A7E916B34839A26CF6C5A1CB25B0B63236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942882, "uuid": "d6980ceb-5acb-4b56-81f6-64f9cddb4cd0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942882, "uuid": "c64ab9ee-29f1-4312-b8b1-b878689b5de1", "value": "12288:IMrEy908gNuVNV2I8zPiPHakxLvFLbFqAPw0m6ooRGpnp2l:cy9gsVVHLJbFqAPPuoRIp2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675942882, "uuid": "d4f168c8-8244-4e2f-8e1c-42d531c83e8d", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675942882, "uuid": "ef2eae6a-e7c0-4774-ab9b-af6a00cc51b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942882, "uuid": "8446c1b2-4719-4de6-8aa2-69ac8af1d4e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e5e1ea-a888-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675953936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953936, "uuid": "7083041d-48d5-4f1b-a327-0a693915ae0a", "comment": "Malware payload (RedLineStealer)", "value": "99c7a050725cce9a7ba8fbca74c8674d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953936, "uuid": "87359f33-a8a6-4d60-b68a-5b78f0a71ed5", "comment": "Malware payload (RedLineStealer)", "value": "8959f539012eb1ea05206bfa70a17375fb0fbc5e826e472395deaf01c1c66486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953936, "uuid": "fcb120e9-8af7-4ac9-b5c2-675f134ed6de", "comment": "Malware payload (RedLineStealer)", "value": "32eb8971b24d7d93e4cb4ed20f7249a5d9d3d43f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953936, "uuid": "a00dfe8c-c077-4f9b-b4e2-0efd52626e13", "comment": "Malware payload (RedLineStealer)", "value": "2e508e95a7ef7815c062abc69557152afb45d4efa6d673efcca2b7e7a781ae30f68a49f1b621341353a76f95b156f7e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953936, "uuid": "1f4cee03-8c72-4c3f-81df-69d3118fc462", "value": "T135B4021BE6ED4072E9B5577008F702D30A367EA05B34435B239FA82E19732A4F63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953936, "uuid": "d683854d-5c30-457b-9360-c8a48a1edbf7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953936, "uuid": "ecf5d636-e403-47b0-95b4-43da05de008a", "value": "12288:xMrdy903q0fnY3jisjay2sYUOqRVAIXD8Jp2:Qyuq0fnYTljZ6HqRVAIXD8f2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953936, "uuid": "d4cb5dcf-060f-4728-9af7-21aaa3ebfd62", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953936, "uuid": "353d822c-5814-44c2-be2c-85dabaef810e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953936, "uuid": "da480c39-3aca-4b07-9781-4b55b2551f17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886296a1-a852-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675930794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930794, "uuid": "5588dfdc-ba4f-48cc-aa0a-6b2e7ef25536", "comment": "Malware payload (SnakeKeylogger)", "value": "4033e593bd9ac43b4655575f7b1e58d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930794, "uuid": "5ce7a5d6-30f4-4b5d-8822-1bd2c80649fd", "comment": "Malware payload (SnakeKeylogger)", "value": "89aa399d49ef918b54805423f497ca4ae1f8bba17f2be49b2707df18c36819b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930794, "uuid": "5f363711-f03a-4ac6-a861-83df18b27d37", "comment": "Malware payload (SnakeKeylogger)", "value": "2bd4dafbf0907429784e0c710a43827f1f084fff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930794, "uuid": "fc107dee-1ea0-422e-bd52-443584299f29", "comment": "Malware payload (SnakeKeylogger)", "value": "642152e5d732625233d4a95f0ace07e454554bdfe4e796f5ad7a9b6d05f81b1b7f14a25ae23f4128e1015c5154320d6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930794, "uuid": "a6e4003b-a243-42f3-9339-f5ba8003fd2b", "value": "T1DCD4127A36B84D5EE2FD437A5EA1021257F6B5C2B0A3FB290F8438D11FAABC04157257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930794, "uuid": "2b1cb50b-897c-40bf-a293-2f3a9fc3a5a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930794, "uuid": "ddd7e111-c7bc-4738-a36d-dbd9d02ae37d", "value": "6144:APz7d+bDbqwrLb4O8Ghi9pHJrvcQi+ubSZncXkRFw8TDBErI+3n3DqVpZEFRi26I:K7dOD2wHN05cQUuZnfF52Lz0pBnQlQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930794, "uuid": "14f5f348-6196-4c42-b05e-1a2388feac57", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930794, "uuid": "77f58182-fe97-48c1-9d80-5bd2333752a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930794, "uuid": "29eebfd5-ca78-4ca6-875d-f540dfdd90b3", "value": "3eK8BaKUeH2aXqd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e0d021-a817-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675905503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905503, "uuid": "b5297e22-5b60-4b7a-9744-1d01f903c6df", "comment": "Malware payload (Amadey)", "value": "1a862e91f1167c4445acf8ad3ee48039", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905503, "uuid": "90dcfb00-ef07-4d1e-9a36-1e5284d16146", "comment": "Malware payload (Amadey)", "value": "89acc4b2bd3c3ac625abdeebec07f9215093e9527d17cb295d5ebb960a4599c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905503, "uuid": "ee186008-6c74-49f3-8611-0f071b1f1e41", "comment": "Malware payload (Amadey)", "value": "67ffbd46d645eff8d6c46e5614d05bcd9df95f79", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905503, "uuid": "28f548c8-1897-45e3-9d88-0c771bbb0829", "comment": "Malware payload (Amadey)", "value": "fd8bb792f13b01a0fe32350b7bd5e56d76d921299abf3212d9dfe7d60024a35d17c6c6e508f57860968758314a55c33f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905503, "uuid": "6c120c56-da4f-4074-b385-93be63446440", "value": "T15CC41247FBE88032E8B553704DFA03C31631BE625E39879B268F596A09725B0B931777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905503, "uuid": "595b07b4-b24e-4b07-aec4-07fa9d1d7b39", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905503, "uuid": "310a6e6c-7258-4a84-a341-b47ea55aa281", "value": "12288:GMrzy907jdIf2xt8lQ8jVdWJcooR70lfhXxF:lycSqtqndWJcooRAdhXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905503, "uuid": "8e2bb10e-162e-479c-91fa-dfc83173cde8", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905503, "uuid": "324b0121-35ee-4e6a-87c5-508b63bb321b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905503, "uuid": "44e85051-cbe3-4b2a-afa3-c7493a41e09e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d04932-a8ad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675969953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969953, "uuid": "4ac61284-b7b6-4b7f-afff-98c44f4d60d2", "comment": "Malware payload", "value": "593d69ac0e94b82c2522a7e6d7b2c55a", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969953, "uuid": "8a9560a4-abd6-4f54-8d89-7b52c1eb21ab", "comment": "Malware payload", "value": "89b5e9e35e796a62e0ffc96fd8f2ee6715d8837ea13db6b2be222be6bc87cdfc", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969953, "uuid": "2dd2b54e-5a65-459c-b5ed-dd6b6bb23b64", "comment": "Malware payload", "value": "d8c1102b6bf8f3f5659df3550f1063643ed66f50", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969953, "uuid": "d004358e-f0c9-477a-9400-c7a44225fddc", "comment": "Malware payload", "value": "971f3d12ce8f80074a96e2b6b42fac4cd507c0a42d16ce4a444f12599222051ea03b325e96befa8db0484dbe51305b8f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969953, "uuid": "62754e11-47cd-404f-b18c-4b3ff17a74b5", "value": "T1D3E16DCFAECB601B571762E66D723E0CBE222630D8908024BFF4E75EA765B1351416AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969953, "uuid": "75afa4c4-e882-4946-bb86-cbcb2f4180b7", "value": "96:SP1jWsLmNEbJPl0EJjAr3BZE5S4dwatCu2WJ3f2Wgw9RKUzVj5q4NaM+12AVool7:S3DFF6r/TC0u2W37V5q0aM0wqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675969953, "uuid": "ca91d055-93b6-401b-ab42-74f5bb696d22", "value": 7162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675969953, "uuid": "527542da-7a4c-4177-bcb1-f739eeccef34", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969953, "uuid": "a158078a-40fe-4af4-bf62-d7033e68d642", "value": "Agenzia_E3.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779efee8-a86e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675942792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942792, "uuid": "3c446924-33e8-401d-993e-f6b5df2fd563", "comment": "Malware payload (AgentTesla)", "value": "a604cc88f63b055d08ae741f1183951c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942792, "uuid": "58652d38-4762-4a89-b65c-9f2f18a6c035", "comment": "Malware payload (AgentTesla)", "value": "89f834c17348a6bbd04febb78911de13bfeb6c2d6ec084a1b4f2c72718308f3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942792, "uuid": "ac60a3a3-39c9-4933-9b50-becb54081854", "comment": "Malware payload (AgentTesla)", "value": "4eb8f6e4c572b5968aacea440724cea0e8db8025", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942792, "uuid": "69cdc306-5faa-49eb-bc23-3af90dea6470", "comment": "Malware payload (AgentTesla)", "value": "8ce7e8b2f3f1f8b6d96496524433afb349bcde7207856ac0d2d4386ce519fa5eca1639c5ddd1220af63893e49e44e80f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942792, "uuid": "942f9ac7-8ce4-40c8-bcb4-5eceea520c1a", "value": "T1E432E7D04BAE64B2D259B033012A060D09BEE57734E709E4BECED58A37FD20E09F9176", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942792, "uuid": "30c8a1c9-cdaf-4bbc-b7e6-aa10aed5bde1", "value": "192:DtQeMLeWHB1KyLcfKbTrijvkuHzJC2bHLoP6MYFPEt1MI3QzfhPK3L:D6eMjB1dLcyb/ijcuHdbHLokUywQzob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675942792, "uuid": "91ff122c-c453-4c20-8836-598c8af17bc4", "value": 11918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675942792, "uuid": "e11b3ce2-e34c-47c1-bba3-1d4bf3d0a2e4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942792, "uuid": "75e320f0-ea7b-4675-8159-cf5b6f116fda", "value": "a604cc88f63b055d08ae741f1183951c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd3523e-a88f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675956840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956840, "uuid": "c8897dea-91ce-4bc2-967e-a1a63bc5f11b", "comment": "Malware payload (RemcosRAT)", "value": "1f19bf7bc66e1cae6b0878ab49c11d46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956840, "uuid": "7cb145d8-3f51-43fb-b404-78dc2077cf35", "comment": "Malware payload (RemcosRAT)", "value": "8a05af4181b5fcc326bbf7fcdec656ba66838fbc920b33742ee281816b1e9c83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956840, "uuid": "beb22a1a-cbe7-46c8-b762-fac0a5a6122a", "comment": "Malware payload (RemcosRAT)", "value": "c008060a1cc5aab19fdadd4b3d6a0b2d1fc6052c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956840, "uuid": "0419b246-fdec-4182-836a-ef137cbb8133", "comment": "Malware payload (RemcosRAT)", "value": "408293091e69fb1bfc3800d8dfa3a0c530615942d49afcde40b7140c69990c0b1db999d01a8a81c24114f3031a8e7ec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956840, "uuid": "06f9f42a-0feb-4ed3-a453-6720bd97c6a6", "value": "T12435F10B6DC75BA6D4D68970E3B919D803F08B5B1421F7E62DC902F4CB85B8E67225B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956840, "uuid": "a0d0ca60-2370-41d4-b148-5e3d4ffa0984", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956840, "uuid": "944fbc03-7f4d-4841-bd09-652890b898a2", "value": "24576:lq/ZM4+TklLmq663Sni7wn+zQs/Q0Gch566o:/T96iniUn+8so0Bv66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675956840, "uuid": "bb4f1c3e-ff19-4825-9cab-580daebfc398", "value": 1135104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675956840, "uuid": "643efd45-a292-468d-822c-a07d59de86d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956840, "uuid": "b4a02323-073b-4236-89dc-362c681c4968", "value": "TR7635 NX202302.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f419dab9-a8b7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675974354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675974354, "uuid": "ae224803-d4c1-41ee-8566-bea02ed3e632", "comment": "Malware payload", "value": "457988d274925c9ff8639903888aad0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675974354, "uuid": "f8686ae7-3b6f-418b-8bef-9fe386eb1fb8", "comment": "Malware payload", "value": "8a15ad5d572723940d56d21c790594aa25d0dc55f4a2696fd8d3bf627f6ee0d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675974354, "uuid": "5fc7442b-4814-4c58-be5b-ab0be4b3d736", "comment": "Malware payload", "value": "4bb50d2e8eb06e7468b43a8fc51af2d77f266500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675974354, "uuid": "5b282e61-3f24-4ec3-a82c-2c028dcb7114", "comment": "Malware payload", "value": "5e6eca3d728827811605c8403e248fcc882b234a64a30c7613d08fd4b7f9d81d09facb2c4c52711de983b6c27a8b2e61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675974354, "uuid": "6e300b07-b4fa-4b8d-b1ac-d8f5dace007e", "value": "T183B40207E6E88133EDB1677019F307D31676BD505B7887AB634EAD1A0CB25A0B67132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675974354, "uuid": "52434057-2a7c-4d52-8910-a476f0840f9a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675974354, "uuid": "83534458-47d5-4f86-af79-5d4e82b446e5", "value": "6144:Kby+bnr+tp0yN90QEPTwMn/tGIbU6Zt3OtTDSB2HPhjA0U67rEggBMunewJAbwfR:RMrNy909BLbZ7qSR07HEggVVqbwhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675974354, "uuid": "50fd429e-c77c-4135-b759-dd3a0d2a99fa", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675974354, "uuid": "268e27db-2057-4693-87a0-9d598544a2b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675974354, "uuid": "45258244-9845-42fe-98c5-fd9a6ff6fa9a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574646bc-a8d2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675985687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675985687, "uuid": "09681908-d8ed-4e90-bbd2-c3aac850f05d", "comment": "Malware payload", "value": "167be436b1a4e446e313842f262068c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675985687, "uuid": "dff451f3-037b-4ea7-bb92-48296697eeb7", "comment": "Malware payload", "value": "8a4383a696b53869509f729543ea418873879bc1f1ff4db4bb6085abeb76ae0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675985687, "uuid": "7419fbbf-5484-4f22-89b0-388a9738bdba", "comment": "Malware payload", "value": "75ff1fa15461a6281e9c06968c787e0b66600598", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675985687, "uuid": "2c6036a7-8f68-4738-8d76-c9fb3e057ba8", "comment": "Malware payload", "value": "85b6a6c2a9015531cd6955aa4d4c9884d755cb4cb4cf467684fa44e94b8bbc4f3584932624116797532a8f2e1b77b010", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675985687, "uuid": "4983d31e-2a60-42bb-ac65-f3d0084843ba", "value": "T186B4020BE7FC8126ECB5133005F603D31A36BE6199798357679E7D5A2C726B0A632327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675985687, "uuid": "ecf99eb7-20b5-4ee0-9e3d-08b4d0fc2484", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675985687, "uuid": "705bb1b0-faa7-4520-bed5-d42718cc8a09", "value": "12288:ZMrRy90hnJoMJXI7UMcM64yvQPtKCVt0pi3ifF2XXoGnydJ6S39:8y+nJ/ISBvQ1KCj8i3ifF2znydJ6St", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675985687, "uuid": "0e92aaff-5ed9-4350-afca-079ff029facd", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675985687, "uuid": "da3b15ac-0d10-4c28-9aea-ca15e0ae6151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675985687, "uuid": "9483a33d-3510-4008-bac2-6eebab81566a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11dfeec-a87b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675948552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948552, "uuid": "24a5d2ec-780d-4294-b82b-9fcd80d945c3", "comment": "Malware payload (Tofsee)", "value": "4bd0f4422d8f22090c6c4a49468b0d80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948552, "uuid": "241b430e-825a-4564-9ed8-de3316c4cae5", "comment": "Malware payload (Tofsee)", "value": "8a9808633a0a0171845d6faa0943cad8ecd7cdf9877f8e4c1af7c72f39eeaaf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948552, "uuid": "0bf80dc4-945a-404a-95d6-f316e6cca226", "comment": "Malware payload (Tofsee)", "value": "35eab50da55b3dcb668cdc7c912d9e11480c9edd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948552, "uuid": "5e7a2596-22d6-46db-bfa9-379568e36a07", "comment": "Malware payload (Tofsee)", "value": "3dd4a6078341f4b278bbdc3a1a9118cd622d598ebad102432060881ec6a384acdcd442d950ea66ee17f5796ceafcb041", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948552, "uuid": "2f01948c-af03-4f28-8eb9-1365af24fa08", "value": "T15D14D03236D0C072C06B61345824EA79B7BEB8309775CE577B982BAE5F307D16636386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948552, "uuid": "661fd38f-a853-4ac5-91e4-49b30ee3318c", "value": "30b62189dd33bea0f552414113e8b2af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948552, "uuid": "e034b41c-e3c3-4fa7-9173-c26f49c8beef", "value": "3072:DJJOZjZ0CB81LhAACWWU5zzIfuefw/TDpP9bC3dIpc8lOpE9Z:DJJATgL+hMIfuWw/bbCNNIOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675948552, "uuid": "cd9cdaf3-7f80-4a98-b10d-6e20ea8a29b7", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675948552, "uuid": "3f82b91c-fad4-4670-a169-36582eab2881", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948552, "uuid": "e949d3e1-46e9-4ad3-a8fc-102e86d219eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d46b447-a892-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675958210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958210, "uuid": "23ed3382-c6b5-4b12-8689-7371b955b371", "comment": "Malware payload (Amadey)", "value": "69b8211d8f809e0ee14571c22f97f8f9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958210, "uuid": "20ae4749-cca8-406f-936b-485347c65327", "comment": "Malware payload (Amadey)", "value": "8aca448b48e7a913e90d21c325fb8d1c882bf2f8d70d3546517ec08a9fa832ad", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958210, "uuid": "758d52d8-1c20-4a53-99f7-70ca7b675d60", "comment": "Malware payload (Amadey)", "value": "50d9752d67863f50fbac8c8be829d5ce8935e00d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958210, "uuid": "e48459dd-269b-4ef7-aee9-48fc72d5158d", "comment": "Malware payload (Amadey)", "value": "c231607d98be73151ae0a18d4ca937d73af2b714192e2b8a1b88bc729e46b8276446789b585d8b5b604786b0e20df89a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958210, "uuid": "08df774a-5c84-46b4-9ab5-e9e6b42bbbae", "value": "T16BB4021BEBED5462E5B11B7019F203D30A36BD606B38965B370E685A0CB32B47336767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958210, "uuid": "d3644d4e-175a-4335-b55e-bbba55f462a8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958210, "uuid": "e91185ee-ec44-466f-9cf7-429c5b010d23", "value": "12288:rMr0y90GdQoHCtVIDbcMN+TFe5nFDJ02FXD0/XSvAXyve3:byBHqVIsMN+TcJde2FXD0Ph3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675958210, "uuid": "5131981a-4b69-49f1-94b7-68d023d2aa54", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675958210, "uuid": "e39ceca2-37d7-488d-8d8e-b4365153277b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958210, "uuid": "fa6f3924-defa-4366-8a25-41c1fa9fdd5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4c0e3e-a8a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675967686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675967686, "uuid": "f31e0df1-0870-47a4-9220-d8cfcc4722fb", "comment": "Malware payload (Amadey)", "value": "d54f63a84b833f94f99197dddbcb88cc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675967686, "uuid": "31e08d7c-b071-4dae-99db-376ffc2934b4", "comment": "Malware payload (Amadey)", "value": "8afb090bbdd3c67bae93803d73768fa4427a6ab9a5dda1f5ae4b76530552c66a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675967686, "uuid": "9e1af144-035f-42f8-9926-23814cc58a3c", "comment": "Malware payload (Amadey)", "value": "396bd5021d9d94ffa781d298d2cacd5fe02b5d04", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675967686, "uuid": "7b5893fa-0937-4d80-b28e-80d6b51dd662", "comment": "Malware payload (Amadey)", "value": "f4612ea83d78fe1c304d0853322a0cd52518654ab13e7246627b42082ad3d7c02e0b68a1e9899bb74ee9a246a830b38b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675967686, "uuid": "6571ac23-c18e-4d0e-bfcf-eb246d92b503", "value": "T1CEB40207B3E88066E875273058F603D31A32BF925A34879B274F6D1E1C726E47A3576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675967686, "uuid": "df97b2f1-aaf0-41f3-a83b-f9df49ea415d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675967686, "uuid": "e9e942d0-5bc2-4294-a01f-dea56cd758ed", "value": "12288:AMryy90cWEupO0SlUkfxuaNTiqqbAiNB:iyMO0SldxuaiAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675967686, "uuid": "9257511c-e78d-446e-98ca-cf6f4f16b796", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675967686, "uuid": "c189382c-f766-43ac-8aaa-39ffb05af4de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675967686, "uuid": "6bad1c9e-b521-495f-802c-c5c3450a2208", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27f0e8d-a8c3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675979452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675979452, "uuid": "ad3caca3-e0cb-4230-8e27-ae6b306446e3", "comment": "Malware payload", "value": "ed0e4d1affe7c40be593bebf61827c93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675979452, "uuid": "fa3bb066-4d4d-49dc-a505-f2c5be4530f2", "comment": "Malware payload", "value": "8b4a183d430dd71264506e908d69db9e3fe03183234d3caf9c49ecab1dd16c90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675979452, "uuid": "076b58f5-9fd1-466a-9d6c-3aa0235ede7f", "comment": "Malware payload", "value": "f365453b52d99be440dbe67d1b5ca5acf7351433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675979452, "uuid": "deb64576-992b-4ffd-b041-70d18d878f91", "comment": "Malware payload", "value": "7eacb41adbb829fa1cbbc83b950c2ab53b894db7ee9219c62b76cb32270cdefdb80f7e48d8aff988fd819dd72303b570", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675979452, "uuid": "a9a6f9b8-ce6e-4b1b-9dbd-3fd4624c3f49", "value": "T1FCB40247A7FC8433D4F5177119FA42C30636BE805A78978B268B5C494DB36B0BA3672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675979452, "uuid": "6b785cd3-9c60-4023-b306-c3b7416361a4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675979452, "uuid": "c4a71cdd-ed3b-46b1-83f1-0856287f6a55", "value": "12288:4Mrhy90GAb1xYVDvnGYY28qyiiz6DqYaEvWqvDvzIVgL:py4UVDu8xiUqYl4VgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675979452, "uuid": "f83fa1db-bd23-43cc-9e9c-8c321c65dd3d", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675979452, "uuid": "cc17b265-d495-4226-a42b-0933c4e9855b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675979452, "uuid": "e99e43e6-051b-4087-93dd-2ccde0fe982f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f024f4-a828-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675912646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675912646, "uuid": "ea3fcae4-61e4-4fef-ba99-72fe6549bbc6", "comment": "Malware payload (Smoke Loader)", "value": "8c5e8512c943fe0f22e3baf6d7fb0ecd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675912646, "uuid": "2b877e48-be8e-425a-ae4f-8cab2d525f75", "comment": "Malware payload (Smoke Loader)", "value": "8bc988064a70352761805484be6c92910e033ec63ce6e011e7e68216c3cb7bc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675912646, "uuid": "9326573e-eabc-44d1-bb73-39f48ddc1b2b", "comment": "Malware payload (Smoke Loader)", "value": "d5e0421e4372cdaa7186689998ef7c8b42abf568", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675912646, "uuid": "c2cb1581-dacb-4a90-ba22-cc30e4cfa6ef", "comment": "Malware payload (Smoke Loader)", "value": "ffb970719bc388453d95de84df9181c6b80669b7eb42ece2ff7010679a0138655241d99d57b430bab085cb84715dfec6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675912646, "uuid": "a4f51388-1c5d-4e5d-ae96-732aad2a3ac3", "value": "T1CB641A0393E17D80EA2A8BF2DE1EE6E8765DF5508F4AB77512189B1F34B1272C563B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675912646, "uuid": "22c108ab-c64c-4682-9b46-6ca0ffd16e2e", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675912646, "uuid": "6a76c7c3-17a3-4cfc-ac61-2d76d7b2650e", "value": "3072:QPE0IArLWPRdHbphTLtiCWR1G8b6tU+gqCQENe+pGSCvGz3:QM0IA3AVh/gR1GA6tUxQkeQGSSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675912646, "uuid": "972a7166-b1aa-4a89-a019-de133d141aa9", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675912646, "uuid": "382c6116-475b-47a2-9562-bb76a5744c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675912646, "uuid": "e60f236b-c6ae-43f1-9066-25506ae9af44", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ac8122-a83d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675921881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675921881, "uuid": "96d75327-d81e-49f7-9c11-70cbe53851f9", "comment": "Malware payload", "value": "4283f36c5dd58523ead73e5c89f3b8d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675921881, "uuid": "78043be0-44d4-4422-b2e8-72b07e15546e", "comment": "Malware payload", "value": "8bfd499350dc36e9ad85f70e01249bb917dfe4002d07c8fca7a780a1a4b2c6c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675921881, "uuid": "e80d196b-f3a0-4a8f-bf71-3a34ab94a3d0", "comment": "Malware payload", "value": "72062a06e73f3c2d931c27d677c0334b7c962e26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675921881, "uuid": "308008be-ad54-4452-8210-c8450bbc41f7", "comment": "Malware payload", "value": "97436ef6c7bf6e6b15b22542acf9647ee42b8e139e8452141610ce1df92d23a3b943fd23bf972761a8da67b9c22bac79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675921881, "uuid": "14971445-859b-43b9-b06a-0d69e2289709", "value": "T1C2F3D026F581864ACB29413909E76FB47373BE069591631FDFB62E2C5DF0288CC9468F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675921881, "uuid": "d0e8020e-37fb-456c-b4e9-a1c9b8370fee", "value": "1536:OevY6z54EJ+ytgXIeZCXIokE9Kkf2oY7LLw7wDzKiivL4w1jr8TYEo7/2x0R6Z+a:NgS2EJbyYeMYkKkyX3DWvLLATirRg+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675921881, "uuid": "656c6a56-a4cd-4f84-9636-73f87e0c1461", "value": 159184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675921881, "uuid": "91da8b5b-96ba-444b-aa2c-297905e5bd91", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675921881, "uuid": "c37d3627-479a-48b1-b4a3-675f0b3a04f0", "value": "Notes.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b08542-a83b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675920774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920774, "uuid": "d42e3f0e-a45c-4984-921e-768a7cdc7991", "comment": "Malware payload (RedLineStealer)", "value": "6dc516928839e8be09a1dda6a051a1a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920774, "uuid": "cfabfc3f-e048-45a7-a632-c523dc51df5a", "comment": "Malware payload (RedLineStealer)", "value": "8c43d5679f5ccf3057a6811d957f69378475ef4b5db27a36287ed4655e56370f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920774, "uuid": "ac74c5c5-9021-49ef-97d8-4eef08966005", "comment": "Malware payload (RedLineStealer)", "value": "25bdfd1a0e575808deafb45dc7fefddb85c0387c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920774, "uuid": "4930974e-07ff-43ab-ba5c-8f04ff3acc17", "comment": "Malware payload (RedLineStealer)", "value": "e6b6496a90009ff8109ebe8486ae2487c539d73b3b370f96d10b29f88e1d084d7cb3e1f8ecc6eeb99358f684ebfbe676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920774, "uuid": "a6947c6f-79b0-44ab-a2ca-a4c300f7da81", "value": "T17D64F1323AE0C032C57764705825C5A1BBAFB83056B1D95B776737AD9F302E1AA3538B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920774, "uuid": "fc32f807-3964-4c41-b454-4779c14679d6", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920774, "uuid": "1e9d8b8a-9057-4e2b-b00b-2cf30549cdea", "value": "6144:iG57CXLeL751nEnyGiOY21tQASs0fXF/sURGTVYCCb0lcLfCq3LN2+mlK:iG57CXCLl1nEHY21pqURBlI6+NT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675920774, "uuid": "2c6959d5-40e2-4dc0-af7a-08a4871edce4", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675920774, "uuid": "3aa00598-83b8-4717-acf5-35d437bf0fbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920774, "uuid": "a1c34934-9ad2-4a4f-bd05-c288c0e7357e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c22a6a9-a87e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675949510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675949510, "uuid": "6f4d21cf-4bf8-497a-a2f8-35c737189ad0", "comment": "Malware payload (RedLineStealer)", "value": "762fc17242be4b67b17bca660916d308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675949510, "uuid": "3f087576-c59a-401f-bf6e-0735cb89a820", "comment": "Malware payload (RedLineStealer)", "value": "8c5720e150de5ebc927c8dd75e42d910b2ea76aa5d2587f9de3ea8c397ce8fb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675949510, "uuid": "c145baf4-c1aa-41c3-a470-084fd5fd452a", "comment": "Malware payload (RedLineStealer)", "value": "9c1b713ba16644ce355e1425be103e75a9441b37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675949510, "uuid": "1699c2fb-8517-4de0-84fb-459efd58caac", "comment": "Malware payload (RedLineStealer)", "value": "61c1750faf65d2d60cdad5aedfaafb2155aa129b21fdb6a9471666cf003c496bfbea372047d36451fada62fa5b65512c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675949510, "uuid": "646c606a-2ae7-411a-aa3e-3c22ae7c5095", "value": "T19F64F2223AC0C072C52664356964FFA6FBBDB5304175CA9B3BA817EB9F302D19739346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675949510, "uuid": "0c413a2c-b54b-4794-bb7e-c0baabdf329f", "value": "30b62189dd33bea0f552414113e8b2af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675949510, "uuid": "36a60bda-cf53-445a-9a95-7d7aa991fbbb", "value": "6144:G9847nLiTSalVJTZGlJIKEFzpZiQL+uIzfqMvP8hNOHWzKbBnS2:G9847nGTSalPTZ6EhhiD08xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675949510, "uuid": "641f8f99-83dd-4cd0-9801-68fc5a55d947", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675949510, "uuid": "86f559c6-a721-439b-9a18-426323fa1ae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675949510, "uuid": "63ec4856-8b75-44d8-98e6-468f338f5281", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d75939-a8cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675982736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675982736, "uuid": "d3cb0617-9ee9-445c-9528-99792cdbda61", "comment": "Malware payload (AgentTesla)", "value": "87649feb76aa6b3bfe7511cf17393762", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675982736, "uuid": "3771c108-2529-406f-a61e-56b693576190", "comment": "Malware payload (AgentTesla)", "value": "8c5faa9edb4cab4b638814cfde7bfb5d58373f8b2476b11de1b1dc5fd68ab71d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675982736, "uuid": "11cab285-d123-47d7-a3b2-c6eaaf068818", "comment": "Malware payload (AgentTesla)", "value": "b44ee131f91247a4024d31326d1f6b4b69d9daad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675982736, "uuid": "1a881126-a266-4c70-8772-bbf29f001595", "comment": "Malware payload (AgentTesla)", "value": "07e451868e06e890b936978fc2eac92a1cd562f4e7eee5067a831f393ebe7ac1be527c4e491886ab76909fa328b512a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675982736, "uuid": "24bced0f-c700-498a-839e-3221a08d1768", "value": "T1CEF4120E673D585BCD8C81B4E0AA593013F2662AB256F3CDECE455EE6E03FE94B45083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675982736, "uuid": "b1093c58-81c4-4cb6-b230-d831f8f106b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675982736, "uuid": "5dc840d8-fe88-4192-a050-58dd83d10c98", "value": "12288:IL9a0twQD7vBwW3Vivw3dL+BHzgrK7L8NrOrx7p58lCrd4gyQapWMs0PA:sgCtLBR3QINhrK7A4rxN5IC54TWMZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675982736, "uuid": "efd0f0b1-b94f-4387-8f69-34b65509c511", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675982736, "uuid": "5b8a5cd2-f659-4f1a-8aeb-46b43239cdf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675982736, "uuid": "35b37c89-b0e4-4541-8666-a05a3e53222a", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3196df58-a82e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675915187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915187, "uuid": "ca2568c2-8194-493b-a0a6-a2a0e25e5e3a", "comment": "Malware payload (Amadey)", "value": "686307b1dce30613ddb69c58a952d1c7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915187, "uuid": "731ab3c6-8fbb-4cbc-8c15-c1ac4f0f6228", "comment": "Malware payload (Amadey)", "value": "8c975c635b3016d941d4fa561eda67261a6cce820b949a5e4a89d0a523954f84", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915187, "uuid": "0b71c0b9-9798-4363-acc6-5cb30fe0d53f", "comment": "Malware payload (Amadey)", "value": "698b6e62c8d001f4cdb91d281695f423c777a402", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915187, "uuid": "74f19971-7442-4c9a-b266-7a068c589485", "comment": "Malware payload (Amadey)", "value": "616d97b884b56b77510d0112528ae36191d916db97430b25737649ee6c86a7e8c2171ea2e3a0159b279c19382e28d125", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915187, "uuid": "8cf6f24f-77d2-4546-b6ec-c81d47a2944d", "value": "T1B6C40207BAFC4026E4B517701DFB02D30A377EA15F39429B769E5D5E0C322A4A93176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915187, "uuid": "ea977fca-ed10-4138-977c-2ba3125a315b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915187, "uuid": "8778226c-8df5-4e79-9965-eae1a12fd981", "value": "12288:5Mrey90fJ6lzY7hN7fTJa+blvuooXG8k56wk8KPv:jysJ6lyhN77JHvuoKG8+9Kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675915187, "uuid": "cd923ed8-3cf8-4a32-bc69-7e30d84b2e8c", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675915187, "uuid": "8424f35d-0bc5-4c07-be83-ae8f25623a64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915187, "uuid": "9232f423-01b5-478f-b09e-d6b8a1b7ae70", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6feaf2d5-a817-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675905413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905413, "uuid": "b48d9cad-d0fe-485f-acaa-73fa2d8f5291", "comment": "Malware payload (GCleaner)", "value": "196498ff5498a2d3c86f41e8e2484197", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905413, "uuid": "3763bbdd-e210-4c6b-8236-b7f582bca21c", "comment": "Malware payload (GCleaner)", "value": "8c9eceae322be0145c4fc19764cd06063cbb5c615b67326628707097f7e29e1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905413, "uuid": "7aed8a53-a902-4edb-af8d-820e062bbae8", "comment": "Malware payload (GCleaner)", "value": "d86f76a2e569f758fa8f9387696b19966ae23978", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905413, "uuid": "eec1bee0-40f3-4f7a-9950-5579e384d654", "comment": "Malware payload (GCleaner)", "value": "8269caac7f36f7708182f3c6f6863f412d0ef53ad6ec9f3d8e416a78faaf061f7dea41f9dc8da5bcaeee14dd5dd6bc58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905413, "uuid": "21a71b4f-aa0a-4c83-b736-aa0a6c4b9545", "value": "T114C5127D7205C4ACC290FEB48D2A98E35CD66DE3E9A4A02370DD7F3F557E1898A0A117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905413, "uuid": "3fe8a9d3-bb4c-49ec-bfb3-4ad4f4863bfb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905413, "uuid": "b42023a2-f344-4a9c-bfda-1981cdb9e580", "value": "49152:rdHLtSYmDrX3gBMYfi0psLxCq6LYL25GaZOQktb+it/LCgv2MR:JHp+XQqYf9ps1CxLYiYaZOQmbv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905413, "uuid": "33989bb0-976c-4421-a3ee-d9a0236198ff", "value": 2731079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905413, "uuid": "678aefab-2020-46fa-97cb-f40748ebc83a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905413, "uuid": "875faca6-e519-4abc-978e-59e83a9e4c18", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca233cb-a812-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675903179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903179, "uuid": "df405753-7407-4302-9da2-529cb33ce007", "comment": "Malware payload", "value": "ca8bb49562ab3bb40d699aaced9e8a0c", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903179, "uuid": "07778dbb-0efd-4cc4-bc72-4ac1b0f6a1c4", "comment": "Malware payload", "value": "8d95c2940ec202d2bf34ff5b506e60020be276572ae9cb83914a7d768a4a977a", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903179, "uuid": "566dba22-f2c4-4ca3-b57f-645cadf1428c", "comment": "Malware payload", "value": "a63015de7c1dd58cb5bb4a3b4d17e5ff1c016e49", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903179, "uuid": "fda4e8bc-0d6a-480b-8319-56b77a4bed47", "comment": "Malware payload", "value": "2690ac32a19c3523507586c6922a212cf6cae3ddba5e001e19b3efc71a21112175e0fbe57a1e1ab0c508a77994670b98", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903179, "uuid": "2e691e5f-679a-4669-a56b-63fc8bcfc5b9", "value": "T178A4238CCB655C7CEA6CEDB1E5E8570729661EA3A313C1CD7E30E158AC272615931B1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903179, "uuid": "9e401982-2af7-4b60-bf06-07c41b374cff", "value": "12288:Uidlo9fwYbVwVLL5JbEnRg9QU/lZLdmTcCDoD7HHhMu:Q+YkLLziRg9QAjRCED7HHhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675903179, "uuid": "f343899b-b20d-46b1-8a82-f85759ac7d76", "value": 454996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675903179, "uuid": "5f80e30f-2bf1-4105-b22f-7fcf82119aa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903179, "uuid": "4ae5b61e-0574-464d-9e82-5cc730837031", "value": "st4rlightmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdfd46aa-a86b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675941729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675941729, "uuid": "d1e325ae-23d2-4e70-8733-9843c0f25db4", "comment": "Malware payload (AgentTesla)", "value": "9d096ac30f558344604f4421066c40bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675941729, "uuid": "d6a33da6-aa9b-4faf-ac1b-ab4d3b642ff8", "comment": "Malware payload (AgentTesla)", "value": "8d97734ba750884ff9d858ed6924e4c9822eb31d34900f4ee5e2870eb0f84cb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675941729, "uuid": "2f77de6f-6ee9-44ee-b9b5-148dd60013fd", "comment": "Malware payload (AgentTesla)", "value": "d2921b1ea5ab957acc47e3ac9fafe69ea0bfab5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675941729, "uuid": "c1bb1abc-fc4f-4e81-952e-a8c5c131ee7c", "comment": "Malware payload (AgentTesla)", "value": "15a89b29151280e0878e75f82f5d4022b3fb2e5246aeac632bff0a048a79d70a4ef04bedfd446a53689f38561102780e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675941729, "uuid": "5d4495df-dcd4-461a-89c8-933271692633", "value": "T1CEE4C42D79B647E2C274F93682E78620BABD52933303D919D9DE1BF04F426827D8B51C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675941729, "uuid": "e508464c-ee9a-4ff6-ae13-e5c1bb65bd71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675941729, "uuid": "15324f82-607b-4294-bc33-52e5460f13c4", "value": "12288:0Y7whVe5d6U6sRg9db30NOQA+/7lRAtUnPODh9p+po5jx4eEwJ6Q00Q1BhMoEMSZ:zOLsRg9db30NOQA+/7lgUPODh9zhJk0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675941729, "uuid": "0d4fab5e-cf5c-417f-b4b9-eb09edcd0712", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675941729, "uuid": "5c159405-9097-41fb-abda-5e3b80fa4b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675941729, "uuid": "948fe5ae-3163-4e02-8c5a-6b99ac5684f2", "value": "R18bNCrdBQbK14j.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a99ab6-a810-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675902450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902450, "uuid": "188a3497-de02-4e88-9227-1832ee0d226f", "comment": "Malware payload (Gafgyt)", "value": "c87d5c5f901b61dbe0ed07449ad717ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902450, "uuid": "1b0c2f95-75ee-4468-a21c-d9674aa6fb43", "comment": "Malware payload (Gafgyt)", "value": "8da698ef73e6bf52c63d23f4bdadeda2965f12c13de9785508f031c77b93e424", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902450, "uuid": "690fbfc6-bbc4-4942-acaf-6c1c40aa17d8", "comment": "Malware payload (Gafgyt)", "value": "3852c9055d0d1e80a8db8b857bcdf6b05200b238", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902450, "uuid": "821e7a47-4ce9-4c71-9ba4-c3c3f3c99fd6", "comment": "Malware payload (Gafgyt)", "value": "b75d271f8a1027432c68526f1d3a2a8e50ebe2dd10dab68d332caff8e58f441962c2e93e641e8bf90b3825ab146924b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902450, "uuid": "8461c199-e421-447d-ac0b-e061026390f6", "value": "T108B3192B7B170F23C0CA107116E31732AAB5D79534B99397AAD03DAC6F17AC43816BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902450, "uuid": "8fe0ecbf-fc41-4ad7-88ea-6c8574e12226", "value": "1536:S+yS09vNUzhPtyN/E5ut63t4S/bUx9G0cmX2FM/PUj8fEYX:iFN6hPENM73t4Su9cmX2FM/PY8fEYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902450, "uuid": "835a2e9e-7b4b-4736-9394-5d7944c10586", "value": 108015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902450, "uuid": "b4a8bc41-72d7-4bc7-9859-d66f43c7235e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902450, "uuid": "f1e5a5b8-a68b-419d-ab51-7c3b0338d93a", "value": "c87d5c5f901b61dbe0ed07449ad717ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2deb0e-a836-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675918932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918932, "uuid": "d4a25882-4719-4621-abdd-a539fc2fd66d", "comment": "Malware payload (Amadey)", "value": "0bcda69c341128970fd12ef70bf41296", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918932, "uuid": "0d797bde-5116-45be-be81-f2b500bf28e3", "comment": "Malware payload (Amadey)", "value": "8ddb2c0c5f08724bb9e9c60a996429484c7851ebb35d66ccc0ce2c331b568f7c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918932, "uuid": "116f704f-33a9-4c7c-a98b-38691ce68a34", "comment": "Malware payload (Amadey)", "value": "2b3d34d7dbf0603305d07c4493bbecb774f03271", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918932, "uuid": "5da86d6d-a949-465a-8049-7f96d8019089", "comment": "Malware payload (Amadey)", "value": "82dc8e8ac9e03b6291fb8704ed3feed8e398189a5b110097f507bfd6c81310eda345f2f45d302bc68567e80774e9bdb1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918932, "uuid": "7d2fe8ee-6918-4124-9b7d-21049ae550fc", "value": "T124C4121BABE84122ECB1637059F503D30A36BE709A39826B274B3D5D1C726B0757276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918932, "uuid": "e0b19719-2710-45f3-88fe-4bc21c9615fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918932, "uuid": "dce8b0b7-0b4b-4f12-9d9a-147d4eaacc48", "value": "12288:IMr8y901muElPJyL2NkTFtLR6iIRGCRDu4R02xpA4H:kynulwkPR6USE2xdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675918932, "uuid": "0cc81882-31c7-42af-82fd-46e6d42ff2bc", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675918932, "uuid": "758bd83b-c0ed-4b6f-99c1-0543f3a7c71a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918932, "uuid": "38654e2c-16fb-4d33-8a3f-3a7a470e44fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c176ecab-a822-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675910274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910274, "uuid": "9e510dd3-9cff-4ff8-9591-16b187f00bef", "comment": "Malware payload", "value": "322a90541936278db6fcd3188851ed6d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910274, "uuid": "4ec0f0ae-8338-4143-a679-e0c44ba1bb10", "comment": "Malware payload", "value": "8df6fc26f7eeacff5618f6da59f196b44e20dfa144a56f2e2a9b6894ee9add00", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910274, "uuid": "9bd4b7f2-d3e7-4824-84ac-ec3ef5edf8c9", "comment": "Malware payload", "value": "d9737a2a7c4cb28e20f0278b5eab448ab11e15bd", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910274, "uuid": "f24b9853-f717-4430-b327-afac962804c2", "comment": "Malware payload", "value": "19158bd5f4a2f8577a7d19c0bf69e55bb988c306c19475dfd49cf652052525ced4d8d7f95e36790531d56d1836454f93", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910274, "uuid": "f7239dfb-3a2c-4ef0-8e44-6b828b5705af", "value": "T163A5331D3FD02625DB48EB2876714FAC27D13832211C857D85A3285621F79B3BFED2A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910274, "uuid": "ab78bf9f-a2e1-4f45-8545-877ee7f2a385", "value": "49152:IBzfLR71tcUEHEymvnp8GYIL+b34gwAOJH4ch9DAxGArM4S/u0:0zfLRvcUNvp8TR/wAOp1kGWQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675910274, "uuid": "cdefa22a-ebb7-4d6a-8cd6-9298502b2f3b", "value": 2210704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675910274, "uuid": "c8c0f4c6-03b3-41f7-9dbb-322a8a6630e2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910274, "uuid": "49879e53-8d46-4a0a-a3ea-8205a674ff7b", "value": "\u6d41\u4f53\u718a\u6837\u5f0f.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd4c0f3-a84c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675928418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928418, "uuid": "dfa5a380-f5fb-47ba-b8cc-9081087fc10a", "comment": "Malware payload (Formbook)", "value": "7e8cb21ab53965e70be829eb0f498325", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928418, "uuid": "f4a1556f-6bfc-4d29-ab5c-d5e30d986f0e", "comment": "Malware payload (Formbook)", "value": "8e30c4e8ca2ff188c1ac1c6f773648b4404675de1a085a110830dbe3b01090df", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928418, "uuid": "243440c4-610b-489b-ae92-cc920c3ee899", "comment": "Malware payload (Formbook)", "value": "2bdbf1e1c9ede9f3e3889a0afd2ca3b3da27bb97", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928418, "uuid": "767fe6fc-a934-4828-a4a5-5fb989919cfb", "comment": "Malware payload (Formbook)", "value": "17155ef2dbff12baedc0ecf0181563dd84c1171663703d65ca924bd8b6cca31b8f9afe623f714f7d2877b2a6fe0609b6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928418, "uuid": "abf1c2d2-96f1-4c45-ac33-640e81bbd4a9", "value": "T11CD19D7828EE85B8D4350CDC2D7B520F96113E1388C7D06F32C213AA7BCA8768B47A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928418, "uuid": "c9ad261f-68d3-40c0-b7a7-e3c3f707e93f", "value": "192:83BJVVkFK05dAMjFV5sCt1PpfiyqaCphZE/nrH8:83/KvAMjFXs+pbZHnrH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675928418, "uuid": "b0f74b18-09c5-4451-8ce9-7a995319712f", "value": 6557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675928418, "uuid": "0dfb46d0-701d-42a2-9194-51410f7ede9c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928418, "uuid": "94e5d3df-fa90-4ac9-a0fe-0b20d9d346ec", "value": "00987654334567.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d146442-a821-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675909623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909623, "uuid": "e7740347-26d1-447c-8b1b-67d3c417f157", "comment": "Malware payload (Amadey)", "value": "25ebf5e9b03949fe9cc344ee55c40324", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909623, "uuid": "169741a0-bf5b-4502-b437-f5d5d0ce4a32", "comment": "Malware payload (Amadey)", "value": "8eb5eb7ee17d87896fbaea1894083caefd84467a1c7b3a54a5703b157e476de2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909623, "uuid": "09807290-a62a-40c8-8e1a-1b523ed235ce", "comment": "Malware payload (Amadey)", "value": "31473714e11e3769922c90c951bfbbb5533a1108", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675909623, "uuid": "50a2121a-4fe2-4582-9972-80deb7e85d9e", "comment": "Malware payload (Amadey)", "value": "7ed823e8ab9f4971e6af5893a59aecaaf81b8e5d88ffd2b1d6c733e026daccd4b5680aee0b4f423bf06e0f9b4aa18527", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909623, "uuid": "54f3c30b-9d27-4a88-bf4d-a4eb0d86e3d6", "value": "T151C41207BAEC8432E9B45B705DF502C30A367EA05B78876B538F1D5A1C331B4A6B572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909623, "uuid": "68ad4069-365d-40a7-bc91-1fcd5535dccb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909623, "uuid": "176fe68d-3877-4974-86a1-9ea92302c99e", "value": "12288:SMrvy90oHb7Vi0muBLFBf7D/zfU6luGwtacp/:9yNHnVmQL7P/zfxn3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675909623, "uuid": "f8da2874-9f13-44d2-ac3f-968771d1ea9d", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675909623, "uuid": "b33f4156-4011-41a3-bff1-e29b7e218324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675909623, "uuid": "ed3d26f6-79c4-4a64-a405-e1adeb59c201", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8060332c-a886-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675953115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953115, "uuid": "fdffe80d-7fb8-423f-8c80-c5d5135a8996", "comment": "Malware payload", "value": "8c8bc7c5c822989134dac40f698b4107", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953115, "uuid": "80454821-d4f3-4b6e-a1ef-5696ad0def2a", "comment": "Malware payload", "value": "8f198226d9fb953d8d30f8e992328cc365e4b193341942cb74f26f195e6869de", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953115, "uuid": "e3483f25-ae28-476b-8308-6859d9db303f", "comment": "Malware payload", "value": "632360030e44bdba6839e90810b401afbdf87c1c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953115, "uuid": "69783eaf-05a0-43dc-8e6a-6ca16263eea2", "comment": "Malware payload", "value": "fe3211653e4572c0ca08fc69a6894e18eb71c657607185aeb6a58345f499360f64c0a678b33fafe94483205d5209f472", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953115, "uuid": "318ba1fe-4263-4f7b-a045-d1e7537ad964", "value": "T166E34A17B3E831E8D626C53589A0C516FB33BC651A219F0F26544A7A1F323A1FD3DB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953115, "uuid": "6aebfb7b-2f4a-4dc6-b0e7-e31ea488ed6c", "value": "1bc8760ae70fb16e8bcc6416dce42e07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953115, "uuid": "ba5ae53d-1898-490e-b49c-2420f3a69424", "value": "3072:lpsydTBXnC1mr/U9AOMMvuQwxAnfpYl7DQF+bwMq:lKyi1m/XQwspOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953115, "uuid": "ef7fabd6-92a3-401f-b506-e0705bc766fd", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953115, "uuid": "179fe47c-d960-45c7-b188-3d025931f409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953115, "uuid": "e4ce8f4d-6bd1-4682-9bce-265a317bcd6e", "value": "2023-02-09_8c8bc7c5c822989134dac40f698b4107_lockbit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49949b81-a88d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675956029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956029, "uuid": "b2b275cc-ff0f-4ecf-8fe6-2dd23cd7b0ec", "comment": "Malware payload (Amadey)", "value": "a4f88b3f03eec9e55aa084be3eefbd9a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956029, "uuid": "df32dffb-41a6-4139-ab44-5e5c6d09662e", "comment": "Malware payload (Amadey)", "value": "900a26cf46d382b11fa2126176af4462765536cb1f0602b34d0c4ad208177766", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956029, "uuid": "e2662d3b-760d-4508-b429-6627a4a77c9f", "comment": "Malware payload (Amadey)", "value": "53e75439be6ce3832e10a2b805cf590b2612c2fb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956029, "uuid": "4b8f3a90-14e3-431a-b7ee-cba565e45ce3", "comment": "Malware payload (Amadey)", "value": "a35a993c5cdbf43d7f5783de8e3eb3dadc522c0d6105b86209f1f436b4e17f704fcfa321e6611c981719a5469a20bf81", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956029, "uuid": "1a5569b2-7185-40cb-aee1-711e0e0d357b", "value": "T10EB4021BE6EC9072E9B5177009F706C306377E502A3843AB374E6C5E1C72274A9767AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956029, "uuid": "429cddc2-ed3b-4161-a2a1-67db819108c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956029, "uuid": "533ec9b1-5964-447a-90c9-e7bad965d726", "value": "12288:9MrAy90qdffrrTpyf4L3s6UIsja92DYUOqR3wG9/2p:hyFlPpi4BUDjaRHqRJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675956029, "uuid": "b7578a86-9751-4f7b-85a3-3585e5d95f06", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675956029, "uuid": "500bcc3f-740b-448f-a26f-d5116c716886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956029, "uuid": "592ffaf4-c510-4e9f-9277-b3dfb7a665ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f3c794-a873-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675944937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944937, "uuid": "e711de98-0302-487d-9ec7-2ebd8b1d6ea0", "comment": "Malware payload (NanoCore)", "value": "7418355fbb216d578c98d5e292589e4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944937, "uuid": "479e4105-4f30-40cb-b305-846e65edeaad", "comment": "Malware payload (NanoCore)", "value": "90e0763354e956676cf7c3c371672a4bad49f0ecab66570913391e83155424d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944937, "uuid": "c8a74a21-e089-44e9-be22-68ca7ba3dfb9", "comment": "Malware payload (NanoCore)", "value": "0e76d95092c9381c8523633cf2d082a6ee514677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944937, "uuid": "d53668be-3367-47c0-a5e9-e093c57c84ca", "comment": "Malware payload (NanoCore)", "value": "6a86269e0e8036f271f2ecb79552ad3b414e87deca8c3979ba85940698cf3d9e00d3a2676c84c9275f1d89bed8dc390a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944937, "uuid": "2e46095e-9962-4383-b7e7-a55296ceb764", "value": "T17515F16A3516495FF7AC8CFC96C162897BDCC0362B1387A58F342CB046E3B9B0D67466", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944937, "uuid": "1a72e9c1-352b-4bba-a955-5d6a9bd1543d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944937, "uuid": "d5cf5838-3a0d-40d0-b22e-f10fc6e34fdb", "value": "12288:NNVz2oeZYSrj298veGZW3ArKShY7xnwi3x7/rFQlQXdoVJH:bV1eW98WGZSA2SydwqBQlQXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675944937, "uuid": "61d200e5-215c-4afd-a55c-950d14f37293", "value": 920064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675944937, "uuid": "4dab5702-baf8-4e7c-835d-e8aff2bad7fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944937, "uuid": "b6021f90-3ecf-4637-bc2e-2c586f9390c4", "value": "INV~000098725267827282-PDF.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844e194f-a843-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675924345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924345, "uuid": "bd2f9442-313c-4df7-8421-62027103a401", "comment": "Malware payload (Amadey)", "value": "103e6e04bf296739e64f6f61aa072638", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924345, "uuid": "c8868424-3227-4bde-8ace-7fa1cd05f59b", "comment": "Malware payload (Amadey)", "value": "9107ab54cf976eb164fd41d707586f35551d19a70dfc638f5c7f6435f7b9dfbe", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924345, "uuid": "0c5da596-96e9-47aa-aa07-44365a6fc3c4", "comment": "Malware payload (Amadey)", "value": "a7c75cdab3eb92deeb4777010478c47d1d79fd1a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675924345, "uuid": "1eb93506-c72e-4bef-80a2-6741c7eb7770", "comment": "Malware payload (Amadey)", "value": "bfa7989663e8bb021e2c7512f62a3aad88a3672b7b23c399646f3ece745e6fcff77206dbb611623b88eec17af98c8963", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924345, "uuid": "9c258587-6223-42da-8ccc-941ef2e66e7b", "value": "T1E6B40217FBEC9062D8F557342CFA03D729367E918F38839B224F694918721A0A93577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924345, "uuid": "f591dd02-640b-4dd7-b8c7-8b4ce924636c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924345, "uuid": "9459acca-4de6-48e9-9fde-cc29fce83213", "value": "12288:LMrwy907LOJjCVjXdlyFX9Lrz6ekgRrN67tRPiZ1qbqWd9:vy6LXVjT+b6vtRqrql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675924345, "uuid": "3bb4a440-7be5-424a-919e-2f806e4790e7", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675924345, "uuid": "d2c7cbca-7531-481b-a656-e2431a4d39b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675924345, "uuid": "3cd65e98-907d-469d-89a3-590091094e3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3f7c4a-a82a-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675913488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913488, "uuid": "0779c5b5-5f0f-4be6-8d9f-92d1ddd2fc10", "comment": "Malware payload (LaplasClipper)", "value": "b6e95f107b0df72a9f5e129136b871e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913488, "uuid": "b5411cb7-7435-4e91-af44-9c6c71e1d1d6", "comment": "Malware payload (LaplasClipper)", "value": "91cb8db5d8281dd6d039e981cb95d39698252373c43360ba5983aa8607e449fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913488, "uuid": "43a45ddb-1d90-437b-9e16-4fa57d061735", "comment": "Malware payload (LaplasClipper)", "value": "9a0fb9f8cd1a4b6a04c4e28754fb6f8089b3801d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913488, "uuid": "7cb44c94-2f89-473e-87b5-a0856462c207", "comment": "Malware payload (LaplasClipper)", "value": "027ef09b29bc0f9a41713e4dc6cc66ccc441c456b4f76996d0d138086b56c1a6009b0e94797408e21695e99d379be159", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913488, "uuid": "2588c933-7730-463d-a01b-22daec45a85c", "value": "T1B8951203D2917D80EA2B86F1DE1FE2E8755EF5108E5EB77922199B2B30B2176C573B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913488, "uuid": "41d5167d-d686-436a-a33c-79c5e95d9374", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913488, "uuid": "be7c5e48-a6b2-4422-ba81-4bc6efd076bc", "value": "49152:CS+GoeCUYCCXbttSJ0uprL3FONWXbktbkIccixJ/efXe:CSfoeCAGbrSJ0uphktbkRxJ/6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675913488, "uuid": "42aff3c3-d4af-41d0-84be-7d608bccf7b4", "value": 1991680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675913488, "uuid": "499333f6-aa25-4495-aa4b-7712ebc46690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913488, "uuid": "06f33203-0655-4632-a7f4-6d6c747eed3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6b51ab-a818-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675905781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905781, "uuid": "963f6e3a-c3e0-4648-861a-b36b5a3f02e8", "comment": "Malware payload (Mirai)", "value": "57ea9070b135770250d7c93e86f6698b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905781, "uuid": "333ca9c3-5bbf-4a63-be35-aef65d82e553", "comment": "Malware payload (Mirai)", "value": "9249ecca44233702c422d5a1e7a513df9eb4e89416c5c7813b19e789883a7f00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905781, "uuid": "01c39b26-15d8-4b03-aa52-c03c24a5efbd", "comment": "Malware payload (Mirai)", "value": "42b4aba78aab9826aade7159ea59537475a66cda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905781, "uuid": "d6b0a247-8d52-41a1-b355-4ddcc8c7f2e7", "comment": "Malware payload (Mirai)", "value": "29ff768c6d0472f500951fd6976836ca5975237d2db1b96ec735afb8d877cdc56a31e7287578e70d3172a129846dcb0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905781, "uuid": "546601a1-a20d-4087-a9ef-1c353870d08b", "value": "T1E8338DB3C42E7D94F14AC278B9204B385B23D40696833EF5968AC6974047EECF6593F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905781, "uuid": "d2ca6690-ea6d-4a37-ade3-31e71f3e51c4", "value": "768:T3/zTfpYtWja5FLM5a0wtAmb8VjqZDoFKGFIPxCilrSeN74uHCZAoqrcCILMEa:T3/vpY6OMa0wtAtGoA6I5PtSgHiIcCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905781, "uuid": "15119132-60ef-4323-8f0a-15caff65e2c0", "value": 54680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905781, "uuid": "6ab82154-30a0-4498-bee7-cc5294b37794", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905781, "uuid": "b9b248a2-8733-4199-995c-30fe136b2e4e", "value": "57ea9070b135770250d7c93e86f6698b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe12e92-a8a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675965247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965247, "uuid": "4e50349b-5d68-4abf-956d-91387793d36c", "comment": "Malware payload (Amadey)", "value": "2aa7a094d1492012f70f410fc3c9d598", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965247, "uuid": "b494f337-c20d-46c7-9062-f188c27aaa29", "comment": "Malware payload (Amadey)", "value": "9259d510e167b789341e4a2d45d77fd49b840cd7a1633561d129f4dabf544e2c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965247, "uuid": "d5550714-937c-494f-ae80-1958b90a0dbe", "comment": "Malware payload (Amadey)", "value": "19c74cbb13bed95553e089492ed9d6c0bc06ea76", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965247, "uuid": "983b0925-0d81-4276-a2a2-aaa3ca8c0920", "comment": "Malware payload (Amadey)", "value": "429c90e681b46e653229a790a4ea00b62bd210ce70d99315d2440b88d61a9c5497b07d1a60293ec66c6911cdd76cd35f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965247, "uuid": "2bd21ffb-678b-4822-bd94-bf75850eda9f", "value": "T11BB40217F6E88022E8F0577018F603C31E3B7EA09635539B638A6D6A5C726B4B13577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965247, "uuid": "6db6fcb6-524c-425d-aa2e-5b80b5a0ac05", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965247, "uuid": "ec9a8b0c-2aac-4c52-a457-51b06fcd940f", "value": "12288:SMr2y90FDD0vWpdnnSG6+FhjCNMJ0XhvIc66TbD5Ww7:Ay0YvWpdLzvCy0xwc68Mw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675965247, "uuid": "b8ea0e15-bbef-47e0-ad70-1a9bf80e6528", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675965247, "uuid": "0bdbc85d-e424-4ee4-9f46-d66ed70b651a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965247, "uuid": "b68b4929-0ed0-47b0-a881-7973d69d82c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04472db5-a86f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675943028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943028, "uuid": "2f381107-9c99-4fe3-b9c2-2450f2d9b728", "comment": "Malware payload (RedLineStealer)", "value": "519e433a2f6d32c301cfb480dda5a25d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943028, "uuid": "98d88bd3-0875-4134-9bb5-f028161c7d17", "comment": "Malware payload (RedLineStealer)", "value": "93b6fef89c5c2a54938a2a3e734c031fbfab337bc842688cfdbf996ca841a768", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943028, "uuid": "41c9574f-1acc-421d-9e8f-4558c81c4668", "comment": "Malware payload (RedLineStealer)", "value": "782c3126ffc31f760c6011ccfec0b060a5834dd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943028, "uuid": "2da7a7be-9d6e-4b86-bee6-cdcc8ef92867", "comment": "Malware payload (RedLineStealer)", "value": "af8af1d7a6be82d29a19010053f4fbd8a7e819b260022fbdaece8ea1db75a8c00f7f10b1752a9891fead8cd4abd4a73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943028, "uuid": "1bef6007-77d6-4129-84d7-657dc6b06479", "value": "T13164F23335A0C472C56F61319860EAA5677FB8309679CA8B7F981BAD9F702E09137347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943028, "uuid": "5689825d-4a13-4383-b67a-ddeb2082de55", "value": "83d1b8095e33f74e23ddae505b88bb37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943028, "uuid": "be29eca3-79af-4223-b913-13497c490136", "value": "6144:whCD2Y9LfTRYb47F7mTzrN73MtV78B7M6avUKvW7pm:whCD2Y9DTgyFi/rNjCV7iMHvd+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675943028, "uuid": "5ccd3a92-5bef-4dc0-b8a0-18e39389f98b", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675943028, "uuid": "2df38bec-f8c5-48ea-aef0-d39e9a7c1b8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943028, "uuid": "7de8aa13-ebeb-4b55-93c8-3909f85459ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7986b1-a879-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675947684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947684, "uuid": "d7ccba7c-6b7f-40d7-8cda-f5b52cca93c8", "comment": "Malware payload (RecordBreaker)", "value": "205ea9f6c9c591315d909be7cc55f0b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947684, "uuid": "31e8e505-1a30-476b-a2fb-79e192e32c25", "comment": "Malware payload (RecordBreaker)", "value": "93dc3a6f3a3c2a24e3c04928dc5fab8d6b34a47fd52894a61992c60881c4fa17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947684, "uuid": "527324e2-0995-42b0-8fbb-5f92383e9242", "comment": "Malware payload (RecordBreaker)", "value": "7a909010d90949a026831b7a266b96d8a5cd4424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947684, "uuid": "b2e03bd2-5047-4349-a7c3-0b24491418a3", "comment": "Malware payload (RecordBreaker)", "value": "16c0244974a97a2fe9bac3e82b1318547eb7957cdf7ecc841f7085b02c52880a5381d5564455501a42c483a67aa2bdd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947684, "uuid": "20cf23f1-75a4-4efb-a514-3d14abce2048", "value": "T1B314CF323680C073C77B1130586DDAA57BBEB9318578894B7B941BAE5F302D1663E2B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947684, "uuid": "56e65349-87ad-4e82-b6b8-6a33d1735eea", "value": "83d1b8095e33f74e23ddae505b88bb37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947684, "uuid": "832d6c0d-a547-4ecc-a3a4-f0d97c70f102", "value": "3072:YhiOD1PRtPaldLMQKWAh5kH6zeXptxCWkhpA+TAciXT1MTI1T86afSO:Yhi0IdLjK/zMxCWkhpASAnJMc17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675947684, "uuid": "1db699c4-7408-484d-b433-f7ba9faf1415", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675947684, "uuid": "dedbaf5c-ad92-4450-8e77-767615c388d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947684, "uuid": "af00c39d-fc74-4a91-adc5-b45012e9f212", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b864483-a816-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675904842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904842, "uuid": "cb91cfc7-5003-45a6-b999-328915b9f1e9", "comment": "Malware payload (Mirai)", "value": "d3e3a54c202213e1c4990d40a2822157", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904842, "uuid": "aec31b99-57fa-44b1-8bfd-207045f20ef2", "comment": "Malware payload (Mirai)", "value": "9431c2a83a3cf4fa78fbec7ae5a90f03c4d02035b223f0585a0549ac86699bf2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904842, "uuid": "8410970b-8f70-43df-b578-dc0461570ed3", "comment": "Malware payload (Mirai)", "value": "41f51e4307fc42aa389a36e55fea68f5dedd15a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904842, "uuid": "ccb5ed8b-cf40-4a3f-8e25-7d1f85e0c106", "comment": "Malware payload (Mirai)", "value": "bdc32367b7a70581228f35a1b8d0c545baf745422a0312002d9eb5965a1dbf22b36aa09b9566d84f7a870fd303fa010e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904842, "uuid": "bceda5a7-7cd6-4c08-ae1a-39a9bc1a27bd", "value": "T12BB31856F8418B52C5C21976BA1E668E732307FDE3DF31129E245B206B9286B0F3BDC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904842, "uuid": "ee3bc1b5-42b7-40ed-9654-3943715efe75", "value": "1536:ebnpJozoVmkB/4fvEQTjXrNa8c+PM7ita8HJOCAk+5WpSdYIQ:8evkB/4ce5aea8HJOCAP0e0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675904842, "uuid": "83794ced-e86d-4a38-8a2c-1830fb704377", "value": 108344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675904842, "uuid": "ae8bb58f-4ca3-4504-bd5f-0484b6f646b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904842, "uuid": "05af76c8-76a3-45b2-8f20-cb6374b8a0bb", "value": "d3e3a54c202213e1c4990d40a2822157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70207dab-a836-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675918728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918728, "uuid": "f5b2008f-5688-4e7d-baa6-0c68b38f9084", "comment": "Malware payload (Smoke Loader)", "value": "3bb2c96f2dcb3b154dabaa7eef48a177", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918728, "uuid": "35766bf1-1603-4fb0-a41e-449032e65e69", "comment": "Malware payload (Smoke Loader)", "value": "944f3f3b0339e87ccc4a9d98eef7114ade32847a14415fe6536d2ce6e4c85ab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918728, "uuid": "6abbf3a2-cb19-4b65-8815-ad04022efc21", "comment": "Malware payload (Smoke Loader)", "value": "62609e0330cdf3fa9a922d1ff6f89843c7468519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918728, "uuid": "f7771ff7-5b62-4b8d-936f-6d8633684cfb", "comment": "Malware payload (Smoke Loader)", "value": "67483f3b3daeed095164f9e76a3bdc204b316a31276a55ce6cb843ce4d8b1137c05769c691f502f4ab20b152009b1242", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918728, "uuid": "197869c9-60ad-4548-9beb-f9c91759d65b", "value": "T16E642B0393E1BC90E92A8BF2DE1EE6E8765DF5508F4BB77512189B2F34B1172C563A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918728, "uuid": "1d4f04a2-d458-4599-b2dd-3766865b4a58", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918728, "uuid": "25291280-f831-4e52-838e-83f3353999fd", "value": "6144:BMcNSjAAjODglQLS/7O6pr0ZlQkeQGSsr:BMISjvEmO6QQkeis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675918728, "uuid": "a540a35e-acc3-45e3-9a3f-eedd4b1c4a42", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675918728, "uuid": "f2db78eb-2028-4049-91e8-49cc50a7fa20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918728, "uuid": "91271ca3-2c89-4129-a326-8418eb0c5fc6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc65ab33-a8c8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675981589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675981589, "uuid": "2a56ba87-a448-4e67-b42f-95dbf1fed60d", "comment": "Malware payload", "value": "8db3edf8493e52cd11e337ac437e1779", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675981589, "uuid": "d312798a-eecc-4b25-8d2b-e15c0151d2b8", "comment": "Malware payload", "value": "94617b9c72e6f1308bfa7674a65897349a05e64fa539a6711dde09524a9cccfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675981589, "uuid": "0437394b-fda3-4a2c-abfc-5c665b292f60", "comment": "Malware payload", "value": "a535c500e42de026bf3ac5753cbbb06731f5aec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675981589, "uuid": "bd9588db-8f4c-49f2-a86d-1290db27306e", "comment": "Malware payload", "value": "2f61b702fbce9d697a3e5389a3cc2cb9f7f97d52a43e134d2f462b8813e43c4450cb08e581be8aab7f8b7334550759fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675981589, "uuid": "48eb2054-cc5d-45ac-b0ae-757b1b2ac28c", "value": "T1E1B4020BE6ED8132ECB417305CF613D316367D909A74876A238EAD490DB25B0B67673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675981589, "uuid": "d058ba47-1671-420a-be3a-c275e68e6c78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675981589, "uuid": "22ee5f58-31b6-4146-ba66-aa78577e19ab", "value": "12288:tMrdy90b1L06jQO5WONUn2iz6D3Y1EvW3v3ct9LiEJT:Ey+1TbxU2iU3YdUSMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675981589, "uuid": "2418a711-08df-4c38-bb6a-a931ef2cb7c0", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675981589, "uuid": "3cc29660-edda-4f22-933c-899b93669337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675981589, "uuid": "88105e54-7bb3-426c-b003-c49ed403ad5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ab64a6-a8ad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675969842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969842, "uuid": "30527b00-86ae-4c5a-9287-0e285c23fd1e", "comment": "Malware payload", "value": "4c5d1467cf3555c1c6364af07acb95ce", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969842, "uuid": "4a62f175-8398-4ac5-a371-0a73c3524635", "comment": "Malware payload", "value": "946cacfb691861b4957e853b7129b31050905510e15b357a251adba29341e320", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969842, "uuid": "31377364-30c7-48c9-8b3c-636fafb96aa3", "comment": "Malware payload", "value": "29b70a45f3ff88e7375a90fe8f4385e631588a64", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969842, "uuid": "ba2673c9-b031-4948-8810-5d36bd67f1cb", "comment": "Malware payload", "value": "f9fa971a545c81e3bc132247c386cc8ae0b4a7a67acc02fb909cf7e69e6bf4b270bfbe65e6c13ab5ed43c8044b0a7788", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969842, "uuid": "1b974a98-af42-426f-90e5-a901cfaa8628", "value": "T1F3B16D6C918927EBC1C2C6382C4496429BB783DF9C76AFA25885B4527CFC4495CA8039", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969842, "uuid": "80fe854a-d024-4cb9-ba9f-44168d32c2b8", "value": "96:yOpVSa5X+BBMoTOsloLengMtRAwRrdX58z3q7dASIf0CthjUrr+8aAoOjBDsagUa:yOpAaB+BCaoLVMtyuN5RdIf0wjUrr76h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675969842, "uuid": "e3e9c23b-ce09-4c5d-b165-c98a525f34c5", "value": 5200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675969842, "uuid": "b7846b97-6b9d-44a1-a4b8-f222e47e0666", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969842, "uuid": "bc7777f4-72a5-4322-9e31-3445d3e3a3f3", "value": "Agenzia_E7.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0feb11fd-a855-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675931881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931881, "uuid": "029024d5-fde8-41ad-b025-7316ca7f987b", "comment": "Malware payload (AgentTesla)", "value": "dfa89f11d8334012ec96e462880e45c2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931881, "uuid": "2da65a4a-7fb0-4511-9849-0e40665873cf", "comment": "Malware payload (AgentTesla)", "value": "948936f52b7baf3132c947135c8831067f1ac4e3f644c265e3ac633140afccc4", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931881, "uuid": "e8929aca-ba68-477b-acdd-cb7a7e4e9367", "comment": "Malware payload (AgentTesla)", "value": "0491d5e4e2a6265a4421d78e6c2094eb8ebc8fd7", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931881, "uuid": "fb6824eb-2f89-429c-b387-fd7f3d727471", "comment": "Malware payload (AgentTesla)", "value": "690146d662809065615bd24d09f67f38d0e68b5310244834fcb0cd959d1c7e38ba40e4a244e1a721fe9f4842173fdddb", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931881, "uuid": "542339e1-5825-4ca5-873d-3362842b3278", "value": "T1606423543D9FE58078DD00D40FE5B470716833EBBEBEB091BEA18693AC053A6ABD251D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931881, "uuid": "9d98bf25-a287-4d05-b4aa-038009171247", "value": "6144:gs6jAuvxvt3dTvdN9JEUHSEXqGNylLCFYyr8o72mfWGQ2v32GkdZP3BprEu:guuvzdL+GqGMLdZGc2DUf7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675931881, "uuid": "c29ec9a9-b851-445d-8ae8-fb08521fbf04", "value": 316680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675931881, "uuid": "bc9b6123-802e-43e3-84a6-7a5a6320bf0b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931881, "uuid": "414df4b4-7ae0-4e9e-ab87-c3f3474a5a7f", "value": "RFQ- For UPVC PIPE-7482093.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e4e53e-a86d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675942202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942202, "uuid": "e4c62eb4-e961-4995-91d1-c31c83fe5ebf", "comment": "Malware payload (AgentTesla)", "value": "0bfdf1fe3f4cfa50b387202a4f561bff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942202, "uuid": "fb334fc9-0733-4e30-9509-119160c25f69", "comment": "Malware payload (AgentTesla)", "value": "94ab2945546adff6363b2730f2b6c7403f176ef66147c4adcb570f265fde789a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942202, "uuid": "c2752948-ca92-432f-9795-3cbc2c7f3d7f", "comment": "Malware payload (AgentTesla)", "value": "884c9f504059ef9f147fc2ee985e1cc7a134e054", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942202, "uuid": "0d7ab038-b2e8-4e04-bf2c-2044c9cf6efa", "comment": "Malware payload (AgentTesla)", "value": "057edf62d458055e7b88734ad057270fcda4e47a03a0a4b8128d7505748330f1827717f44f1073a5b72dc243eb52c233", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942202, "uuid": "fd91c67c-37ef-473f-ade2-a915f788076d", "value": "T110059339BAB64E96C234F97582E78220B9AC5D4B3303C95896DD37F00B72D81798F51E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942202, "uuid": "18592d33-7bef-498f-81c5-e83f934000c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942202, "uuid": "32c82d56-f0ae-492a-aa97-d65c25b04591", "value": "24576:DWr4LsRg9db30NOQA+/7l1RhkkLAbhNK+eLWol:SrXRqT3SLWol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675942202, "uuid": "93f5a270-eb92-463a-8c0a-d3f215aecbed", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675942202, "uuid": "086ff101-f11e-4e7a-8a14-c01357c931e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942202, "uuid": "54c2e1d1-5e1e-4fe1-8c8b-48e3b8d3a411", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396eadde-a898-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675960727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960727, "uuid": "ad9f9099-368b-4fa2-a118-f8e619f17a0d", "comment": "Malware payload", "value": "3b41a516c2985fb9b525b788dc7e5235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960727, "uuid": "c14423a9-8858-42fd-846d-bab8f3bfd91f", "comment": "Malware payload", "value": "94eb84ea10e9db6acb13b2d316f069ab2e705ce9c65a10c1d69d76486a8a5ef6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960727, "uuid": "aba87a23-62b7-4bda-afa6-f59d3a9e3ae3", "comment": "Malware payload", "value": "ee904c6eb7a1562acc77f61bd04cf0c778a5a857", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960727, "uuid": "017f835d-44db-4461-9341-fe6b91dc6bd6", "comment": "Malware payload", "value": "345b2b66c3737e5a3b2efd6cec66af8ad7f45d5e31392b940bc706401eddf95a71e27e3f8fc820f3801ea3d37fd6fe34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960727, "uuid": "ac7af2f2-741a-462c-933f-590c7265a17f", "value": "T1BC52296062DC5523F8BE1BB99CFA550043BCB5D3BD22CB6E21C850CEADC27414591B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960727, "uuid": "b39e25c9-d88f-4968-bf57-11f1e00dfa00", "value": "192:OzYVebFsga0ixbIbZBt/FN8yi9N+ebEXneo8F7zeqKAohkru6wzyuaZN4M7:kYVYVMI9/F6yIbE39y7zZKn6wzbaZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675960727, "uuid": "e588a7ab-067c-4956-9b12-264d1f9b17d8", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675960727, "uuid": "8702cf36-7f89-4801-b6d2-b467068eda66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960727, "uuid": "60c8bf3e-498f-46ed-9768-e83a6a64db50", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66801ef-a861-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675937368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937368, "uuid": "76a193ac-5b7c-4335-937f-eb4f5e62a2a2", "comment": "Malware payload (Amadey)", "value": "2b6d6ccb79eb1e73e4f57491c2a99ffd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937368, "uuid": "062f625b-8350-4fe3-9777-c503f5076d1e", "comment": "Malware payload (Amadey)", "value": "959714abba43970fb65cb7e22a0e2c183e6a68445c796cbe13f67de0df6003b9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937368, "uuid": "cf9f2fe2-068b-41cc-a4b9-2a42712ded11", "comment": "Malware payload (Amadey)", "value": "baf9a29c4136b322b152c291090c6f6755bae1d6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937368, "uuid": "5e81ced4-2e18-4ef0-b43f-c3b441f91430", "comment": "Malware payload (Amadey)", "value": "7d83bd249684daaaebc5f40beb5ce8905148f3651916385d24d48670d1d39a9f9b98bce5a170a31fa9713e877841a1b7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937368, "uuid": "147f7a04-93fb-4782-aa0f-53da7727c646", "value": "T121B40207E7EC8137E9B85BB019F507C30A36BD601B3887DB268F595A1C725A0A63177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937368, "uuid": "104c1c77-c123-47e7-bfc2-b584857aa3a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937368, "uuid": "e49c38e1-1935-4f10-afb6-68f52337b45c", "value": "12288:SMrvy90XmLfObFnKgtw5elmPZz/NK2wEgE:JyAXbFnZuekP9/kO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675937368, "uuid": "187ceeab-b913-4522-8f09-fd0885e32160", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675937368, "uuid": "9c997d44-0331-48b3-aece-3725373d33ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937368, "uuid": "20c6bcfb-35bc-4466-89e8-321077c33ad8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13a132e-a870-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675943721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943721, "uuid": "818e106a-c593-43d5-b5db-f8a0436a3c08", "comment": "Malware payload (AveMariaRAT)", "value": "2c1baada98fcf4067fe27afea6bd2d79", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943721, "uuid": "57fd52f4-f4c7-45e1-a240-d4aaa7c391ce", "comment": "Malware payload (AveMariaRAT)", "value": "95b549ff25b0b5eff9790ebd2c31bd21a44498531abb4426d6094ff18f368dbf", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943721, "uuid": "c851c629-bd21-40e6-aac3-c1af54da0e7c", "comment": "Malware payload (AveMariaRAT)", "value": "546e2a56ec926f1e4213a85e8ea7dbfb1e702e50", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943721, "uuid": "eacf626d-d3c7-4712-a8d5-8a35ab319eeb", "comment": "Malware payload (AveMariaRAT)", "value": "679d7219aba8ec15a6037fbf3aab97000b0e4c909b68dbd9aaa421496c9446f44ef2060cfbe0ef441222a7ac204caa61", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943721, "uuid": "197fca80-8072-447d-9dfd-25ffffc1bc0d", "value": "T1DF02AD24B98F8C59AFE4FB28346E01C5A671DC1BB781685E52720068DB0D4DBF1F6A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943721, "uuid": "057b109f-b0ef-4e7c-be53-3e78bdb55029", "value": "192:LbVX8Tybk67pJO03lk717OeAaM9MAOhLJlLm3BVsA0Eo:/Z+yb/pc01k71z7YMAOh+ndo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675943721, "uuid": "8f4fa7ff-5b31-4063-84ab-068a44650da1", "value": 8557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675943721, "uuid": "40600c26-8ee9-425d-9890-57f70970231e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943721, "uuid": "e9509bd2-7dbf-4651-8313-bf5f0c5f5b1e", "value": "2c1baada98fcf4067fe27afea6bd2d79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513bb8bc-a84e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675928984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928984, "uuid": "07b4d333-c6c7-491d-8356-e996db8e8c5b", "comment": "Malware payload", "value": "d7f700eb8d77a5f1e64288c16ffbdaeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928984, "uuid": "c469042f-93db-41a6-8372-217d55bab0f9", "comment": "Malware payload", "value": "963d177ea2dc9ca09171286cf39e331dc6807190ffbe000866c7fa59ddda656d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928984, "uuid": "6d9d8614-32ce-412c-9d55-48da44bdd11b", "comment": "Malware payload", "value": "c0d4559890cb0393f929289312813aa6e13739a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928984, "uuid": "102f03af-fb0f-48d5-9d7c-bc61717a08b3", "comment": "Malware payload", "value": "1e479cc3f2ec1c8b2bb0e0436bf6dea24b5dcd926ccc49060b40e872b5f3302b7ec9a7440d839369732c1cc488534e39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928984, "uuid": "8505c449-8391-41a6-9743-89f35866efc8", "value": "T184D401A4FA14E80BD65A0F380D95D1685960BE403D54C963B7E27FAF7F3A2C3B915087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928984, "uuid": "2fe74203-701a-4634-97ca-2b5c4698a2f5", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928984, "uuid": "c6892f07-2252-40d2-ad1b-181763853ee5", "value": "12288:bbif/mHZzu6uhuQgRN6Zuj90Z2upnDotvOc5yJmMLIaVJilhtBl:vif/mHZzutuQgHt90TnDotv/yJVXVC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675928984, "uuid": "e5bd6a93-3bc6-44e7-bb26-10e0e2454f39", "value": 637104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675928984, "uuid": "39d47d93-24d4-440f-b42f-9024a40e098f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928984, "uuid": "2014edab-f24e-47b9-a389-87975b2152b3", "value": "36730010004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5bb17c-a8aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675968432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968432, "uuid": "8fab4f73-3323-46db-93f7-7c8d232e955f", "comment": "Malware payload (Amadey)", "value": "5d7a8a8960727f5b3153f007389eedca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968432, "uuid": "819edc90-d859-4e28-ac60-6d5663c33f0b", "comment": "Malware payload (Amadey)", "value": "9687c2350979bbd0b41b409caf1456aedde868e8f04ed6c0f090888e68f03618", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968432, "uuid": "08de26d4-825f-4978-b4a4-79c6d0f662ed", "comment": "Malware payload (Amadey)", "value": "ef957b01788b09034f2adecef11e3ed25adabd56", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968432, "uuid": "a912f1f8-2f65-420c-a1ae-04ba7d4b6361", "comment": "Malware payload (Amadey)", "value": "77f46562bfef35467fed21f525d26d38132910ceb301772c0856e37314ec07427db036a7994f7ca338d23be7288d4949", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968432, "uuid": "edeb6970-c0c5-4356-a93c-a0c09bf8dc09", "value": "T15AB4020BF7EC4066E97867701CF702D316327EA29A74829B264FAD1D19B21E0B935377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968432, "uuid": "53456ed9-bbe2-4cbc-b37b-6c5e16965eb8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968432, "uuid": "05e4c8a1-4447-4ab7-8940-6c8688b0fe55", "value": "6144:Kfy+bnr+zp0yN90QEtxc0bBQPU6ATQF4m747+Wa3CcSFXaxXnTF7z9fvxZI2MA0d:ZMrTy9077wg2z7zx+aZTLfvxZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675968432, "uuid": "9385fba7-276f-489b-b532-f9aca97683fb", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675968432, "uuid": "1d6827a4-3d0d-450c-bff1-abe720b3381c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968432, "uuid": "b8b6b27b-e321-47b4-8f03-ccaf1469b609", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0252f191-a846-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675925415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925415, "uuid": "f122e25a-b066-41ad-9bbd-279984c26d34", "comment": "Malware payload (Tofsee)", "value": "89978a544235221c324affda86ea60cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925415, "uuid": "fe29203c-a00c-4b3d-bb2f-45fa1abaccce", "comment": "Malware payload (Tofsee)", "value": "96cb55136b342be12e96117a3a0a4c85a76a975ca215709fb4b28107c904a891", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925415, "uuid": "8097b433-9658-46a4-aa43-7bf2907f5b8b", "comment": "Malware payload (Tofsee)", "value": "2c95f2f0af6af8f4f0e988b2e51979f7915b803c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925415, "uuid": "53752000-199e-4fd5-8503-bfedc6621b69", "comment": "Malware payload (Tofsee)", "value": "6d8c63ab67265cec3e738ac1ab06d088f933a4c3ae90ea4ee4912c53c1afa77639090345b81c951d6e2106c02e20f893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925415, "uuid": "4714b32c-f1ba-4869-a54f-e9568dd8736c", "value": "T13514D13235A0C071CC6B24309860DAA56FFEB83146B8895777981BAEDF712E17B37257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925415, "uuid": "9844dbb8-d1c7-4056-bd40-e20761e88724", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925415, "uuid": "28b0b904-1f84-4481-8f40-df38b1a3e786", "value": "3072:hjqgOnQwKsoP1LaKxWud5ddCYHvTQdU20FfFqMCplR5:dqgaOdLbxhpvwyFdJCpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675925415, "uuid": "b03d49ea-0206-4a15-9ce5-2ceafa169e7e", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675925415, "uuid": "e7974561-bcb7-4923-bed7-12026f1cec7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925415, "uuid": "db4f766c-38f5-4e29-90aa-fc5701b0baf2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21426135-a878-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675946942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946942, "uuid": "4b6fe53f-0a6c-445f-afd5-e076b61f62bc", "comment": "Malware payload (RemcosRAT)", "value": "c2697227ce31b6bbf47a99688d4d1c4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946942, "uuid": "244ef83c-9466-45b5-8bac-b75f11ae7c46", "comment": "Malware payload (RemcosRAT)", "value": "96cc5db4e39930207bf9c0c379f7d612e01895bba8f5557a93dc215ec1063263", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946942, "uuid": "4dd5c031-a8b2-49fe-b6a0-45f6c8abb73a", "comment": "Malware payload (RemcosRAT)", "value": "8f6d75c69776e0e7c8ede6e8e4b52285a915a392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946942, "uuid": "6d4a2c96-47f0-4c4b-8b85-ece891992be6", "comment": "Malware payload (RemcosRAT)", "value": "4017a5e357a2e98a1d363df93ef2adf8d9b776c4641df468ba756869fcd817fb1870cb4fc975a411650fc2162b4f5ac3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946942, "uuid": "fd7a69be-0967-4fa3-9248-f67a064295e7", "value": "T13335F15B2EC66BA5C4D68E70E3B915D913F0865B1421E7E22CC602F8CF8678F67125B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946942, "uuid": "75f27ef4-9212-4b3e-b567-33d05262a8df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946942, "uuid": "0ab01280-f4d6-4c38-9640-541ed571d79c", "value": "24576:+q/ZM4+TJlLmq663Sni7wn+zQ7167Q0Gch56Fm:STc6iniUn+87B0Bv6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675946942, "uuid": "f5da54b7-e519-4967-8558-ef620e4a7db3", "value": 1135616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675946942, "uuid": "53f2ecee-c22c-4263-8e3f-a7e7a9daa943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946942, "uuid": "6cf872c8-fa45-4454-a3c9-98ddfcc40003", "value": "Order Ref PO-NZL_25100137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265952f8-a86e-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675942656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942656, "uuid": "e8572f0e-82fa-4151-b2de-e9e6f681c393", "comment": "Malware payload (SnakeKeylogger)", "value": "63105821dee03d72fe243acebf51ad1a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942656, "uuid": "14c73a80-f674-46c8-95c2-c7d79aa06019", "comment": "Malware payload (SnakeKeylogger)", "value": "96cce33cca8b3a0296c28f1e228821fe65afa896d1b22cbabefa5839de68e0e5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942656, "uuid": "7a326700-f88b-4c2f-ad0b-e73bb4b99e94", "comment": "Malware payload (SnakeKeylogger)", "value": "d5abf2c7398dec63c27d7b119ed88bc2e3941308", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942656, "uuid": "7f43716a-d39b-4bf8-9445-a8806469a1ca", "comment": "Malware payload (SnakeKeylogger)", "value": "968232111ba6dffa85ab13a94506542ca5230338e9e80012458628f68dae4fbd1d511507a70963911a5ed18ba6b79583", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942656, "uuid": "54ebcd67-9449-44ae-984e-d0ae71b10899", "value": "T1D5137E5AE78F02A5CF8112B7131B0A889ABDB73EB350557134AC937433EDC2D46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942656, "uuid": "071c058b-1ab1-4408-a920-5497e85f282c", "value": "768:HFx0XaIsnPRIa4fwJM8sT95m+EvfuDGhryPbMkuNTw2vBZ:Hf0Xvx3EM8sTLm39c160kZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675942656, "uuid": "4bf8dc33-1794-41f2-b109-66f8c5715f58", "value": 42711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675942656, "uuid": "80f84cf9-f187-4cd3-b723-54ef064d8160", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942656, "uuid": "6e9c8fad-be5d-46eb-9cfa-1a55c388addc", "value": "specification.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03b651a-a870-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675943746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943746, "uuid": "fdb687e0-00f4-4940-979a-10c4922bfe6a", "comment": "Malware payload (Mirai)", "value": "449200bffa03489a06feaa4f0b8741e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943746, "uuid": "5a574a3a-c3ee-4773-a634-7d4b21f974ee", "comment": "Malware payload (Mirai)", "value": "97325805396c86588dec402c7d57c9a7f3bf3e6ec23e8964f971af930dc921fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943746, "uuid": "f4ca87cf-7804-48c4-befb-8e131d87bedd", "comment": "Malware payload (Mirai)", "value": "614afc627972c6049ca830749fdba5b8b4eb91e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943746, "uuid": "8d7c5d15-2b31-41ef-84b6-5d121ad53c9f", "comment": "Malware payload (Mirai)", "value": "d832102644545bea85a85eafa80b9daa9c9ff6caab66529d8f3de5297efbfc8cff1d57efc653cc3bb28fcbf5fb8290af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943746, "uuid": "2b8a03cf-2be1-4926-b9aa-03e6f62859a7", "value": "T1B1F33B46FA514A13C4D51BBA79AB418433139766E3EB3302AD145FB43F87B9E0E33A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943746, "uuid": "6ccd70b6-b0e8-4064-96e2-a7259aa9e064", "value": "3072:fu5LXCvIk3G6oMbIc78PXexWKpoGM/9EIQDx:m5LXwIk26oMbIcAPIWKpLM/9Rg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675943746, "uuid": "d9f22fce-d38f-47cd-bf0a-be84a4ab6df8", "value": 157949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675943746, "uuid": "514a3dc4-6b49-45a9-86f6-ca51c84dc2af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943746, "uuid": "d08808dc-1d76-4732-9b3b-c2a99cc88ded", "value": "449200bffa03489a06feaa4f0b8741e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a1f2ac-a84e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675928988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928988, "uuid": "04857207-1c8c-4d98-a7e6-ba5867c1cbef", "comment": "Malware payload (Formbook)", "value": "fba958eb2dcf6e4b72c1ce56bcabd1f5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928988, "uuid": "b5113d9d-20ff-4dab-8484-e9bfe898e754", "comment": "Malware payload (Formbook)", "value": "98b778be9d7ced2bfadcd22d20cee573933da0cef9625e7f10ca5c06ac47df35", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928988, "uuid": "61beb9ca-2d18-4d42-b3d5-1c7b686a92b1", "comment": "Malware payload (Formbook)", "value": "e93970ef57f7a0b9cca9390ce049bebc6764f802", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928988, "uuid": "5d96565e-7635-4f0e-94e7-77306eeed85b", "comment": "Malware payload (Formbook)", "value": "eb3ad6c4ef50d4ba66311ddc84e27626b3fba4ac3d8c0f4cd1534221f97d39fc80300ae847b8931de48c4f949755f655", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928988, "uuid": "6e5905fd-d2dd-4877-8093-2f9739e5277c", "value": "T1CC74CEF4D66335601E4F59DA809D2BD98DF257D31001148D0AB3B6CA0932FBE8EBA5CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928988, "uuid": "af6f8cc9-5bb3-41c9-aa65-1dc770e60275", "value": "6144:sO6xdqAjUi+BJGpTzuQBSAfY/VRFoDplulgT7UXtccjs6sWKFX35+:sldqyN4Gp6AfebFoDplo3X2cIJ1p+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675928988, "uuid": "7517b8d9-2c87-4086-aa6c-08efc58287ff", "value": 339684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675928988, "uuid": "9a55e60c-e119-40d5-ae86-e9ff8cb75ff2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928988, "uuid": "3db84e8f-f8b8-4a17-b84b-621fbfa09095", "value": "cnf13429226.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6774e7-a82e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675915529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915529, "uuid": "1315450c-70cf-421f-a1a1-3877ab09174e", "comment": "Malware payload (Amadey)", "value": "679c18d7d8a24c4be479e2541358e709", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915529, "uuid": "97de9f11-c85b-425c-b10f-9c0cd5014c9a", "comment": "Malware payload (Amadey)", "value": "991356da65c02e329bf2fc95716693f016305b0e059eeab43c1089fb1036b482", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915529, "uuid": "501e58a3-4d2f-4450-8af6-096209a72dcc", "comment": "Malware payload (Amadey)", "value": "e906ddbe9c2e548b1ea09ea44ecec1befe2a86a8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675915529, "uuid": "5c258df4-5f60-4174-8c0b-d0837586a8bb", "comment": "Malware payload (Amadey)", "value": "60de585e29f13074d4cc0f0e05aca0408d27b85d5815744bd1854a22496c5b2c6b18c9d3d36fdda0d9734251627e6e93", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915529, "uuid": "58e31883-1cc2-41b9-a32f-4b97fbc15866", "value": "T1CA54E03379A0D072CC6B96359820EA947F7EA5310971994B7B580B6EDF302D17B3A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915529, "uuid": "a4667cf3-61b8-48b7-bc1d-615760d6364b", "value": "5b3e1365fd24e4232cba105b88665e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915529, "uuid": "7e10b573-790c-43f3-a831-fd20ace37e79", "value": "6144:vPy+4hfLd1fjt6S8IVneznhAct5a+T4FnAE:vPybf51fjUhzt/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675915529, "uuid": "200c4440-a58b-4d66-ae47-258480ef3a57", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675915529, "uuid": "3dbc5c6e-1bdb-4784-894c-22a70d568481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675915529, "uuid": "825b5e6b-cc19-4341-b208-1d6461cfd3d0", "value": "679c18d7d8a24c4be479e2541358e709.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dace6219-a8b8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675974741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675974741, "uuid": "f09cf3c9-fb32-47d0-90f0-f56aa1ca14bd", "comment": "Malware payload", "value": "f2f874379579a71ac3b454118465ccfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675974741, "uuid": "8b679104-4290-4375-9a61-f8642a5b6707", "comment": "Malware payload", "value": "995eb63354d330bc029dd5a81c886efc0743cd8cceffa47cdc0d4e8cef1edcf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675974741, "uuid": "8ad7776b-d2db-4697-b932-cd902b9ece82", "comment": "Malware payload", "value": "714941bfedb1b91c1d96e4cb71dc3d76faf6f5bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675974741, "uuid": "3518d6e7-fea4-4a5f-b5f4-dbccbfe84e3e", "comment": "Malware payload", "value": "473eb4dcad951b55d207dbe3fc134698bdff9f44cdb33b916d8aaa25b404998064c86d87cca3b985e1108b8cac496fd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675974741, "uuid": "2e63b6e1-d2d0-4d21-8d62-19cb6ab6ba27", "value": "T11D64F113F3E1D432C532A23199E8C6B1676EB5205B3C69A77718266FAFB02D0977234D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675974741, "uuid": "6b5dcd3a-d515-44ec-81e6-fe941656108b", "value": "3ae714bb16df7ea6110fd4db3c856d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675974741, "uuid": "04e42418-8e63-441a-8f7c-3574ccc8ff04", "value": "6144:/toW4yRiHLSz4XhKc7zc28HBWEW3RgR2/K+FUyovZJpW:/tox0i+z4XhN7YhWEWBgR2/K++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675974741, "uuid": "f68bffbe-4eff-4cc8-a3bc-7771e4b5fc18", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675974741, "uuid": "2e4a3965-c229-4b92-a315-6f441fc62e94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675974741, "uuid": "eb39be09-ef14-46a0-9b29-0903e2ce7e3d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f688d088-a871-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675944293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944293, "uuid": "62e7507e-aa39-4f5b-8180-7ff189260cf8", "comment": "Malware payload (Loki)", "value": "d47ece8de27c1186ec43378513b38fb4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944293, "uuid": "045f15a1-0f55-480d-8ae5-2b550d1f9a6f", "comment": "Malware payload (Loki)", "value": "9973b2cda556b31ef4fe10ee234c910bc4ea1ca6af8631dbc0c4f425a4e0c5da", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944293, "uuid": "d814c551-e984-4675-92d0-787556c13ae1", "comment": "Malware payload (Loki)", "value": "656268668230c5015cc9053b4a9eecb30e1cca6b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944293, "uuid": "d20abb7e-9bc3-4439-85cc-5c9e225d8045", "comment": "Malware payload (Loki)", "value": "4e40cb1747b25943948d95ec14d309e420e1a29a6cc3b2a9d82114bd42d01681e4e9ebcf066a5a62a97dd4fd780e8a48", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944293, "uuid": "b771c127-f5c5-4aa4-bafa-eb46556f4ecc", "value": "T1913412F5F470DB677A20604AF324A189F7CDEB2CC96598D6585EBA09F462716CCCC08B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944293, "uuid": "ca43c429-037a-4515-b9b8-13dfd275ae7d", "value": "6144:ivHGKPFiyk+JJRiuzIP8/8we7faPRzWJ8AZuP:ieKoufRiu3/825Ac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675944293, "uuid": "cdde2773-95b8-49c3-abc7-b8097430a0d1", "value": 232301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675944293, "uuid": "073af1d4-3ee2-4aee-b300-4abb0e719367", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944293, "uuid": "db83ea53-305a-492f-8450-3e8d68473caa", "value": "HSBC Advise_pdf.xz.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f45a4f-a8c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675980429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980429, "uuid": "62a83106-1af3-4ab2-9250-8f0b649b3c3e", "comment": "Malware payload", "value": "54ca404d16db18d233c606b48c73d66f", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "H0lyGhost", "colour": "#598683", "exportable": true, "hide_tag": false }, { "name": "NorthKorea", "colour": "#FF52F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980429, "uuid": "3660b195-6847-4f2f-82c8-336b8f24d242", "comment": "Malware payload", "value": "99fc54786a72f32fd44c7391c2171ca31e72ca52725c68e2dde94d04c286fccd", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "H0lyGhost", "colour": "#598683", "exportable": true, "hide_tag": false }, { "name": "NorthKorea", "colour": "#FF52F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980429, "uuid": "83c2847c-a5da-4c1d-8e02-e15ecdd48897", "comment": "Malware payload", "value": "d7d472bfc62bd6f52e3b4b3c7e88b92b664dd142", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "H0lyGhost", "colour": "#598683", "exportable": true, "hide_tag": false }, { "name": "NorthKorea", "colour": "#FF52F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980429, "uuid": "16c9a6fb-ebb6-44a5-b374-7c34b1719b01", "comment": "Malware payload", "value": "ae402b758920cb39e5c024c0752ae284e3b39b2c17ac54c47620454f1e6c6f4da540ef882d574ae529d72d7803806540", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "H0lyGhost", "colour": "#598683", "exportable": true, "hide_tag": false }, { "name": "NorthKorea", "colour": "#FF52F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980429, "uuid": "591257a4-dc54-4238-9aef-520a08a59db8", "value": "T1D465BE22FB40D132F6A10072DA2D9F6B995CAE31673444D3B3D44E1E6AB48E35E36B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980429, "uuid": "5c492483-c904-4b79-a5fa-b0035771b583", "value": "e35d8b44296d67eb10cc5ca04f16565a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980429, "uuid": "47d82ba5-a46b-4d1e-8656-9c7b48de07e6", "value": "24576:RtpRWh9e6yT5p0qMBNEYhw+fEh9vnwR76aNGu:Rch9JqMBNZNMh962c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675980429, "uuid": "cdf15354-5320-4579-b225-b56189832577", "value": 1435136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675980429, "uuid": "89df5fa2-9757-437d-940e-61fb4469ec3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980429, "uuid": "2274d5c7-8279-4ad9-bdcc-41f7b313ba63", "value": "99fc54786a72f32fd44c7391c2171ca31e72ca52725c68e2dde94d04c286fccd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a403ee-a8d5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675987156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675987156, "uuid": "992427a5-1d89-4047-b43e-346f00643a08", "comment": "Malware payload", "value": "d7c12373e58eadd9bbef1df42bae9b23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675987156, "uuid": "ff6a5a92-05d5-414f-935e-5c3855ff1cae", "comment": "Malware payload", "value": "9b5350234f04b1d1c610304ef8f253b371990007b9f8c4e6adac49e6c9c7b678", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675987156, "uuid": "a389d68c-709e-4e30-b2f7-935dbdc62dcd", "comment": "Malware payload", "value": "60ce3768990c6995e29bf5a7345c5e09f83961e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675987156, "uuid": "3c768a7f-65a6-4543-bba1-a6612b545857", "comment": "Malware payload", "value": "def73e89ece58bf4be85c0ddaa8812083dfc53fa7eb552ab9e2fe5211e8a82a926488c7d4201d1285844caefa005dd3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675987156, "uuid": "70a33a50-3558-4855-b5e6-fa5115aef4a1", "value": "T17705F16C2CB49204D1BCC2FE8AA36634E7BF7E93B499E6190D82B1C91C35BD35058D5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675987156, "uuid": "8ef21488-deaf-44ab-8fa5-eaf165fce59a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675987156, "uuid": "81d2f79e-0523-484a-b47a-2f5d78997e0e", "value": "24576:mHCtn9BoO/NTSQlQXD5lbYQqTj3gmrNMsf/uM4RHHT:NjK1lbXqQmjGM8HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675987156, "uuid": "2bf7588e-acfe-4d97-9401-55cd5a34bee5", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675987156, "uuid": "f533c314-dbe1-4647-82bb-014660b7aa02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675987156, "uuid": "4dccb704-67c0-40bb-aeb5-17bff9394631", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa0dad2-a8bb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675976003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976003, "uuid": "19b7c25f-8351-4af6-8b35-f38c3ea8c2d0", "comment": "Malware payload", "value": "60e3976c78d52c8b4fab3ad661fe6701", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976003, "uuid": "028cf97e-1def-48e1-bd25-c8d79e162437", "comment": "Malware payload", "value": "9bedafc700ece5b34479b060c0859f2129d3a92748b2d1ddcd4e175ade27ada0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976003, "uuid": "9493a3f6-7c9f-406f-8fe3-f9bb2b33a1dc", "comment": "Malware payload", "value": "897715a947f9b085fd8715d2bc8fc3cb1a19b5e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976003, "uuid": "6b10c06c-97ba-432d-ab55-d555494be7c7", "comment": "Malware payload", "value": "70e37ac3cbff5399f8a4bf8e373791895d50a7a473dbc3008be67fff4e0b0f7f534bf88dcc002a3c6d1165816b0e9144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976003, "uuid": "efbe6c0b-f654-42d3-8546-9f9c825c38af", "value": "T187B4021BA6EC4132D8B017705CF607C71A39BC509A3887AB264EED995CB2670A73477F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976003, "uuid": "b8ec35f3-dc35-4103-b788-8d88807e8195", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976003, "uuid": "a418d470-1ce4-4392-9c13-f9372a0b7f8d", "value": "12288:IMrMy90IE27IQg4IacDRMkiz6DxYxEvWlv4fB0xV9JloY:0y5hg4IacDriUxYrEYloY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675976003, "uuid": "f422d087-945c-423c-8e8e-d24afe55eda3", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675976003, "uuid": "554a3261-a2ac-4925-b665-33f81e1acf65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976003, "uuid": "9b4426c5-e69a-4875-b333-e606a03ae493", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6416e61d-a8a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675964234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964234, "uuid": "05f94fba-b220-4fbf-a127-f79620fd045e", "comment": "Malware payload (Amadey)", "value": "593a5b3c1af2e07a4e89e1fac1c66e2b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964234, "uuid": "b2055675-719e-466d-b88d-a9f805b2b613", "comment": "Malware payload (Amadey)", "value": "9c6337a7dbae16861420cf78076fb63737ea77d9302767c8122bc15b40b18059", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964234, "uuid": "d5afc708-51ac-4705-a716-1cefbcf1d8ed", "comment": "Malware payload (Amadey)", "value": "f59ef2ecd7ddf1d96122f92d0a734c3e62e2d4ec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675964234, "uuid": "78e1e9b8-ee22-42bb-adfb-501c82ca78d9", "comment": "Malware payload (Amadey)", "value": "2caaa8559be5f5952bd07f420376e4e6fab68c3979037c86db5f5c2fc46112d0761586482fef3d6259956e64abcaf26e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964234, "uuid": "2d10cf87-5a82-4f85-a689-e9e2f7536b61", "value": "T1BFB4025BF7E88132E8B127B018F747C31A397D74A6B443AB274B294A09771B0A13577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964234, "uuid": "71ee79ce-5937-4a0a-9b2d-ba0e45c24639", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964234, "uuid": "19ff41e2-39e3-431a-9735-edb17ffe7ba7", "value": "12288:sMrly90RXDIA8kfjRwLBnrCNNJHXh4/Lnqf4B:pyWnfSlrCBHxcLC4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675964234, "uuid": "6b820422-6872-4d68-9ebf-a174f6ae5621", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675964234, "uuid": "07e8243e-53a2-445c-a099-710ab658cc90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675964234, "uuid": "096cdf4c-b359-41f7-9fdc-5c190d6555e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6fd7d8-a8c4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675979871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675979871, "uuid": "10b314a6-31de-4a91-92bb-a4e51c0cbecc", "comment": "Malware payload", "value": "5b0f4efc5f1c3d06e9ada5112b872103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675979871, "uuid": "fdca4c0d-c5a6-4a87-83a1-f1d2d05d3043", "comment": "Malware payload", "value": "9c682ea92d3595f703099116f400adbe1bc7c08a8cbd003ccf7df3b14d000bf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675979871, "uuid": "37be0e61-6d9b-4e53-ae7d-6fdd217c3b96", "comment": "Malware payload", "value": "36b6c4e28e59621948a9a2da5a8968af93f4248f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675979871, "uuid": "a15776b0-62cc-46e9-b322-99f3573c9bb4", "comment": "Malware payload", "value": "18305089fd09b78800c347c8f8b2545e23a14597df37c218dc56301fb237d197d417349b0f9bd9f105619bf464eca674", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675979871, "uuid": "52b95f8f-8c45-42e8-a4f1-8ac41accffe6", "value": "T14BB4010BE7E84532E8B4277019F602C71A36BD914B78879B279E6C4D5D736B0B23136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675979871, "uuid": "fc1da87b-e21e-491b-97c3-9845ec82b99e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675979871, "uuid": "337002ff-2f0b-426f-9d26-8364fe16accf", "value": "12288:9MrYy90NHHjJY265Wcbiz6DLYFEvWrvH5vGcT9:NywtY265LbiULYNf5Bh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675979871, "uuid": "e68ca545-5fe8-43a2-9476-fcf14f6a1973", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675979871, "uuid": "880860b1-bbe1-4ba5-bf66-c3e564b45c67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675979871, "uuid": "3390de31-2381-4b47-b3a8-102b6b9db5d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0052f616-a8bd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675976522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976522, "uuid": "4a4b8538-d0bb-45db-afca-fd770c649439", "comment": "Malware payload", "value": "1cae7fec940733c5cab1f785a04bd110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976522, "uuid": "47674c79-c2a8-4666-bebd-3da39a193157", "comment": "Malware payload", "value": "9ca8067633447f916b7086c931aa81cc8c0226e2a6a71e8ac0732be97e08f3f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976522, "uuid": "d8f889cc-fa91-4c1d-bf9c-f5e233c659cb", "comment": "Malware payload", "value": "fdfec3ccf55bd1f049ee7523d7b2eb54e2d3a920", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976522, "uuid": "81784ba1-5218-419e-ba51-efc4df05ac49", "comment": "Malware payload", "value": "67afb5c9c63bb38725ab7733b9754a6a033e95f4de6e87380eaa4ea4a2189872c0c2d6b5f398a012d825542faba88088", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976522, "uuid": "f73a8251-238a-46b8-862d-4f994f15432d", "value": "T13EB4020BA6E84532E47467B018F712D30A367EA05A38835B2B4FAC595CB25F0B77477B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976522, "uuid": "43465a95-581f-4a56-8e5b-7c284c04862d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976522, "uuid": "cc7eb75e-b574-448e-a8b5-61351da16b9c", "value": "12288:0Mrey90xNWcjRONJToi7Jgiz6D7YpEvWOvO8bD6OOF25eyJ:6yINWcjMnkziU7YMG8bt42sG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675976522, "uuid": "24a14bd3-8417-4386-bc99-9918000b5e2d", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675976522, "uuid": "b1b88b1e-5d59-4b22-bb35-bc36343457ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976522, "uuid": "ad27f540-c40c-4ddd-b141-aa0017788fee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1185847a-a88a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675954647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954647, "uuid": "4e02a23f-484e-4ff1-ac67-9ba50aa307c8", "comment": "Malware payload (Amadey)", "value": "05d6eead50762e19e931255fa27c4f2b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954647, "uuid": "2707a430-2bf4-45bf-9f5e-f525072ef237", "comment": "Malware payload (Amadey)", "value": "9ccbeb9a6248a426ca4b0e23ba99e0da817a208f89fd1042ebb783df292750db", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954647, "uuid": "67c847f9-4dde-49a6-a7eb-a0be42694cdd", "comment": "Malware payload (Amadey)", "value": "ef55689dd5a4194b1405f38a2ee4de70cc277bb8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954647, "uuid": "d5e6c702-d5aa-48d1-b761-82940200417a", "comment": "Malware payload (Amadey)", "value": "697ef2e00cd894d60d35d40828f09cebee094b242a005caa2e323c1e6eb82b9f9082e2c348c5d167cf9780f43ea22e84", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954647, "uuid": "dd318e07-1fd9-4f4a-a702-994058fde3ee", "value": "T1C8B4020BE7EC40B2E9B517B01DF606D30A3A3D505B38435B278FAC5D58B2664B931B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954647, "uuid": "de89b862-0314-45d4-bf8e-e64d5b0e0753", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954647, "uuid": "e6f89ac9-d6e4-49f1-99ef-7ef344564fcf", "value": "12288:MMrmy90WpXD2lynULiAvs6Hsjaw2WYUOqRwTdBPt4GT:6yRKlyJAvtMjLwHqRwBBP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675954647, "uuid": "070f03f5-cb16-4c3b-9624-25dcaa3e18a4", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675954647, "uuid": "c2b7077b-9725-4aff-b7e0-35376c990f6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954647, "uuid": "bc566fae-44b2-41db-bce7-f03c3d2ea516", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3368ee-a866-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675939523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939523, "uuid": "f7633656-2e2b-40a1-aee7-42a536728ba5", "comment": "Malware payload (DCRat)", "value": "33ba2f9311210174d62fd336cd289d3c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939523, "uuid": "2b96769b-ea1f-4fae-9d00-8b7e2609b588", "comment": "Malware payload (DCRat)", "value": "9d0110e715676cc9c012409e85bc2a7a88c3a851666795a52681cecd8d8ebe24", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939523, "uuid": "dbf1bf8f-72fd-4a47-bacb-ebe8f2acfa94", "comment": "Malware payload (DCRat)", "value": "cf225c9b2d3fc87a8dcda9b6d114b8e64c846492", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675939523, "uuid": "427dc36e-9af3-475e-a88b-87ac818c266f", "comment": "Malware payload (DCRat)", "value": "cb4111ca3d476e9e882129766ea8ec365397342cb7125fc2f05f8a3e91ec981720fabfb5b1bf03e91d18c9cd610a7fb9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939523, "uuid": "3bc1ba84-ebb5-445e-a990-cf51bf86fc7c", "value": "T1D7454A027E45CA52F0181633C2EF850847B4AD612AA6E71B7FB93B7E55123937C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939523, "uuid": "cf6bdcc3-a1e8-4257-a2a1-3d9e06b04b64", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939523, "uuid": "5387cab7-f480-4486-bb6b-f02c2520c57b", "value": "12288:URZ+IoG/n9IQxW3OBseUUT+tcYb4pSYMJkIG5Pr7ILgduyUJIIlB4xuzzlHjGXd:u2G/nvxW3WieCLY7IG5XILgrIlzFjcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675939523, "uuid": "ff7eb739-4ab3-44bf-8a7f-b2a1fcad0fce", "value": 1165415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675939523, "uuid": "c6f067ca-c6dc-43fe-976c-544cf2a97747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675939523, "uuid": "53d00ce9-b2be-4217-a405-84caf4eb69e5", "value": "33ba2f9311210174d62fd336cd289d3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b03911-a839-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675919943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919943, "uuid": "c359c5f6-34af-4061-b8ae-99cd249519b5", "comment": "Malware payload (Smoke Loader)", "value": "6c5dc113ad86665424fb86598473d508", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919943, "uuid": "76d86cac-cd46-44f5-b844-29dbfedf7d93", "comment": "Malware payload (Smoke Loader)", "value": "9d24a97b354fdfbd6e3042bd5c5b7f81c3257fb0876d6909ba58c15dab56cf72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919943, "uuid": "28362a0f-4ace-4940-aa05-de1746e87821", "comment": "Malware payload (Smoke Loader)", "value": "37a3ffcc6ee3576d2d4a20a4bb50dc583f8037ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919943, "uuid": "77825cce-9db6-42c4-9c7a-2fb20287b9f3", "comment": "Malware payload (Smoke Loader)", "value": "596ba03ce4bcd29ff1106da4cf1d53184f0bee31f8dd9c1baffde5d015bb556e56b988cace3c48bf22252e258e8ec011", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919943, "uuid": "09e4c22f-18b0-40fc-8501-2e6fe296a166", "value": "T1DA64190393E17C80EB2A8AF2DF1EE2E8765DF5508F4AB77912189B1F35B1172D563A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919943, "uuid": "db1ef60d-6aff-458b-96af-258f6343ab96", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919943, "uuid": "13ebacc8-6c26-4ad3-bc1d-76ef9863e645", "value": "3072:6PEUvCQSPRdRPqo3RqXlesaZWc0H8NGNBesCQENe+pGSw03PZz3:6MU5E5qoBqXlQHNGNBeVQkeQGSwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675919943, "uuid": "d8832138-aa4e-43eb-81f1-59d0f04a66ca", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675919943, "uuid": "0f1375ad-3a5a-4046-a611-b70ad20515f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919943, "uuid": "11dcc9f7-34be-4dd5-98dd-5e29296bb938", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890104f1-a850-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetWire)", "timestamp": 1675929936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929936, "uuid": "5215caee-014a-4ca3-81cd-38fd144a7401", "comment": "Malware payload (NetWire)", "value": "8359e25b8dd8545649e05ab3886329a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929936, "uuid": "3ef6c98c-cb7b-488e-9d80-6e611a1ce114", "comment": "Malware payload (NetWire)", "value": "9d2977e8e247515a58c1a05c3111a05ed3832c9f01e5df39c1ff5717531f421d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929936, "uuid": "33e14860-c5c5-4508-b371-781080333f41", "comment": "Malware payload (NetWire)", "value": "2a2ce1a9ac8b3670838f0c1880a768d4f862cbab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929936, "uuid": "91d322f3-10af-4954-b9fd-1106de15109e", "comment": "Malware payload (NetWire)", "value": "5af10a08a2bb5cbecac11a00cec25fad847416dc8e0707fbdb59f252ac5a6d4bf731325c2bf226a6a6e36948fe9f19ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929936, "uuid": "ccbb51a4-2929-4c6c-b925-3abbd4f90b9f", "value": "T134E4126639F89E0AE2FD47BE1CE0020643FAA582B093FB190F4874E52F79BC14567957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929936, "uuid": "baa04ea6-fa74-49f9-a62d-3bf5a95dbe74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929936, "uuid": "b958adea-03eb-42ce-911e-f54d30ee309c", "value": "12288:v/o8ZROaaCOUQPM0kMDMhOvsWRUj9XK2KHmFZcn5Efr5QQlQX:v1Oa3Ot+MDMhnWRUjBdW5YiQlQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929936, "uuid": "c89d42b1-f964-476a-bbe7-5e13b8e6c114", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929936, "uuid": "863d98f6-9aea-4a8e-aff7-cd881e59f64c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929936, "uuid": "6602b0bc-456e-402a-a4fd-e6aed671834a", "value": "Proof of Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b555167d-a834-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675917985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675917985, "uuid": "50d5da52-1c50-4b56-9367-5c024d3d8ac2", "comment": "Malware payload (Amadey)", "value": "4c3ece3ef4c6174a815b6dac3e4182bf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675917985, "uuid": "14b7a9c1-d6d8-4681-ae5f-cdb96f04f20e", "comment": "Malware payload (Amadey)", "value": "9d537fafeacaa8775b1bf93addbd4e2bf5ca9b704bd3595a46ed79008a12a72e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675917985, "uuid": "1f2b408f-009b-4235-8e2b-a64417c55851", "comment": "Malware payload (Amadey)", "value": "6a7572a719670917f16426f58806b141ec81ab2c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675917985, "uuid": "a58db84a-0a86-4439-88b4-da91927938d3", "comment": "Malware payload (Amadey)", "value": "be5d861ec85be1a44808eaf5d247bd8c800a70fa6131149caaec4dce8d4ccd8b5850e0402294245c63d8148f80e9328b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675917985, "uuid": "322c2d19-af31-478f-bac5-f1451542d1a1", "value": "T19CC41247B7E88122ECB197705CFA02C31A367D615F3983AB57462C592DB26B0A63136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675917985, "uuid": "8cd71bb5-c25d-47a7-a393-e85be66e8234", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675917985, "uuid": "a49d3fad-1f61-4cb0-918c-ebcd941a49bb", "value": "12288:iMrpy90GwSmbCqhQlUnLqhtLH6iIDGCRDuMR0HV5dyQpEeN:jyQScCqhQxH6eS4HVuQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675917985, "uuid": "1d79f822-e9bf-4ba0-b2f9-9c6ac740121f", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675917985, "uuid": "6ddd5742-8d83-4f9d-88b7-ecc7048aa8d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675917985, "uuid": "51ab16dc-f608-4507-b46d-43ef44f2ede7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdd7843-a8b4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675972918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972918, "uuid": "b0d5a5fb-9b8a-43b4-9b5e-9d16a2480ee8", "comment": "Malware payload", "value": "edf37cf077d45af8423585c739b0e9f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972918, "uuid": "9673610e-f50f-435a-8058-7e52d42a8a31", "comment": "Malware payload", "value": "9d72868b829977bb64dbea69bd088faeb7b42a676d00c1763994456bda17b581", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972918, "uuid": "8c7a0fa7-a525-4866-9fb9-716419a865da", "comment": "Malware payload", "value": "6147f39c0772dc631ec8a0418646e5014358f233", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972918, "uuid": "c44efad0-2815-47ba-ad41-5fa489070118", "comment": "Malware payload", "value": "752f73f7a349725417c062110ba796697aa4046290143c06cdc881c370930062d458af727173a6dd739b5a8dbe937b19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972918, "uuid": "f38482ae-564e-4e0f-857c-cbe3ba3a0f49", "value": "T16A14CF1237D0E471D032B7319C68C5B0777EB9215A79EAAB7B28172F0EF02E09676395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972918, "uuid": "fd0cecfd-a916-4b53-bf3d-1096ba316b83", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972918, "uuid": "93c48744-5238-4aa2-9040-347acc3ad840", "value": "3072:kR8u78Ml+RxErZF7GfiZMAA9dj5iQCyK4mKtO6iLwGQpACD6Q:kRmMcmFKfi/Ot5ivF4F4wGQpPWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675972918, "uuid": "9d5bc0ee-cb7b-4157-a7b7-8354e8235ce0", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675972918, "uuid": "7e614c88-13af-46b6-a784-4dc125fe946f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972918, "uuid": "49dbe4e9-b187-4acb-9ad7-3ee137461468", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bd82ea-a897-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675960264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960264, "uuid": "7e5f9969-7db9-4319-bb8e-8ae07d38759f", "comment": "Malware payload", "value": "854d58e273861db3228171dd662d37aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960264, "uuid": "6af79193-68d2-486a-9951-f069d8cf421c", "comment": "Malware payload", "value": "9e6c5b43e6d5cf6b37148c1a2fb557b013171a45b5d0edec514545dbdcadf196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960264, "uuid": "1af25121-4cd6-4ddc-8400-38730ecc05b1", "comment": "Malware payload", "value": "556c6db70aaca4550f18baaeb90fc2d8f83b9580", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675960264, "uuid": "2c64b9a4-50e1-4038-820b-003d090e5a57", "comment": "Malware payload", "value": "f90ee0510cd3b3dfe75a04cbeec4c9a740df98cbd08eb4cc87888dfb680b3fb89f1529459802c5341fe8e04aeaa4d59b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960264, "uuid": "2481fbe1-65b4-437b-9116-0c4fadf71d62", "value": "T11004CF1232D0D870E036BA319C69C6F57B7EF8204A785ADB7758272F4FB02D1AA76351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960264, "uuid": "a99f5d1a-be9c-4a3a-ad8c-3485c05407c9", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960264, "uuid": "3b179478-6e8f-4c07-9d1e-02ccbcb3c997", "value": "3072:wFgBBqn7wMIyKE+VRUKM6AIJyxlfWxzPTd1NKf2fakXoaB5AONZv:wFgq7tKlVRzAgomTd02yQh5DX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675960264, "uuid": "d3f07e03-a26c-4111-a2ed-2ea7f33b4de1", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675960264, "uuid": "b949a1b5-fd45-4f61-8aa5-3b93b80ce9ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675960264, "uuid": "65c21546-433c-4528-a574-bc0e9080a099", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7563f5-a83a-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675920683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920683, "uuid": "4ec6b465-98de-4ff1-85e2-b6314f1d27ed", "comment": "Malware payload (LaplasClipper)", "value": "dab20b8790b09f050b673fb6dca9dc68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920683, "uuid": "d6eb277d-82fe-4794-8516-6e041e1f5600", "comment": "Malware payload (LaplasClipper)", "value": "9ee2809bf58255e50d290f296b404ba79c4c3593fc48e5c125d4fb33eec23c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920683, "uuid": "5367d47a-66f0-4db2-b2e6-a82ed62f2225", "comment": "Malware payload (LaplasClipper)", "value": "8f0588544a9094aff314b67bdac0b756319da17c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920683, "uuid": "c7aea490-4af3-43af-a82b-c91a08459444", "comment": "Malware payload (LaplasClipper)", "value": "d6d133494dd6a67cfddc693f66d4b60ac037f0b74c58b160dd70cb10f7e3e0fb81c82079c2e83a19ccdd3c62e24f9a42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920683, "uuid": "79f84e1e-bf10-4ebb-a064-94352d99368e", "value": "T12685333436C0D0B1E6F618F50AE1CA61E7797030A4B5CE275FE9A9FA9B30D51AE12347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920683, "uuid": "b60ee7eb-c609-4714-9259-0de00a0fa3c1", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920683, "uuid": "608e5af0-a27d-4c93-9bc3-bf68d25548b3", "value": "49152:ryxnvnLLDon2+cbbesJjmdZJNWfigbK8j:exnvnLK2beijmdyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675920683, "uuid": "5d323fc6-72b2-4e49-b67c-91f233604532", "value": 1874432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675920683, "uuid": "e3737f2b-5417-4c66-8ae2-fa72b1f0313b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920683, "uuid": "5eff2903-c7ec-4d82-bc87-2ae2e8745833", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c2d4e7-a886-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sodinokibi)", "timestamp": 1675953255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953255, "uuid": "f5581b0f-afd2-4dff-a9c4-dfa8e0fb79d0", "comment": "Malware payload (Sodinokibi)", "value": "62ac26e575f43a4743bb4f3fbf13e80b", "object_relation": "md5", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953255, "uuid": "9c1f6ff7-3f96-4ff0-9c25-dedcce267406", "comment": "Malware payload (Sodinokibi)", "value": "9f31413bf3c33baac4cdac9557567109318cc355919b25d7b69cd64db25ff55c", "object_relation": "sha256", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953255, "uuid": "76fc8985-d655-4c02-9d11-a69e3dbb7469", "comment": "Malware payload (Sodinokibi)", "value": "0c19cbeb5b6bfac331633606a92a3878dacb2b8e", "object_relation": "sha1", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953255, "uuid": "8f8b2b9f-7958-4a8f-bb81-b9081a0992fd", "comment": "Malware payload (Sodinokibi)", "value": "76c62c89da09fc6c0d9746f3adfc356bb1a0cef5dc54f8031ab195eade049b303a31fa105c62ac6bfd321225ab30d457", "object_relation": "sha3-384", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953255, "uuid": "dceb600d-1004-4a5c-819f-5dfbdbb96646", "value": "T16D04E06B6EE040B2F0D301F2277B3F367EBFFC704826551AD76858890A65580DA2A3D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953255, "uuid": "8be718c3-e8a5-44e5-9a48-2760126ed6ea", "value": "9014e39262404e977fd8e4e75cce30e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953255, "uuid": "c556a810-9b24-4282-97a0-e2d259563775", "value": "3072:RNKQ4JTBg0Q8F63VETed7/kBazzFbUL7npOStSWQ:RNn4FQS63VE6F/M4q30TJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953255, "uuid": "77fdae4e-7ad4-4da4-b871-1aa75001fe45", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953255, "uuid": "ac027e26-80b3-4a3f-8d78-f194188e50d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953255, "uuid": "ce84cc47-e175-4c0e-88bd-dac85fd17fae", "value": "2023-02-08_62ac26e575f43a4743bb4f3fbf13e80b_revil_sodinokibi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1aa9fbf-a89b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675962217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962217, "uuid": "886c9573-7085-476d-adb9-4c30c10a1f08", "comment": "Malware payload (Amadey)", "value": "1811778bd409478071cadbeb224cef57", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962217, "uuid": "67937236-cd6a-42fe-88d2-864666c20ae0", "comment": "Malware payload (Amadey)", "value": "9f46496d50d76c60965ac38dd159caf91c1e74e2ef7d3e8b3f8d2d2a355ec19a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962217, "uuid": "e3f7610d-17b8-4bc6-85c2-d6050ca524cd", "comment": "Malware payload (Amadey)", "value": "bc91dbb3531f2e6ffa8a3294af199ee0bb3fb016", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962217, "uuid": "bb8a323f-9d2b-41cb-b171-e651d13594df", "comment": "Malware payload (Amadey)", "value": "d14b876640ff1fcae8db1a9c8c713604174430bd88dc78f483ede7c1f27e913d25edf4457760c505b975e469f56c4f47", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962217, "uuid": "0c2fac27-5bf9-4b73-b59f-7d08d17c479e", "value": "T154B40217FBD94032D4F16B7019F603C31A367DA16674539A2B8E6C2A09726B4B132B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962217, "uuid": "9094cd63-2dc6-4bd5-a4c3-dc778d02dfb9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962217, "uuid": "67e53a0a-667f-4473-a3da-fa1c6f9fe8ef", "value": "12288:wMrVy90YEfRx9fJjGtSXCN+J+XhJRrxTJRL0q:1yTEfRx9fBXCg+xZJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675962217, "uuid": "7972582d-4d85-4dcc-bb6f-93ad05ea3f21", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675962217, "uuid": "c7e5e68a-7982-4e58-9550-5793a1b1e19d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962217, "uuid": "25f7de18-ba93-4591-9e51-3d99cf905968", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e688f84-a819-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675906269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906269, "uuid": "40fe903f-0968-4a14-b952-27fe33072a74", "comment": "Malware payload (RedLineStealer)", "value": "9e429ad67b0b60a60ba3881aee5851b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906269, "uuid": "52d4ebf2-90cc-4a42-8a7f-624b28630d77", "comment": "Malware payload (RedLineStealer)", "value": "9f4f54a2083b62b83ffca33c2954ee17703b3bfc919a1f7694c8c12c3d1afaef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906269, "uuid": "478c1a64-f23f-4948-a397-d3c3f00be45a", "comment": "Malware payload (RedLineStealer)", "value": "8cb0b53b2f888810dc6ed24a68dfab09de150d4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906269, "uuid": "04c26edb-7364-4b86-a830-b73e02f0f041", "comment": "Malware payload (RedLineStealer)", "value": "a696dbe8d6e350892c85c400c511097bd711f4c881fbeef97f5af045b9f404ab6901856809745db106d013e60dd6aa6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906269, "uuid": "ce180644-b094-450c-b2ab-4224ad1269ef", "value": "T1BF946C0393D17C84EA2A8BF2DE1EE6E8765DF9509F4AB77612189B1F30B1172C563B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906269, "uuid": "02b53181-2fda-479f-8574-cfba2e8fbcd7", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906269, "uuid": "533c0970-8347-443d-8512-8f2a78d30f05", "value": "6144:7MrCWAHY5JLJFRZpZc96hNQbIF29IeURQkeQGSrQ:7MmWhFRZDc96zQbgw2Qkei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675906269, "uuid": "2b07778c-0552-459a-b8aa-241178e16b15", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675906269, "uuid": "64d694bf-529b-49b5-b752-9aeddf746e33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906269, "uuid": "aaa01e4f-c9e4-42ce-afcb-597f6388181f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9a54b7-a881-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675950771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950771, "uuid": "b31cbcb2-1db3-4093-b0bc-defd71e67ccb", "comment": "Malware payload (Gozi)", "value": "6d5eefee80ac158543a38bed7f72d916", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950771, "uuid": "fd82a63f-dc9b-4740-b50b-ed83037c364a", "comment": "Malware payload (Gozi)", "value": "a01f213f4b8070f25268bff89a8e7a331f4428df86121309623d2f30c2223bea", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950771, "uuid": "3f8291dd-c5d5-4565-8be7-d1247c3c0bd0", "comment": "Malware payload (Gozi)", "value": "07a129d794fba8ff08e75b6ef1fa43b9b6214849", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950771, "uuid": "2321440b-6fed-411f-8935-2f2f1b0254be", "comment": "Malware payload (Gozi)", "value": "af8f02b05715467130ed5e2a780903f40bc38b798f39b66c3b846fe0dbdfa7ab27b805b66a1243ebc2bf4608c297dde2", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950771, "uuid": "bc24510a-0d6b-4fc8-9602-ae1cec90ba18", "value": "T1C5F0591C41294F33C60DCA7BF1C6867E2272A19D511AA2B3131C0BA7060A2B00D1A285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950771, "uuid": "a4d988c4-b13a-4e4e-8820-103ae3e7bd3c", "value": "12:5jhtM/uJtO/gJV1vt3ZVI7tey4Bna/a9tZvntGt:9hu/gJ3xZV2cJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675950771, "uuid": "5f2f1613-e5ab-41f3-bc55-2e671ca4a3db", "value": 550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675950771, "uuid": "d736ab3a-efb6-433b-8a8c-2dfd1272e3d3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950771, "uuid": "d7bd61d5-38e2-4afb-ae0a-9c463ba84c93", "value": "agenzia_delle_entrate.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3ec6a5-a839-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675920035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920035, "uuid": "bf66cec0-2770-46c8-abfd-9d4b1cda9cf9", "comment": "Malware payload", "value": "58cb96288d8ada838c2187dc9bd21fae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920035, "uuid": "ba67a65b-576e-4f03-ac3f-79ff613325d8", "comment": "Malware payload", "value": "a02fc41c21e5cf0aa8919198cb3dc7e93bbbf7fb0b6ae8bc4c97332818b0dde1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920035, "uuid": "ef89bdcd-9494-4fe2-a3ad-55166942e1c9", "comment": "Malware payload", "value": "56da68afe24c9d93ed7f0153c6550e5a357c0ba6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675920035, "uuid": "fc6cc7fd-c1be-47a0-bdff-50cd727923d6", "comment": "Malware payload", "value": "4bb735f4653d29af4bbb2c0dc2d352b848446c48fdd69bbabb71291cc0e7c17bee902ee85a68075269fde11fe36b13e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920035, "uuid": "709eec23-1776-4d52-9614-4698e4fab052", "value": "T11D7633117DE648FDD2A50C31DCF72FE3A8F9F9254F2858F37398524628AAC525402EAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920035, "uuid": "63f54473-d339-4075-bef9-dfcdbd2ffce9", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920035, "uuid": "2273cf41-f2c0-413f-a65b-14aadb2d348f", "value": "196608:91O8S2nXipTV2dErfoR7lfYhhKesL/QOtP7uvBr+jFq7F:3O5Yifm7lfWhKesL/QYDArQq7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675920035, "uuid": "3134860e-c8d7-48c9-8c25-1f2ce5c42a2e", "value": 7642908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675920035, "uuid": "6b2d30db-3836-492f-9bdc-f61c9169c1e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675920035, "uuid": "3bea5719-af34-4ce3-8cc8-18d8df795029", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd5f434-a8c9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675981912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675981912, "uuid": "4a73ea43-99af-4b90-9152-d142ee77e7bd", "comment": "Malware payload", "value": "b6a90871e050ad177abeea472e653f03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675981912, "uuid": "0cb283dd-e693-4db2-ba39-6a1e4b0ba2e7", "comment": "Malware payload", "value": "a03e20741d96fbb52d78d09e0aca3b5bfcae2026aa2d942040282807fa47e73d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675981912, "uuid": "2b855703-109b-4175-a377-fc7e6f1147d6", "comment": "Malware payload", "value": "0d36b4b8064369b2f329c9644d7637aed73933d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675981912, "uuid": "c3959e8e-c5d3-491c-9cb1-4deebee7dc82", "comment": "Malware payload", "value": "483a9cad82fcd00ee3b3a703fe8c50fd1f55e0d8b7196152a709ca2e1d327eb2dbbc52585836270b39e07655c6fda5ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675981912, "uuid": "65b89b0f-21ff-4c9a-8c93-670a140d7206", "value": "T12DB40207A3ED8467E8B817701CF903D30A36BDA05A38D75B234A9C4E5D725B0A73676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675981912, "uuid": "2eaf6b94-f0fc-4a4e-af6e-3ef73c2c6247", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675981912, "uuid": "ac74e7cb-5af8-43d0-8fde-de4838726dfd", "value": "12288:5MrMy90qSz6oLzxSziz6DIYgEvW5vm9g0mi4:xyceAQiUIYour6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675981912, "uuid": "caf5dca1-3091-4466-bd06-98ecbed2a217", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675981912, "uuid": "558df4bd-edb5-4d03-b33f-3b4ae746051e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675981912, "uuid": "e34c2b26-8d7c-4c3c-b39a-703e6c55b796", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37416161-a818-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675905747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905747, "uuid": "cb966a63-98d4-4ac3-aba8-39d051ddef77", "comment": "Malware payload (Mirai)", "value": "84ce89910d2f6d027f5e54206595a1d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905747, "uuid": "44f189f1-d71f-4bc3-87cd-43bb0deee02a", "comment": "Malware payload (Mirai)", "value": "a07631864052b0e17179e249736d8d76ac268f0dfdcde0366ebfa610c71fd11a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905747, "uuid": "862a5c09-92d6-46bc-8a0e-1b6588e5759d", "comment": "Malware payload (Mirai)", "value": "8fcad90b500155db83ea807aba477fe373363c00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905747, "uuid": "e66ef6a6-1ebe-4407-94d5-596c8b8f074a", "comment": "Malware payload (Mirai)", "value": "2308ad01145c01a40c8a9df4a4b34d968514034b489df120ccbdd14aa26d1dca6c81b86bf4eb4b63f6ec5545733ad67b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905747, "uuid": "365f1317-4811-4f15-abad-1ccf90cc2723", "value": "T131335B21A87D1E17C0E4E5BE62F78B6AB2F6160E18D88E5D7D730E4EFF10490A8475B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905747, "uuid": "f34e87fc-ea24-403f-bb3a-435e931f5df5", "value": "768:97+ttmSRovNqb6Hq9S1WMuohI9K4eQCXpICs39wZClOKGiKaO+JfGw:NsmSRea6HSSG0I0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905747, "uuid": "3f5794c3-9de3-4e09-a29a-a094ea7daf8e", "value": 52748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905747, "uuid": "542507bf-8c64-4adc-a347-ef9ac373e6c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905747, "uuid": "7b1f1265-9e36-4de2-b62c-36a4ec8574e0", "value": "84ce89910d2f6d027f5e54206595a1d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efecd89-a82b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675913840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913840, "uuid": "dadf5784-b19c-4f06-9e40-a496d86c9e1c", "comment": "Malware payload (Amadey)", "value": "7eaf2d406abf7840a78bfeece6b57ce0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913840, "uuid": "6d99d6e1-7de8-4f1d-b90e-71cb612fe323", "comment": "Malware payload (Amadey)", "value": "a1124383b2fde65062a009357f192a3625b3c7a66ae2bfb7552b46640cfa617c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913840, "uuid": "12a0d3c8-02cf-410c-9ec9-ae369f0baca1", "comment": "Malware payload (Amadey)", "value": "7dcacf79a4b7ed13272999cbc1bd06af24241455", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913840, "uuid": "f648bc81-ed7a-4684-bac7-66ceac670099", "comment": "Malware payload (Amadey)", "value": "c4f85e43f7cc9a5aa8489f5865a095b30393f8bfd3f0a81347b45e475c3042b11d25b6f69fa209118e60594c94ed5dc8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913840, "uuid": "1499bd00-09f2-42bd-914b-cf3111bc606c", "value": "T110C40107F6F98432E4B557709DFA02C30A367DA09B388397260E6D5E0C72271B67676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913840, "uuid": "0cdcb969-309b-44d4-92a2-85d280a1e6b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913840, "uuid": "3d03b52a-710d-4e5b-aee1-39476ec73f51", "value": "12288:TMrEy90ngDGU1Wwbzvuo6XG8OqQhNudu:3y8UQqvuoUG8v4Adu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675913840, "uuid": "2770bba4-254f-456c-9206-d3a56d1ecc10", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675913840, "uuid": "28f543c7-dcb7-4bee-9a6b-5e4f75b47cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913840, "uuid": "55773ba5-a583-4d93-b9b1-955909dfabbf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d7285e-a818-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675905792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905792, "uuid": "a2b89cd3-69d8-49b7-bdd1-fcbb4f32d9f9", "comment": "Malware payload (Mirai)", "value": "75ce0cc6378de2a16f4fb61db9d33b08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905792, "uuid": "139dee84-3084-459e-a924-b8f65d96e134", "comment": "Malware payload (Mirai)", "value": "a125535db9bd40ebfc375a95d1d2885f1e02374a99000af7d7ff7694a9319180", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905792, "uuid": "fe7cfcd4-f8b4-40b8-95c1-26a0364e92c3", "comment": "Malware payload (Mirai)", "value": "3941ac8c5d10db1c61032deb2227e891c6746b19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905792, "uuid": "6d5dc627-a95b-474e-9b06-085107c7fd04", "comment": "Malware payload (Mirai)", "value": "e258d6fd05ed350eba4b6ccb33d0dedf481cbc15810a154945e09b37e122ade1b6f6533598319027a9f70489cbde9257", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905792, "uuid": "5795ed3c-86c5-4c7e-8eca-4cd9bc8ce5fc", "value": "T1D6D2D11AD4C49DB5EF7FBF370809AFD227A109B52757CA320600EF51441156BAF0EACA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905792, "uuid": "bee248e3-058f-47fb-9285-50fdadcf2099", "value": "768:Cb2F+M67OySMcl6ZznwrbL2RRizy9H0i4uVcqgw0t10tLy3:Cb2V67OBBMZzCLPzyH4u+qgw0tYu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905792, "uuid": "b2d24637-efbe-437e-a87d-4e8bbd34d6b0", "value": 30016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905792, "uuid": "1e52530a-402d-4445-937a-4b9feedce400", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905792, "uuid": "670efd16-1329-43d0-a140-2fe8f365ad50", "value": "75ce0cc6378de2a16f4fb61db9d33b08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28224b0c-a882-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675951249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951249, "uuid": "3f94c338-bcc9-42a1-b89b-77b7d45606f4", "comment": "Malware payload (RecordBreaker)", "value": "497dfbd54b8a5fe2ba1fae3ef197946f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951249, "uuid": "14aa3194-452c-44d2-83de-0be08b8f649a", "comment": "Malware payload (RecordBreaker)", "value": "a14f4e87c870e86a85dc1e875537fd515cf10e42ce86698f83f71a5e0beef8e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951249, "uuid": "cc6fc149-a231-438f-a7b3-38af659f1a94", "comment": "Malware payload (RecordBreaker)", "value": "49c51b1e9142614acb2c8bc63f70954d265fc197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951249, "uuid": "f4985c2b-aebf-4b07-bb5a-748e7b941c38", "comment": "Malware payload (RecordBreaker)", "value": "025f1ca6a16f108e002bc6d837ccf229a0e6060ee23ac12a27ca9d668d74c89908c98b3f4ea4c8dbf318721208aa228b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951249, "uuid": "15cd8fb4-f058-4374-a71a-36275d91c25f", "value": "T12704C01333E0D871D476B6319C64C6B1777DF8214E399A9B3B28172F8E702E19AB2395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951249, "uuid": "f0a73070-4113-46d0-ab18-b929b949389a", "value": "910163c173a5611f34260e641a94d790", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951249, "uuid": "e6b69094-217b-443a-a5b6-6b0ed850bbb3", "value": "3072:absQ1+EhWuWXCfm+mf+fS6mdmXwjr7+nJ4vVQes9A0n:abtvwC++mtFmaies9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675951249, "uuid": "1fbc0290-1338-4dc1-8a8c-97afd6330105", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675951249, "uuid": "9e4d685e-605e-43d4-8c8d-c7448b744dbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951249, "uuid": "26329d57-f773-4d70-90af-c704fbf7fa86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ac7b67-a882-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675951302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951302, "uuid": "6f8a6a97-510c-410b-8e16-0bb14693af49", "comment": "Malware payload (LaplasClipper)", "value": "084751e2a8af5ac8680db42b98c3beae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951302, "uuid": "4f483c1f-57cc-466e-ba74-e092f1629b83", "comment": "Malware payload (LaplasClipper)", "value": "a18b09003c8b26b3c1cc70a7483c9fec6e5db52f4bc036b5c7a383e151c24a76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951302, "uuid": "06bbe5d1-0d22-436d-ae84-09c34af9a0d8", "comment": "Malware payload (LaplasClipper)", "value": "25cb2138dd0db412502a5a69f455b95f3d913758", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951302, "uuid": "04318035-0205-44c6-a364-8937dd9a42bc", "comment": "Malware payload (LaplasClipper)", "value": "11a0df88ff59389d70c1ae3d916eb73922c628ea86291a377241bcb190f3a762e03e0b59fb6c1c04af92248f879cb514", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951302, "uuid": "56afd3ca-10cb-49c9-99ad-f3d9491c31db", "value": "T19A04BF233790E871C072B6308C59C5B13B7EF9314A79AA9B3768273F4EB02E19676355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951302, "uuid": "e6850b6e-0096-4545-9cb8-fc72e4ace8ef", "value": "910163c173a5611f34260e641a94d790", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951302, "uuid": "8875fdcb-e858-413f-a57b-da908f3438fe", "value": "3072:PbsBhIGfs6Bw4MiWZY+ZmHgzmZztPAtG3PpyCQXIKegqhYpXWghJhAJ:PbOfxw4WZDDCZAtcPpyJnXEymAJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675951302, "uuid": "a8186134-6a98-42d4-b3c2-f7b9627ad299", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675951302, "uuid": "8ceb5fee-c31b-4932-8ee3-aabb9eaa2003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951302, "uuid": "a8c2788c-6220-41ea-b6d1-39be8ccbe92b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da47a49-a8a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675965592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965592, "uuid": "8f1b2ec3-3b5f-44ee-a28a-79ed4b89dfc7", "comment": "Malware payload (Amadey)", "value": "754d48e2d50ce4e7b505bc97db87a7de", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965592, "uuid": "8dc5c9ae-9818-4bd4-8302-cd54b5a9faae", "comment": "Malware payload (Amadey)", "value": "a197ab44c46d8dddbdeed7a6be7d2552a3a6f4ed24f5564ba35db91ce9d6b416", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965592, "uuid": "e21ed583-e8b2-47b3-af78-a28020576703", "comment": "Malware payload (Amadey)", "value": "57798dfaa256f604a82a14bdd2c4146a1f8ee890", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965592, "uuid": "91add469-0703-455f-aa38-ca70e3f04c55", "comment": "Malware payload (Amadey)", "value": "0418aadfbecfb09102841f4b375055cbfb1de7f21cafd19b69052bc47f3c04af9f1028019bad41991d869d0f2fe95f05", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965592, "uuid": "b41077cb-065b-4ac0-bdb8-eb6589bb3dc7", "value": "T107B4020BF7E89032D5B1577058F707C31936BD609A7893AB268E1C5E19729F0A13277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965592, "uuid": "7e599cb7-1918-453f-8228-92710b2f788a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965592, "uuid": "1849e966-ff54-455f-af4a-2eed91e8066d", "value": "12288:IMrky90XpGyul85Pagl6WCNmJuXh4d+ns9BNVg:My4Gyul85Pagl6WC4uxC+nsnNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675965592, "uuid": "2104a626-eda1-4c42-9703-39dd138af9f2", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675965592, "uuid": "56d43ee4-47b3-4671-9a61-1529d8431829", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965592, "uuid": "7e2bbeb4-9d47-4054-9461-c682c5aef840", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7fe2bc-a86d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675942233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942233, "uuid": "d3b646d9-d8df-4142-b5a8-e854200c4dbc", "comment": "Malware payload (GCleaner)", "value": "b6520807a7090ed6de8bbae51abce7a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942233, "uuid": "f4ee0095-400e-4dc4-8a38-a7a0ff7ed61d", "comment": "Malware payload (GCleaner)", "value": "a283083eea81bfe5d7fc1c5203af7e2995e88a87a019702eeff18a6572bb86f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942233, "uuid": "0ad94324-69f5-4285-9379-bfd15d61bbf9", "comment": "Malware payload (GCleaner)", "value": "7226561b47852488912a2e117fe5dcf7c41f4752", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942233, "uuid": "7a5f6a64-7e20-4283-b004-d3c2eb583ab7", "comment": "Malware payload (GCleaner)", "value": "81dc6172adec846210a1405a045e81cb21002276f32802e56ce22a123a82f9a52a575a5bf4090545130fec319197c494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942233, "uuid": "c1412eab-070c-482f-932b-0262a88a7c02", "value": "T135C5127C7445C9ADC280FEB48C3AE9EB5CD71DE3E994A52270D9BF3F92791844A1A103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942233, "uuid": "b1b65e7d-b215-4b3c-9ec4-02ca85ab4b50", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942233, "uuid": "d184b069-89ae-48e5-8ea2-4687527a25e8", "value": "49152:rdHqVMvG8qjYaQZ5cJmZUnU6AULToRMYyQdHHJSIoER5ZvLCgv2MR:JHqCvAjYlZ54mZUnjHLEMGdnJSCfLv2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675942233, "uuid": "dd9e8be2-63d2-4d29-8b38-072011d64992", "value": 2576005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675942233, "uuid": "2892a9fc-fc58-4090-9154-4716a5202c69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942233, "uuid": "8e9fd108-a2ff-40d8-8f40-c02bcd513b92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfc487c-a8b6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675973644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675973644, "uuid": "e44f295d-9cf2-496b-99d5-2af2c53be55d", "comment": "Malware payload", "value": "433b813e066ee7ab3f5f11015705b659", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675973644, "uuid": "75262728-d478-4387-b2fa-9f2405600166", "comment": "Malware payload", "value": "a2f49d7bc1d0f299da6b59cfa653df073ff74b841cae265520c87a920367bf11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675973644, "uuid": "a4673a73-5dcb-43c1-9054-6cd1526baccc", "comment": "Malware payload", "value": "0cdaa0a0d51edf0c34ac3ae43c458c7d1365e0a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675973644, "uuid": "65a1d442-1b61-4d89-831e-034f81ed93d7", "comment": "Malware payload", "value": "a19f466f9661b7ac79c5d2a9468ac0d95f25892268b56fd72c8460e53c3867afeccff1f0570cdb43284148a7e323d31b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675973644, "uuid": "604e4a45-666c-474e-a96a-bc778bb28746", "value": "T17C3623334B650401E4E8CC3AA52BBEC572F20777478668B971EB7EC616359E5F203A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675973644, "uuid": "d9194f87-8d3c-4a36-9b57-9baae2fd1517", "value": "f51724e08a085aa5e9f0970616ead7ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675973644, "uuid": "2af88a7f-a82f-4060-94d0-b74665792896", "value": "98304:QwJ+BQSw6qvay3FK305/Bk6N1RKPEL15D7gDlk+C/eWK3oorad92TyGofF:jJWQSwz3YR6N1GELH3gDsGWK3RUGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675973644, "uuid": "cdc7d5a4-381a-4b74-bcd9-647c76be8f51", "value": 5272576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675973644, "uuid": "4df758bb-bc74-4ff0-9186-f7cce1bb0c95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675973644, "uuid": "bdb65b77-a977-4e22-ac08-bed9906f586a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08303f49-a878-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675946900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946900, "uuid": "65e353ec-79b9-4dd0-84fe-80db492a22a9", "comment": "Malware payload", "value": "46ac33f41859993f2e5c4e92f13d0dca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946900, "uuid": "64dd032c-33a7-4b4d-a14f-451c17fdf65f", "comment": "Malware payload", "value": "a326643a0b0666727cd5d38637313526ef28e12d9fd042549b9607bd1d2e0421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946900, "uuid": "5caec6d2-22bc-455f-95f3-ee45b85e677f", "comment": "Malware payload", "value": "2a53502bf6603e907a5232058fd75c24cbe1cdf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946900, "uuid": "693f69df-3459-46ea-a710-cb33aac31ccf", "comment": "Malware payload", "value": "9e65cbdbdc52a9f8a22e0c36543404b4ecee2a25aabbec1434adc61ada08d1cb4c81e84ce5609cfd90b2f98c77a563c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946900, "uuid": "5bbcf5d0-1c63-4e08-92d2-78c41a4ee45c", "value": "T147651261BEC04971D4B219361AF696306A3DBC2117B9CDEB47943E2E1A302D1EB37762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946900, "uuid": "de1b9ed0-620d-477b-96e8-985b6ee41f90", "value": "e92b2275a730f59940462780c383a1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946900, "uuid": "26d39c3e-0cbb-4ca0-9ba8-006c76966a69", "value": "24576:YLeTtjJFtHrKeUuFx5g8Z7EI020nEPK4xtLUSD1U6Yh2E8cWE5zM79EK:YLYkeUs5g8JEC0nEBBsv8cnKpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675946900, "uuid": "757bad97-9eed-4bdb-94ab-6ab17e3da482", "value": 1421403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675946900, "uuid": "c708f767-96b8-4f15-bdaa-95269f5c5972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946900, "uuid": "d44ca765-cf57-4f68-b75e-0b97916cdb34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6a1e77-a88b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675955442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675955442, "uuid": "4b35aa7d-2f24-40d0-8b8c-22a2afa6aa9b", "comment": "Malware payload (Amadey)", "value": "77758c9b682afca2ab06d77e2771a4e5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675955442, "uuid": "cb77bf99-66d4-4881-bec2-75c8603eda86", "comment": "Malware payload (Amadey)", "value": "a37691936abd27ce1ae5a5deee2aa8b129e3fa0c188efea90d587a0069367142", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675955442, "uuid": "74ea684b-9fe2-4556-904a-aff5b63451e0", "comment": "Malware payload (Amadey)", "value": "d5097f438706507f417d215ac5bc663388c1bf81", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675955442, "uuid": "85fb0c82-8eba-44d4-84e0-1279b2619455", "comment": "Malware payload (Amadey)", "value": "1a94f7576ecfb0a09954a72ceb5361cbe43bf80a7282deff9c7d1884543ebab1d19f840e9e829f5fb3ea84dbed1cd9fd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675955442, "uuid": "3a302dca-2129-44d6-8632-bf208b22a75e", "value": "T1D4B4020BFAFC8175D8A0077059F60793193A7EA15B3487DB274E9C8A1CB25B0A63176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675955442, "uuid": "6f36a3b8-789b-4c76-938e-bbdb25d42fd3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675955442, "uuid": "880806e2-e6a8-466a-bf65-431784e658ac", "value": "12288:MMrZy90yUV+H4dULp+4szJEVHaTxLvsLbFlYxRs+j:1yyV9aLsTiqLIbFlYIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675955442, "uuid": "efe9f629-c0de-4763-bfc9-3741c7511c5f", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675955442, "uuid": "a561ad2e-c52b-4746-88d8-d8e322857538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675955442, "uuid": "ea002756-1648-4bf3-bdf6-6f7a0f52d5e8", "value": "77758c9b682afca2ab06d77e2771a4e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f26bedd-a812-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675903157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903157, "uuid": "609a11ff-14d9-4aa9-afce-b7844ade497d", "comment": "Malware payload", "value": "5912dc5d9650a4a137ec62dfd66d5845", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903157, "uuid": "d419799b-ad3f-47b1-a3f0-e1635e5a569e", "comment": "Malware payload", "value": "a3b350c21d3de56ead4ecd5cc30afd832d44188cd434e23ffbdda4d65cddafa2", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903157, "uuid": "db904560-7e83-4e95-a3bc-2db4ade5d836", "comment": "Malware payload", "value": "f9a4a03c1ba3dcee6fce5e00f4d1ac1c296f0f54", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903157, "uuid": "61defd10-9cdb-45d8-b953-45469b21a86f", "comment": "Malware payload", "value": "fe1e56b4d6fb1250b5559c2304383de4e36e0096c85129f5e1544a03dd08c53f3f5e0133049c7fda40b36215ff32d3e8", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903157, "uuid": "94675937-e79d-4114-bb43-65c4b14228bf", "value": "T1D2A423021386BF2DE614D132D8C783145A462A3B88B273576705C988F6E4DC9B5EFF9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903157, "uuid": "2982edd5-9597-4e88-9fd7-e0e01ba06c69", "value": "12288:fh3YPX2fagEUNlaNhDrw1EXUqv74lzdxPA0ljUfoS/:fSPXIjFGN5pxklXf6oA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675903157, "uuid": "40175340-3646-43e5-8b01-0f0aa872b954", "value": 468908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675903157, "uuid": "097db222-895b-4af5-b7c3-897f1bdd9e7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903157, "uuid": "21aa4dce-f3db-4c8e-8e7e-1bbafcefe52f", "value": "st4rlightarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03271baf-a8c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675980822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980822, "uuid": "fdcce191-5c92-4a8e-9a63-9ba2aec741f5", "comment": "Malware payload (Mirai)", "value": "b0848de6d9ba712c41963ae53834d489", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980822, "uuid": "24889f45-bc59-4d42-a9d9-fb4f83469096", "comment": "Malware payload (Mirai)", "value": "a418834472d914b352f98cd79133786156753f6d82a1a2dce2f274d7381c4650", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980822, "uuid": "f6c36f98-d6e1-42df-84b7-062539b9abb5", "comment": "Malware payload (Mirai)", "value": "d5185e493f2cede9ee1652747afbf9d17577aaaa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675980822, "uuid": "c4a408f9-43d1-42fe-8483-3342f04e3fc6", "comment": "Malware payload (Mirai)", "value": "e3f0888d8cf62279de70e9bd1da98191d360d8ffc480ce941e3e10a8e3dd95cdfc09a81d5e76bef2a93ef64d405c02cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980822, "uuid": "59f708e6-b84a-466b-8201-54807246fe8f", "value": "T1CA730A42B54FC6F7C0470EB542A7B63E8A31EC2A0A6A8B5AEB1DFDF4CB175C57116204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980822, "uuid": "923971c3-a623-4c3b-86f0-ab09899040d6", "value": "1536:2moXIQwhYd2msPj95pmpLCopcDWC6aQuIVdkpmiA5CoeKdI1fkq2J+:2mXQwhM2msPtQeA3CxQtVepU5FN4cq2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675980822, "uuid": "406d8fe0-d03a-4404-a87e-ddffa7db285a", "value": 79619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675980822, "uuid": "e70fe561-cb31-4711-a00a-b65349c8a20e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675980822, "uuid": "1a9ebb04-eb6e-4d6d-a041-24801ac9be1c", "value": "b0848de6d9ba712c41963ae53834d489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596bb1ac-a87e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675949613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675949613, "uuid": "354ddfcf-ace5-49cf-91e5-e5861d185309", "comment": "Malware payload (Gozi)", "value": "4f65e575df96122bbce04e538e531d5e", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675949613, "uuid": "e37caa2c-c045-443f-9b72-cf1f83c4579f", "comment": "Malware payload (Gozi)", "value": "a42fad7a44006d21404affed1fb90a67ecf5e2bc6436dc3729705ca29b4f91e4", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675949613, "uuid": "fa17274a-2a1c-4a5e-a7ca-5c66b962c983", "comment": "Malware payload (Gozi)", "value": "bc7db9bff284dc162af5945d849b76fccbd25125", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675949613, "uuid": "aa94415e-faf4-4f2f-9d40-57c96eac41f6", "comment": "Malware payload (Gozi)", "value": "0c128989d31411ebbc81b5f21fdde5062e9d14d9c396c5c0f53720f9b41157f3ef250a28854732e37546d4018e55f328", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675949613, "uuid": "bde62b9f-f246-4c43-8498-5d5615888290", "value": "T1B3139E01F6F948F6C7A31EB06720FBA9A7F9D631217C5151AF2369CA1E60953E13D20B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675949613, "uuid": "5897822e-c858-4b4b-950e-c43b589d8a7b", "value": "ef075d26b728b78a932306e24062e80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675949613, "uuid": "9a074a98-f829-412c-9ced-5312f7fe7e7a", "value": "768:/0gsqVXye2rS/Q4VYXQIVpCHlNBmQWGk2j+A6ewBvu7gpzhK3D1Gcb:/9sq8S/QEYXQIVWlvmYp6ewNu7hD1Gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675949613, "uuid": "3edd2469-cbab-459e-82d1-ae45252b3355", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675949613, "uuid": "fcba2a63-b403-48e4-8c1e-8adaedadd2d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675949613, "uuid": "4b4a9354-6442-4663-9d24-0739fae36aca", "value": "unpacked_gozi.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40565340-a891-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675957732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675957732, "uuid": "1131580a-ba72-4b86-88c8-5ca8a81535bc", "comment": "Malware payload (Amadey)", "value": "4575f983ca45d2106734692b4bde6d15", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675957732, "uuid": "f7963327-6c6c-4f0c-963a-4a15cacd08d8", "comment": "Malware payload (Amadey)", "value": "a48c771a01e910ac9733396d9e8d970cc5e586b0d4875908051748a285b88cbb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675957732, "uuid": "f6f2b62b-6916-41b3-bef2-8bce1cb991c8", "comment": "Malware payload (Amadey)", "value": "c3ff8c68746fa21e99f8dfa16baa48020ad9fd60", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675957732, "uuid": "265edade-8761-4393-9b9e-72e8c646082e", "comment": "Malware payload (Amadey)", "value": "32d2ed734a2a12bcf9e533f0b404192fcd1e71e2c490b59a2f02a0da800544a02d311ee7af281fbc4a290aeb6da3c8d2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675957732, "uuid": "62895100-ed00-49a0-9ecc-3034db0add7b", "value": "T114B4020BEBEC9062E8B517301DF207D31E36BE516A78839A234E9C5B1D731B5A635327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675957732, "uuid": "2496bf7e-fef4-46c9-bb8b-abf925957f2e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675957732, "uuid": "e789b1b7-14ab-49da-950e-d6f0eb5afbf1", "value": "12288:jMrVy90fcbysDVWYhQ+xuXZGDJ0rF2DJ2m67ZhHgn5:myTbDV9Txu+erF2DJ2L7Zh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675957732, "uuid": "58fa3f70-ac36-4f0c-8aea-57ebb817881f", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675957732, "uuid": "ef0c6aee-5020-4043-8bb8-d36cbd228624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675957732, "uuid": "055ebee0-ab88-43dc-a8c0-23948fb137a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3c0e73-a883-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675951816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951816, "uuid": "395b48ad-e6d2-48d1-8074-ebd4146eba13", "comment": "Malware payload", "value": "620ca79f39faf72e4f9dd11b07491f87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951816, "uuid": "13f06ee9-8f1a-49d0-8d1f-02bbe129cdb5", "comment": "Malware payload", "value": "a50a57385405aaa91014dc24c77d4873cb6c33ae149090fe4c4ba4a1fed93361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951816, "uuid": "3ca9d89e-4c5d-4328-994a-43a79bbd4d02", "comment": "Malware payload", "value": "7155a958f93f0512187b28ac9088143c719c9c01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951816, "uuid": "f2a548e9-6485-4943-bc21-6d821ebaf2a4", "comment": "Malware payload", "value": "c2f0138933648514eebfe6b1ebec4c95d43d95ebcf067dec63d80d2c4c758f19a0475525335ad818e2731e5f899833f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951816, "uuid": "641c20dd-e96f-4285-8450-8b1454643483", "value": "T13176330239E6C977E286A976DD184FC561F5D9180F049FAB5B96081E2F3C8ADC53EF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951816, "uuid": "5071fe80-45fc-481a-915d-594f3c53d4a2", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951816, "uuid": "19e26d90-1c37-4318-86b5-82451c798509", "value": "196608:91OxFfy8k4d+xcG/aLZwk7k7Q3fEg6JOQ7o1wuA0RO:3OH84d29rOfEg6IQNR0RO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675951816, "uuid": "41c72d34-34c9-4b59-88b4-e9356893b055", "value": 7583536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675951816, "uuid": "1d894ff8-6c86-47b8-a04a-dd96816c2cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951816, "uuid": "67ac933c-9bb5-41f7-9553-c9758f2dc8ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0b3825-a893-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675958776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958776, "uuid": "be1da0e2-4985-4542-b326-acbfabd755d3", "comment": "Malware payload (DCRat)", "value": "868d21f20d9baf9c4a8daee1913533d1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958776, "uuid": "f489a8cc-bfe2-4e08-9c71-ee5639d40db4", "comment": "Malware payload (DCRat)", "value": "a51d75e20f254c6e04bd8376672285b29f072a9df53607f3adf3cf2efa02625b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958776, "uuid": "2454dd83-2f71-46dc-b0e1-cb4785c6e802", "comment": "Malware payload (DCRat)", "value": "0561eb07552f1bbc8ad0da79db58a5c35efed7f5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958776, "uuid": "388dba5f-ca75-44c5-aca3-8c44750f72a2", "comment": "Malware payload (DCRat)", "value": "674cc3fd0cf6a75fc14f419c651cee3bdd0d9a7dbeacd0ce1283553384f34e172632bb7398a540c5d78e3b403c4f7c3c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958776, "uuid": "3dd10d57-01a5-446b-92f6-72b0a6d209ee", "value": "T19FF5339B3DDC281AC7BEA3F812A30D1B5C8973163AB30469FF906176CDB6B519D0AD40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958776, "uuid": "94821669-6ea0-4d83-a72e-2ab665acd40f", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958776, "uuid": "5d53fbad-fa0d-4343-a929-75d7ef9d42f1", "value": "49152:12A49Dw9QwAcoRHhIJFFqnjYuJuWfcxz1n7hfSY3IRtrXXT5nguTxaD4kn+x:ItZw2wAcoJmJFFILcxR7RUzDquMsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675958776, "uuid": "102c85d8-13ff-4278-a584-f03d35e4ac5d", "value": 3331072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675958776, "uuid": "2add9041-e1c1-485f-9d8d-62977c397b4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958776, "uuid": "25d70cfb-67c7-429a-a7d3-f44ad94e70a9", "value": "868d21f20d9baf9c4a8daee1913533d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722ba8e7-a810-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675902410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902410, "uuid": "44aff3ae-2eaa-48c4-b475-7ae2c7b7da10", "comment": "Malware payload (Mirai)", "value": "f3ca625e0bff55f5833c484949c64de4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902410, "uuid": "0ef31861-ab77-40ae-b63b-9fde7713d45a", "comment": "Malware payload (Mirai)", "value": "a5468986143488bd54818322a46445e7ce2a5e77b3ca473ad0501d348958be03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902410, "uuid": "152fc21a-6f49-454f-b522-3ec80c96102c", "comment": "Malware payload (Mirai)", "value": "fc591c52ab2d7244f4b9bdc0e54f154c1bf4a955", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902410, "uuid": "ee8b1f55-95c9-4b4e-8347-7bb6d84539b5", "comment": "Malware payload (Mirai)", "value": "9844f6cba0150f39b81454537a6d047caa8cefe60ada3a8fbe77b77e0868703e85548e6e91855d74ba3cf08f42a9278d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902410, "uuid": "1eda7fea-1e73-4785-b29a-464f31c9b543", "value": "T173835B9BF503C5B6E45204B1602BBB23AA73D2FB809AA646E7DC5E71ED119025317FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902410, "uuid": "b2a367bb-cc6a-48ae-b43f-d6ce76bb5ebc", "value": "1536:TqpP8HLqEnr8EBZ/kYHfFgwpl5X7KYvhtYY/YG0Cqgj:TqpPSvnruY/FhpLrKYbYfCqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902410, "uuid": "95d7e0a3-bc9f-49a2-a72d-8e07fc18f419", "value": 83596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902410, "uuid": "7920ffb3-5883-4f9f-abfe-662a1d5d743e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902410, "uuid": "dc918d2b-7f36-4306-8e39-fbd6c9b44928", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0be1d1-a82d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675914751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914751, "uuid": "08707485-47fe-4d59-91f3-6001c17998d3", "comment": "Malware payload (Amadey)", "value": "497c306e46f1ad11163bfd7f664427ca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914751, "uuid": "ef4572fa-6265-4d2c-8549-b7305b2ed360", "comment": "Malware payload (Amadey)", "value": "a556f69bd2f2d4df951d9af97bd2048a05c5e2fdab03b982e7a6e9ca73199474", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914751, "uuid": "538ef0d0-e661-4445-b642-5d0dbce1b10e", "comment": "Malware payload (Amadey)", "value": "971896198fb9fa5c71db021bb2985ff99cf3cd56", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675914751, "uuid": "62e2240f-d9cb-4b7d-8251-8afef44e3204", "comment": "Malware payload (Amadey)", "value": "47da5d46977d6fdae5408542c619131b0ffd702ee833151c7bbfb1d56a053a30fe20d88931b0554be542a1f45cf1f084", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914751, "uuid": "33f42848-d293-4057-914a-34398762230c", "value": "T1CFC40207F5E94432D8B167B04DFA03C31A367EA01B3896A7674E7C5E1C72274A631B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914751, "uuid": "71154178-3eec-4b78-ae5e-c6e236a82816", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914751, "uuid": "884b7ca0-085c-4450-b23b-fc2776218825", "value": "12288:lMrey90lkq6eLn4jn8qdZMhh5ybhvuogXG8EtMMtZ4+Vd77qS:/yw6e7MRUXGvuoyG8YMM7Hvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675914751, "uuid": "ea760676-e705-4187-a018-b2bcba228c15", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675914751, "uuid": "cf98052e-04a6-4267-9c06-f39a5122f477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675914751, "uuid": "b798850b-eac3-4bd0-b9e9-9594eba35ff7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a4382d-a848-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675926500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926500, "uuid": "c8b7e19c-463d-4a22-9ebd-ba77b86590f7", "comment": "Malware payload (Amadey)", "value": "6528141a9c028fa97368167e8672a82f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926500, "uuid": "67c2812b-c8e6-4f4f-a100-3bdb9052c2a3", "comment": "Malware payload (Amadey)", "value": "a58bb55b53a1e193766729cac39c34d00a55d131a7f9f069fbfa6319a92e3778", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926500, "uuid": "c6896554-4781-4081-be6e-6177e7380f41", "comment": "Malware payload (Amadey)", "value": "01c1ba224fb711aa0fcc3432c2d4880d3161ef8f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926500, "uuid": "cb3e85fc-e0de-4a87-9a0a-89bd37fd8db2", "comment": "Malware payload (Amadey)", "value": "215c15ae1dd76711312bb83ffae89110b80fd3baa7e7fffef39879f16c793caf8d7b9c5963e2a4b8d73e7d5e2fdc9b5a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926500, "uuid": "95cf6e99-b357-4333-91c7-c355e126e470", "value": "T1C5B40247FBEC8172E9B557B00DFA03D315367D606A38839B225AAD4E1873560AA3137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926500, "uuid": "46919ce8-f764-4970-87d2-f067632eb30b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926500, "uuid": "3dfc78b8-a780-4d38-8cce-13f60ed9b6d7", "value": "12288:3Mrvy90SHFcAc4nMVwyV0XXzmXlAJHPNfWS8Btflizd3:EyGQMVVV0XXiX+VfJ8Bttg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926500, "uuid": "655da851-a2a4-454c-a8f9-821871379f28", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926500, "uuid": "3b215cac-0f9e-47b8-8843-e9b2b682dc5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926500, "uuid": "d9b11565-1337-4167-9a50-aca4c09642dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c86397c-a849-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675926855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926855, "uuid": "715d736d-7b00-44b5-8b77-fb5459f2cc77", "comment": "Malware payload", "value": "3b1eee1eae44b69580a51f62892299b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926855, "uuid": "99c6322c-77ea-4201-b960-a34e6ca0900a", "comment": "Malware payload", "value": "a5a7cd96d20f9dcae8e052a5fb71ffa0b5d9573ddcc85ee4d651724b0f450e1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926855, "uuid": "7edafb94-0749-4afe-9a1d-b7fc761bd6ea", "comment": "Malware payload", "value": "97b9a975bb3300c24eec2cfc72487cbc53c250a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926855, "uuid": "487917dd-4f18-4f6f-9a38-ade272b5ab06", "comment": "Malware payload", "value": "423cda13504e28bd3e68744331f13aedd15252af2772ce40997329341f07d682cd231578da5cf738f084a2e97dc3b14d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926855, "uuid": "ab62ea5f-d22b-4246-a52b-e08e4fbfd21b", "value": "T1638412822390DD96E66A9A31DA755CF2AEB62D16C661074737403F9F353B3C01A2BF13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926855, "uuid": "f92dccd6-ffa9-4f59-ae0e-28c99a7412e6", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926855, "uuid": "0b21ba24-03f8-4ab1-a098-96addc93857c", "value": "6144:SPXUVQiwqrcTSBp43Fg7XFWjiFyItJyIp7+x/CXm6QS3j5eA7zvbbN:rxrcTd08jiFyopixqXlf53vbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926855, "uuid": "08bc4a01-e953-424e-b07d-fbf0220d88fb", "value": 381352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926855, "uuid": "ad59639e-5049-4943-95fd-62d71149872f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926855, "uuid": "671cccf6-23dd-48e3-92a2-cb2f326a0609", "value": "SOLICITUD DE COTIZACI\u00d3N 020823_PDF_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124ac7b4-a82a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675913416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913416, "uuid": "4fbc8060-1dfd-4bf3-9abc-1b55db24cea7", "comment": "Malware payload (Amadey)", "value": "33d4da719435cd26e8f4fbf13dcfbe4a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913416, "uuid": "8144ffe1-64f4-4f04-86c7-b07b98881ce0", "comment": "Malware payload (Amadey)", "value": "a5c686973984d42e51cc740341ae35f83dd91cf9b6a41a7ec495307d964a4dab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913416, "uuid": "619a0084-4c0e-4530-a13d-f1832ee594d7", "comment": "Malware payload (Amadey)", "value": "3e575528f377cea8093753e689c8cb62ab122e8e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913416, "uuid": "228c80e2-90e3-4d33-aa31-01839be71a3b", "comment": "Malware payload (Amadey)", "value": "6d3230b99c2f6347948039602a87e6db2ef43a628644d7798462ab2d536a8399f14e176d5e14f61d8a24dd3aa2212696", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913416, "uuid": "5d6f4a17-ac56-4d59-af11-faee2935d2ef", "value": "T149C40207AAEC8462D4F657701DFB02D31A363DB05B3882A3634F6D5E1C712B4A635B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913416, "uuid": "9e6533e8-5be0-40c7-9a24-26c1c7675145", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913416, "uuid": "99e2561d-b328-4662-9c57-689f8c38309e", "value": "12288:DMrQy90+Rm0lTVNwbpPJMrXBUbrvuo7XG8X5wHpX:ryPRm0lvmp4X8vuobG8JSpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675913416, "uuid": "2279af63-4328-4a1c-a5f4-4ddc1f311773", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675913416, "uuid": "f604f38d-bba5-4070-8c8c-90496613b389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913416, "uuid": "f01fc0c6-3624-40b0-b597-8e4b42b43170", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50342ac-a860-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675936855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936855, "uuid": "2a6623a4-01b1-41ca-90a6-f78055a14384", "comment": "Malware payload (NanoCore)", "value": "26ecfdc4d53c0b4e7c0c953947bdfd42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936855, "uuid": "74a8e74c-a9d3-4909-bf09-aada9ad79b9a", "comment": "Malware payload (NanoCore)", "value": "a5d16ad0ea483a7970de039d7b194f79c7848b230da509527a53843b6e4e6f76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936855, "uuid": "dedd48e7-99bf-4360-9399-e9ab32c9875c", "comment": "Malware payload (NanoCore)", "value": "21cb73277c624c63c51121c6a8f5da6bc3dcfb73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936855, "uuid": "36f1a71d-6629-4be2-a5d3-a218944ef760", "comment": "Malware payload (NanoCore)", "value": "f1b62589811a077e9ef3895732ac5ab6d646c9ad3e2b2324e2bacec005eeca543c1f346caadc8fbaab6bb77c5928e0f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936855, "uuid": "ca5237ff-25ef-4eca-8236-cff40d7ec166", "value": "T14D158EA337B199B2E78720B10434BB985BF17503BE16D2538BBB37C0A785DB77298152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936855, "uuid": "d3c6d4aa-0612-48be-8b7f-88394f56d7e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936855, "uuid": "22566d4b-5c71-4b5b-b426-90b4c90b4c7a", "value": "24576:SeSqG4yPawLvWVZSgiYhS1rH/TK8DCpV6F0xM:BIvsZaYhS1L/GcWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675936855, "uuid": "e3a50ff5-2dce-4523-b446-b58faba7c3d1", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675936855, "uuid": "eadb5f77-c722-482c-9ddb-c63775ee8234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936855, "uuid": "c41445f2-a76e-49db-884c-7615dcd8b528", "value": "26ecfdc4d53c0b4e7c0c953947bdfd42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe784cbc-a860-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675937005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937005, "uuid": "17b3ca08-41f9-4f4b-a902-66eb263032c2", "comment": "Malware payload (Amadey)", "value": "26b34505061488c8df6b74e1f483627d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937005, "uuid": "6639c71c-7216-4bf3-891d-13c6ddc7ca2a", "comment": "Malware payload (Amadey)", "value": "a5e46b27bef409be3cd5c86352417bfbdfa2a2419e63635743ee18b8b448f17a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937005, "uuid": "434b3efc-1b9a-4272-b19d-203e6bddec61", "comment": "Malware payload (Amadey)", "value": "d0b61463e96b545515ec75549780dfe0cfef3e28", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937005, "uuid": "4710fec0-5e7a-42d9-bdd5-78f0db478b3f", "comment": "Malware payload (Amadey)", "value": "6ec14d9c1b30f585b4d44b04589c50747b31938f80a82efbe7ede847147892c82a38634b000df47aee731ae5c223a072", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937005, "uuid": "b8c40e0b-e843-4f67-adf4-06429e582cd3", "value": "T19DB40207E7E88132E8B857B019F607C31736BDA15B3483DB628FA9591C325A0B67177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937005, "uuid": "d3c9f37a-653a-474a-ad0a-35c6d612cc61", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937005, "uuid": "09d171ca-4772-45c1-80b4-d52dc852cc11", "value": "12288:/MrTy90CW2lTAyAmn5C2FTvw5WlcPZz/CKsAkHGB9v:8yGc15bMWmP9/JsL+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675937005, "uuid": "9af714be-0f08-4a8a-ab3c-0ca1c2cf7d32", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675937005, "uuid": "2a0618ea-1517-459e-84cf-4dc876bcdc0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937005, "uuid": "58ee2424-b40a-4ae4-9d2d-c39c6ce1623b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98126633-a87c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675948859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948859, "uuid": "d5a9e139-f3e8-4008-8cec-7b3cefa0e4dc", "comment": "Malware payload (RedLineStealer)", "value": "ef8079cf160510d0da7162bc08f753d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948859, "uuid": "faeaacbf-e7b8-4b0e-a2ea-36f25aa16063", "comment": "Malware payload (RedLineStealer)", "value": "a6416ca607f03e7d02dd9c8b546113c71f421c0ba8438dafb941d25f8cf2c9e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948859, "uuid": "75e1779f-4780-49b1-888a-66911c375ca8", "comment": "Malware payload (RedLineStealer)", "value": "e786cc8bee83e4a37433ddccf9d3540e1f6533fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675948859, "uuid": "e3b95700-b18f-47f0-be0d-98a443d13169", "comment": "Malware payload (RedLineStealer)", "value": "5b4903178155ec091c59e0b112d444538098d17b1db5b141ccca65cd6c161e8e05a0377493a454d5065653bbd77e9412", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948859, "uuid": "0162ab98-415a-4165-adfa-045a5d7648a2", "value": "T13304C51437FCCD11E1BA6A3F6921A05146BFD8026842F65B76C367CD1E32B40FA57AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948859, "uuid": "fbe0916b-8492-4191-901c-cd9c59cd3308", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948859, "uuid": "61583e55-f574-4002-b29d-8da0b4b80775", "value": "3072:OxqZWXragQx+/pnab8PeR5D+hb/xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuD:0qZWpnaQC+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675948859, "uuid": "bfa9105d-6d64-4daf-97df-c7ba74c36566", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675948859, "uuid": "9198ba4b-4cca-4c3e-80ab-cb58e6e66e6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675948859, "uuid": "1c6ce7c7-1cd5-4e17-a069-9e1eea9b704d", "value": "ef8079cf160510d0da7162bc08f753d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5c50b2-a849-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675926967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926967, "uuid": "c34fabe8-035e-42f8-9ea3-b40191c2d0cd", "comment": "Malware payload (RemcosRAT)", "value": "943153fd3c3ed9d114e9f178c9f0693c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926967, "uuid": "4c5e8d7c-d2dd-432a-a1a8-564ed56407bb", "comment": "Malware payload (RemcosRAT)", "value": "a67d4cdb218d6e7106b4efef10d24fdd69025b556df74549921e3d4156201084", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926967, "uuid": "8e0e5b9f-b244-4e19-a8b7-1b6904b1fc9c", "comment": "Malware payload (RemcosRAT)", "value": "0f348594c321c9ee44f07b9abe0bfe97479c5c49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926967, "uuid": "ebd15b76-8f10-4a40-adb0-09ceb6296e27", "comment": "Malware payload (RemcosRAT)", "value": "be3e5760aca9c3f5c305c783b1d3805d0c0a6efc94aea09523f982ade2702896ab30115e304f66f5570093c0e033bfbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926967, "uuid": "6acdb334-b807-4b8d-8680-c1de3676dc02", "value": "T16C553FB0A8BF45D6E00FC9901AFCFCA501BA75F3DED60DA5436C76445E3AFA86E0150A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926967, "uuid": "8bd6f6af-fe35-43c3-b061-da4bce98a8b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926967, "uuid": "ff2936cd-13f8-4c58-b93b-0d4535946094", "value": "12288:YutMCnSOSepN+l1vVG7euwvv/+VnSXgoZkWv8yx:5oZkq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926967, "uuid": "2aeeb08d-ca25-4d68-94d6-f1120d422ff7", "value": 1392640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926967, "uuid": "210c4248-c411-40a5-a776-9f9c1a9132c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926967, "uuid": "495c9d45-52e6-4c9a-b90b-10b37b574350", "value": "Gqlba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d2ce76-a84a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675927307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927307, "uuid": "5a1934a0-8518-4907-8177-53c99de36ce8", "comment": "Malware payload (Amadey)", "value": "8fb2dfdafc3d3e269230668fc083dba5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927307, "uuid": "d4dc1723-d705-4a3f-9876-3c25f428900f", "comment": "Malware payload (Amadey)", "value": "a6b54b067fbff96bf6f79542d414ca7753a1d7eae408cedfcad2652e68c1b758", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927307, "uuid": "c79f0210-aab3-440c-b8c1-39908eb6863f", "comment": "Malware payload (Amadey)", "value": "2f2a14264250483b80f84ef09db9d6ae5ff1375f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675927307, "uuid": "17d2da6c-6aae-4dc1-b78b-7b182be2f055", "comment": "Malware payload (Amadey)", "value": "b7e6d5ed5e1c851240572b76ed27ec1c0e1e4f61b7519f1ad191daf6d3bb5439dca0593dc99d105d74cc59d1be4a22a5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927307, "uuid": "afa69bd8-49fa-471e-b748-295753676864", "value": "T1F5B40247A7EC9072E5B46BB019FA02C309377D609A348797378EAC1A0CB35A0B635777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927307, "uuid": "11a2096e-e112-437a-93c6-dad293a20e4e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927307, "uuid": "22c044ee-c40d-45d6-ac68-800fefc4708c", "value": "12288:xMrfy906VirfxZrjnSNlAHbPNfWS8BtUL4Yu8KHL:Wyxs3jguVfJ8BthrHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675927307, "uuid": "6855f090-93fa-4cb0-84b1-f522451b928b", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675927307, "uuid": "d67da6df-9d0b-4962-a1a0-5ad2bc63184f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675927307, "uuid": "1cb899f6-4f99-4962-aa89-35fb440d5679", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97aa7fdd-a852-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675930820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930820, "uuid": "621ddc17-594c-471d-aa38-da5471d3eee2", "comment": "Malware payload (RedLineStealer)", "value": "c20915da4dae63d07eba18a79a8ee4dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930820, "uuid": "57100453-a624-4b6d-b738-8f34efb88425", "comment": "Malware payload (RedLineStealer)", "value": "a6c31aacfd3ce8844f424f33a967179e8f7245438152cbb2a43be6e9727aef94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930820, "uuid": "e3d2f7cd-7c82-4f9c-9b2b-f5fee35ef812", "comment": "Malware payload (RedLineStealer)", "value": "791f2a749f336a2f37a14cc822ff5ea329076bdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930820, "uuid": "cdb7edf5-859c-4724-8236-e0eaaf22ab0c", "comment": "Malware payload (RedLineStealer)", "value": "b36e2cff6269b3f2a0d723d883bef3b8511f9193bb580ae3e6d1715d936a626fbaa55b3d761ebbb88913adadf48c1304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930820, "uuid": "30e1e971-45f2-4b79-a773-f930672b384d", "value": "T19D945C03D2917D82F9658B769E2FF7E8764DF9608E4AB7693228DE3B14F0172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930820, "uuid": "c833652b-db8c-43a1-b4c6-23cf5b8c61c7", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930820, "uuid": "f0b32750-4d8d-4488-86fa-171ab5569a89", "value": "6144:Kxyr5dhEouducha31rGnW2Hzq+yUYobXQ6Liqsv:KMldhtudq1CW5+PYozQS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930820, "uuid": "a874a86e-5e1b-4c54-8152-8c8468384d42", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930820, "uuid": "962e6aa0-ecbd-4e39-afeb-1e2c56bf53e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930820, "uuid": "799dd98d-069f-4032-ba82-21fe1e526fbb", "value": "c20915da4dae63d07eba18a79a8ee4dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0e663f-a8a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675966393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675966393, "uuid": "7bd73940-bc76-4983-9008-4003edebefd6", "comment": "Malware payload (Amadey)", "value": "e653aa71281c048a34f105770ecb8641", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675966393, "uuid": "eeaa5d4d-cb79-4f32-93fb-b8e1111acbad", "comment": "Malware payload (Amadey)", "value": "a723fa9c8016e008001e77544eee05377088b1886300b4406e7c7102a75f6e29", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675966393, "uuid": "28f08231-cafd-4b08-ab59-706c5851965a", "comment": "Malware payload (Amadey)", "value": "ebf0436526fdf707d82106b27718cc092c3b45b5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675966393, "uuid": "7b20ad6c-1b01-495f-8002-a25d25537777", "comment": "Malware payload (Amadey)", "value": "c5d64800dee970bf0dbffd8afe6b544467db7137b9b24cca53947e87f5e415553381a0915205663293038274eb7ff10a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675966393, "uuid": "42af777e-9372-4168-9433-aae0a6da46e8", "value": "T105B4021BF6E89032E8B0177018F707C315377EA09A7856BB174E6C5A19735B4A2327BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675966393, "uuid": "761c424b-9f64-493f-9537-441c61a5c786", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675966393, "uuid": "0c2db2aa-57fe-43ca-b26c-310d146210d9", "value": "12288:BMrzy908HES0TfjvPFzH3CNmJuXh7e0ns9BNVU:+yFES0TT9LC4uxK0nsnN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675966393, "uuid": "5d36fd9f-8ea3-4c2d-9bf6-acaa29fcacb5", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675966393, "uuid": "0366ee5b-abe8-4a03-a8f9-4d4a2974c71f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675966393, "uuid": "229db509-5c04-418f-8428-2793547c1b6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee026762-a8bc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675976491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976491, "uuid": "10adc3f3-79d8-4350-a1a6-18129cf07192", "comment": "Malware payload", "value": "de948d641f21b845e2bd9c7ea296cbbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976491, "uuid": "5a925d44-dd46-4fad-87dc-d58381dc36b9", "comment": "Malware payload", "value": "a73fe13dbba080dfb86b8c6af0cf91458dcb8a0ac0bc41b6078895c1ab8a7a2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976491, "uuid": "2e58ac34-248f-4b52-b42e-e9d45c126c9d", "comment": "Malware payload", "value": "d5071572f830cffd966d58271a59c53d58d19274", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675976491, "uuid": "d44ec896-b487-4a2c-ac3a-6e2dec4d60e4", "comment": "Malware payload", "value": "687bb32f4b016653ef11fee5c403cf1908ab2189d9c7a18142680fda7565a154ff5200032a613702ffb8a89e517aafef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976491, "uuid": "b3491e89-c020-4951-9f24-72c4e6dae9bd", "value": "T10464E132B7C0D432C462F631AD19C6E56A7EB4205F38A66737183A3FAEB02D1D676315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976491, "uuid": "25abbe3a-ccc7-4a42-b7c4-b207077ddd33", "value": "3ae714bb16df7ea6110fd4db3c856d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976491, "uuid": "6b9248c1-a36c-4aab-af92-cbdd666a0536", "value": "6144:YFVR9yhRXAEYY2hH7xVPW8BiKAjwsV5/uPR2npH8Ar6zOidBqsXDOSa9p:YFVm7X6Y2hHjPWNKAks7/uupHPrqOi5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675976491, "uuid": "ec6ee69f-d371-4590-a195-72f3cbb854b1", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675976491, "uuid": "6ed56a44-6e8b-4464-bc50-f0987741355c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675976491, "uuid": "7be4ace8-88f3-4901-a0f3-0ea0ae7ae91f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360011c2-a8a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675965875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965875, "uuid": "7741dfb2-618a-4030-8a05-e6ff6763b5db", "comment": "Malware payload (Amadey)", "value": "630979676ac160a41fab32b88249429a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965875, "uuid": "e449ccfa-6c57-4b4f-9235-230fdd6bf453", "comment": "Malware payload (Amadey)", "value": "a7d16fa17486004dba668010b5f2666e03c4405d714e937bc6357cf30bab4ec8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965875, "uuid": "0580da5b-5959-4169-b358-7b4d666d38ec", "comment": "Malware payload (Amadey)", "value": "8a9f227bb4ee1aae6c6e766bb25bbb71597be4b9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965875, "uuid": "6f23b1eb-ba0c-4adc-979a-97fad0751ab4", "comment": "Malware payload (Amadey)", "value": "85026070c84836094c9504ba132e04e749922e442a51e84846b2b64a079a8980b8747fd0d5578575add5e5610eda4e7e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965875, "uuid": "ca9c07a2-40a9-4d51-90fd-816e640624b0", "value": "T1DEB4020BB6EC8032D8F167701DF203C31A367C716639539B278E6D9A19726A4E27573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965875, "uuid": "d21cc8fc-8082-49b1-878f-1fd5b00a2988", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965875, "uuid": "b7a91e7a-cca6-4572-a006-94e9c6b1ad01", "value": "12288:LMrwy90vN4pDQD9vHMK4EBhVCNyJ2XhfJeHspu4on:HySN4Vu9vM0B/CM2xh1pu4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675965875, "uuid": "b2b91970-e8c2-472c-bfec-73b7185dd1fe", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675965875, "uuid": "29e5fd0c-3353-4123-add5-798f022e789a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965875, "uuid": "c88d856a-a0d5-42d9-a234-94e3ab5aa764", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc742aa2-a8cd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675983737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983737, "uuid": "9a37c6ab-d940-4278-ab65-fbb3df22aa12", "comment": "Malware payload", "value": "6c011248cd869aa8bda11871c8327170", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983737, "uuid": "d092d946-6fa9-4423-9087-0503aa4280db", "comment": "Malware payload", "value": "a813247cfcb4adb5f41472c86e5fa840469c3bd70ee390db986c32a8ec0e73bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983737, "uuid": "186a41b4-7686-4193-94f8-6d0b2bd239d8", "comment": "Malware payload", "value": "83824c1af6429a9d898eec38fcbc973be533b6ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983737, "uuid": "593bfa79-b0dc-420b-8717-fdc17a872220", "comment": "Malware payload", "value": "4f6543feeb74fdf4d0443fb5fec25a2357a90a834eb29d43b1584ba68227ca14bbaf54679b652ce1857eed1d2c6d892a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983737, "uuid": "b2de7b01-3eb4-4dfd-98ca-6a5260550837", "value": "T14DB40207E6EC8133E8B557701CF202C309367DA19A34D36B268FAC5E1D726A4E63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983737, "uuid": "816697c4-7889-4d02-92d0-151620142874", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983737, "uuid": "0fe031b4-3a5c-4937-a459-d3b01956ef97", "value": "12288:tMrry90Dg68lRUU3Cgv/i13diz6D0YMEvWxvV273bBzLTCn:Ky6g68lRCgvK/iU0Yc92pTCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675983737, "uuid": "e6c2bab5-5199-4cd9-9e0f-e7d92790f7c5", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675983737, "uuid": "84fb5b97-9d92-4e78-8144-712cd71eb428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983737, "uuid": "0d086b58-aac5-4ab1-9c6b-89f7f0a7f92a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ae15cf-a863-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675937907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937907, "uuid": "505a7b09-8884-4491-8e51-65d2e64d1ee5", "comment": "Malware payload (Amadey)", "value": "dfbfb5f1ed392e837bb240dc5182fa3c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937907, "uuid": "72fb9921-8a2a-464f-9370-55b9410c0fd0", "comment": "Malware payload (Amadey)", "value": "a922a4348e073dcb0caacaafea0324cc397e4c638dac759d478b9d8201124787", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937907, "uuid": "ef15621c-2975-4a10-a039-0b35ad7de021", "comment": "Malware payload (Amadey)", "value": "bf9fa138f1e2821d6898f350c4e207b563fc98bd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675937907, "uuid": "9c5446cd-a756-4eb3-90e3-dbd1b2633a70", "comment": "Malware payload (Amadey)", "value": "4fea05803175a515f7ea9edcb0cd502a6c3a57bd421b33f15f4cb06dab5d042ed0c3bbbc02324f23f49cac86202ba5a1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937907, "uuid": "15c70fef-e42d-4ffe-9de6-2186865b34db", "value": "T187B4020BE7EC8032F8B5177059F606D3263A7D516B388797264FAC591C32AB0A63177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937907, "uuid": "5532604c-96bb-44b4-bdb9-76a456ed1f3d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937907, "uuid": "5436ed4e-efee-4e80-83ca-e3bba4301c90", "value": "12288:MMr8y90aSRLrra356NXIhkcw5Rl3PZz/bK7Ngl6zUw:YynSRLH2ImQRRP9/e7Wsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675937907, "uuid": "af4d498b-93e6-41ad-bea4-01c4426fe6b3", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675937907, "uuid": "f0965504-7fdb-4c4a-9492-9cd4731bbf72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675937907, "uuid": "28e7a1ae-2667-44a7-83b3-524379be0fc3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b835497-a85e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675935739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935739, "uuid": "fd70a440-38e8-46ad-bb5f-d2fb2b0bb2d8", "comment": "Malware payload (AgentTesla)", "value": "011e5d6869b4d65b707781c1bc7c90e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935739, "uuid": "3227c399-3691-45e5-98ff-86ee053a4114", "comment": "Malware payload (AgentTesla)", "value": "a92a2d0fb30ec37a2c3c3fb30a876fa9f1b429396f876434acc2f14abe861df1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935739, "uuid": "6fd0fe56-45b6-4b09-b796-5608e8f99049", "comment": "Malware payload (AgentTesla)", "value": "fa48d1ba3aac5c423de86858b5973e17e447165c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935739, "uuid": "912822da-51c0-4c3f-8fa6-3c75064b56b4", "comment": "Malware payload (AgentTesla)", "value": "f9ee7635837bed728f11e4da841eb7adb92745385ef82158d70db3b167b170514618cbdf8eae9b2ede0ca8180f6176fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935739, "uuid": "a364df18-e86a-4fb8-bdd8-01f54c52cfbe", "value": "T128642396038A6670203680F95BF475747230AE7A30ECDB2557B7E0B0B9AC925E25EB35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935739, "uuid": "b18d93ec-48e1-4c82-b5d2-0bd075878e5e", "value": "6144:ZStmVPVsVK5HuGUhJHm9X1PKOC7X0rQ7TldA23Axw9HR+6QEyjNgJCAzk7bW2S:ktm3sUtV5FPKV7pd19HzEtj3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675935739, "uuid": "51a44916-2ae3-4937-9dc5-b4bf97c1311d", "value": 319149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675935739, "uuid": "dcfcb37c-ffcd-41a6-a772-ab753e04033f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935739, "uuid": "3f520473-bcff-493d-b370-9f054656e117", "value": "BL-SHIPPING DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0fecb13-a815-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675904770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904770, "uuid": "df39713e-1c5b-4b8c-9897-9b6bf2114156", "comment": "Malware payload (Mirai)", "value": "17d6f60c9eef982e3f697296bf07b8c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904770, "uuid": "3b7e8872-ade4-4d47-804c-ca0f3a76e35f", "comment": "Malware payload (Mirai)", "value": "a95e6c1f77c27a8a702d7abf0f253d3d46ad5342464fd8cad1a75d33bf94f044", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904770, "uuid": "588688af-38aa-4a6a-ac86-0abe9e77a92a", "comment": "Malware payload (Mirai)", "value": "7decfb795d5eb48a3c019739b9d1c73c0a9b6873", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904770, "uuid": "0c8350b4-a16b-4a0e-bd12-5d74595c103e", "comment": "Malware payload (Mirai)", "value": "09c9a155ef44658e723d7c273008b7eef88049976b08c94aa603619ac56edf61bf5b0ed2214893c877ad9d8dd322aed0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904770, "uuid": "bbb3cec9-aa00-47e6-935a-7210baadf709", "value": "T12F045B46E6408B13C4D32B76B69F9285332397B9D3D7330699286BB43F8369F0E63945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904770, "uuid": "a477db11-a225-4071-a1e4-29fe819da47c", "value": "3072:YtJsDS53y1m7OajK2QVAOmWGmrOt5ows+ifQ1zM/922CmhwHox1sF:Hu+SOajK2QV7mWKt5oj+iYJM/99CmhwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675904770, "uuid": "29bfcf7e-33e0-4d0f-9336-57085ea61c66", "value": 185107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675904770, "uuid": "1e15a990-4bc6-4957-b9c3-a3d2a3d2dd4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904770, "uuid": "3bf5c78c-bba6-42de-a089-a82b17d044fe", "value": "17d6f60c9eef982e3f697296bf07b8c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a1c1cf-a814-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675904297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904297, "uuid": "13da47bb-58b8-4cf3-a8e4-202eb3c158eb", "comment": "Malware payload (Amadey)", "value": "d3d31bfce25aa8e5d8cddae98d6ffe51", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904297, "uuid": "b76cd3cb-9905-4b23-83b1-a3dd882e595b", "comment": "Malware payload (Amadey)", "value": "a9769bf93b6c0c650c4c17416af195bf47bc3a0451585e25d20ad826aa1a7304", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904297, "uuid": "f5865a3e-667d-4f92-adaa-60de1d18f286", "comment": "Malware payload (Amadey)", "value": "d00d62b4620a01fc9044ee566c707fc5cfaede3b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904297, "uuid": "bf464b29-5bd1-419b-8faa-327c7a0f4fd1", "comment": "Malware payload (Amadey)", "value": "ff2815fa85a3b909b94e3064e18adae8f24e40e012df5513a987875b51da21226ab9056af76f55ee94fbc59e872ea2f3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904297, "uuid": "ced56133-8a24-4690-a252-345c6d49f57c", "value": "T17FC4024BF7EC8132F8B453705AF903C30636BD616B38879B264A6C6918B26B4B571377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904297, "uuid": "10ce646c-2df8-43c6-ae65-00e23ef8de1e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904297, "uuid": "1c3c7a99-23b2-4f18-ab1e-175ebffc55e2", "value": "12288:5Mrjy90JWsTTJo4ElLg6jF+mUf2Jt8pQ8jVdkJcg8NLcdUf7O:uymW40k6jF1gCtundkJcg8xcmTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675904297, "uuid": "fc0c217c-0461-4a1b-80ef-9b10d53ea793", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675904297, "uuid": "02d8959b-0763-4c28-afef-1c28b6a1df80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904297, "uuid": "8bf6d12f-0576-414e-b6de-0da33585c8dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4ca81c-a80f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675901944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675901944, "uuid": "0339ac51-4bd9-4996-9751-f8b3d5819dde", "comment": "Malware payload (GCleaner)", "value": "5b401e5528c19c52f55947ec0ae42166", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675901944, "uuid": "7d9d7fa1-e32d-4705-9805-29badec89955", "comment": "Malware payload (GCleaner)", "value": "a9d96c7829619ef3813a775687868c76d697888b7cbc9b689c936f5e562d82e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675901944, "uuid": "36aaca41-5ce1-4927-9dac-d464f2f4ba7f", "comment": "Malware payload (GCleaner)", "value": "7ca034c3ab00af1f4e9e9f65e288abd9bb39f5bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675901944, "uuid": "0d53e138-4746-458d-92fb-35e7484b2877", "comment": "Malware payload (GCleaner)", "value": "a8b2357fe9398a38e610772e64310cfe9278c8cc62b0b76b7d90e7d90a021f74b2fc9baea7fd57bed8a33617c2af1950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675901944, "uuid": "1d9e3d79-fae4-4376-970c-a4e4b51a0ceb", "value": "T146C5127C7145C56CD280FEB88C3A98E75CDA6EE3E9E49062B0CD7F3F52792859A09143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675901944, "uuid": "2b2cbadd-f14b-4435-9d2f-428ed50db0e5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675901944, "uuid": "f3505232-b9c4-40c7-ac52-d2073b826182", "value": "49152:rdHGaWcgnBBON4Tw9eVpcaza9yEJKH8MezGDixM/OT69c/QWzaTLCgv2MR:JHR+PONhacwEO87aDixM/Owc/Jqv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675901944, "uuid": "5845addc-4335-4b8e-bf22-b632b2515e6e", "value": 2674788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675901944, "uuid": "fa7ee910-5eb8-4b55-a9d0-ec67a8f7d5ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675901944, "uuid": "34769d87-19ed-40d7-aa65-cd6eaf7f8b09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07118a04-a818-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675905666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905666, "uuid": "e797e1ea-2926-41a7-b88e-484353185f01", "comment": "Malware payload (Mirai)", "value": "bd34608dc0a450789fa0070c90e7825a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905666, "uuid": "eb361103-746c-482b-afc2-628b91d7735b", "comment": "Malware payload (Mirai)", "value": "a9fef749ae58218d23b55fd05d7cef2864b8b24de05e784ca0e597dc99b9f059", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905666, "uuid": "d231007e-752b-4eee-82fc-4d4fbdc73d3e", "comment": "Malware payload (Mirai)", "value": "02833bed861d6bdfcab56037db08e2d45105de5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905666, "uuid": "244be8ce-f261-4cd0-95e0-d0cbffef1f3a", "comment": "Malware payload (Mirai)", "value": "2c402c81bbd1776ef89480864b76485a8107fbc7760757816a3e5ec78e7909c436e2e66a929fc0e5f6040cead130f1c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905666, "uuid": "9dc030e4-9372-497b-8ff5-a4087341cdf1", "value": "T1BDE2E198BC156055C99D8DBBC0B10FA56B8090A107AED78D0372ADD08AF3E4F7BCE066", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905666, "uuid": "79ca97df-dc96-423a-b3a0-6ae834a8b2d1", "value": "384:ZSHLgHJw7U05fD0zsP+GkqfkP5ewpPMn4dMottQqbyJs1PhTjw+kUOrXhRzRWGVR:gHcf09P+G3fkwIM5oiJs1t0vxR9WGPOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905666, "uuid": "84cf8054-4660-40ad-b76b-95b6edcd26de", "value": 33688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905666, "uuid": "74355c73-d321-43ac-a97d-98c278cd492e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905666, "uuid": "18717e60-0b6a-4d91-9436-3f0794eaea3f", "value": "bd34608dc0a450789fa0070c90e7825a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8ea93e-a848-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675926639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926639, "uuid": "9d79349f-749c-473f-991e-d791072ce715", "comment": "Malware payload", "value": "3643a0f098b6f0bcefe84c583c4b5ea1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926639, "uuid": "0ea610d1-2114-4d9d-9911-bbafd914e088", "comment": "Malware payload", "value": "aa2dca2c68a4ed4653a3b9831c1b97f6d9194b66fee691370d69f39fab8021d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926639, "uuid": "ec9efebc-f7a1-4c37-a955-891a63f0361d", "comment": "Malware payload", "value": "d118537785658cda1b0ae90c0bc91fae42d1b3a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926639, "uuid": "48549ca2-8210-4f80-a1e6-07fcdc2810b2", "comment": "Malware payload", "value": "54020d9a90001c4859742a2a7969c691401699779089dd22eae6f9fde0e34844d4b30197e82b8e8e3d433afcf901a64d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926639, "uuid": "7d7ae191-cab0-4f74-b5ea-9255050616a7", "value": "T1787633A03CE486B0D702057785A96CFDA2F6E3A80E50185372AF427DBDAD5E78D37E41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926639, "uuid": "8f365bb7-18d6-4e9d-b51e-ecda547fa7cd", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926639, "uuid": "05db28ea-d301-4616-9f46-79214c917c13", "value": "196608:91Okxu3IW9yE8ylmOgMnFCjvHOwMZx+av0cnOz7RJV23FV:3OWuBr8igMnEjvO3x+aZ43VgFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926639, "uuid": "df4659d3-76ba-4254-b066-a97b61f2218f", "value": 7606148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926639, "uuid": "1c75ee1c-d0a3-48bc-8131-a2dfb6ddc39b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926639, "uuid": "a356dcd3-8b23-433e-a73b-64e2e2f36d17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc49ae8-a884-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675952281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952281, "uuid": "aa2d4111-460c-46fb-bb9d-b97760478115", "comment": "Malware payload (RedLineStealer)", "value": "ab996d5b02f6f125f5cfe2b15a810a34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952281, "uuid": "28054dfc-7a93-4757-b6e1-a82f5db89770", "comment": "Malware payload (RedLineStealer)", "value": "aa8b2be4fc7f54a1f4d5b98c50339db3e72438919305251c29b5a379f10d9315", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952281, "uuid": "5843b903-8817-4bf9-803c-aa7a9a377b08", "comment": "Malware payload (RedLineStealer)", "value": "62be350e5491b392ecca94e31e84aca345d0edd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952281, "uuid": "30c2850f-c6bf-4cdf-8c9d-4e29963db252", "comment": "Malware payload (RedLineStealer)", "value": "c00d16199f93e9dae43d7315391a0ff3e18088e93255492b9c2715e276db8b7803b3d97adeb7c87e5cd79033ce5ef946", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952281, "uuid": "c763d59d-997d-40b6-b7c5-1bf69e846470", "value": "T1B8B40207AAD88032ED751B7019F303C31A357A906E38876B374F3D5A2C725A5B6357AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952281, "uuid": "1289e656-7656-48f7-ab5e-e1e47921c1c2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952281, "uuid": "7e82e83b-54da-48c5-9f55-d421a25893f2", "value": "12288:lMrFy90Ew/NnQrIs3MWmhk8ddtqMA9Q7vjzDLfkxC:8y0nY3MJhk8d7TASnzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675952281, "uuid": "ab837f1c-f507-4945-967c-5c82097b2cc5", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675952281, "uuid": "0c8991d7-9e1a-46f8-96d8-b12db0bfb531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952281, "uuid": "0bdeb007-9827-480d-bbce-a92e62859493", "value": "ab996d5b02f6f125f5cfe2b15a810a34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30f97cf-a83e-11ed-88f6-42010a9c006e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1675922303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922303, "uuid": "92bff23d-4d87-4293-8fef-18829c263f0e", "comment": "Malware payload (CobaltStrike)", "value": "d9525642be84f4e5862e89861ac364f9", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922303, "uuid": "fa57d6fd-4446-4c48-8511-5248cd513517", "comment": "Malware payload (CobaltStrike)", "value": "aaf30ddd3c33e3809c71004c47629fc9d5fb7d367b488e89e213731a0ea0fe2f", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922303, "uuid": "792de206-e801-4bd6-9c03-242f2b612888", "comment": "Malware payload (CobaltStrike)", "value": "d01d2b4fdca546ab8462b27313cbb4ac5cea364c", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922303, "uuid": "4327deb8-832d-4eab-bb6e-0afc0b0136ba", "comment": "Malware payload (CobaltStrike)", "value": "de61d2384cab6a899f27fa5515f7520eeba79e880ae6cb961c22266cd13dfb8c18dd3f8a8fd1a869cafde6d305e4301e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922303, "uuid": "a464360f-c967-492e-bd11-7fb9817a1c4d", "value": "T1DA768C12BCD514F6CAB9E23285A2935136327CA547393BCB6E44757A1F32BD82E3E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922303, "uuid": "9a3f32c1-63a5-4386-b0e8-7495ee8bc505", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922303, "uuid": "f63ec5ca-1871-4586-9c2c-43b452e06e95", "value": "98304:9cCaNWvnWkIilNMhvJn/uvDTZ6jmCm84U9:9tcWvvLlNMhvJmvPv384u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675922303, "uuid": "d57a8518-bc9f-4d20-a186-bd0108fad61c", "value": 7222784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675922303, "uuid": "0a79100b-09d8-4c39-adc9-7a988ceb313d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922303, "uuid": "82c698f4-c07a-480a-ac09-6063424e9695", "value": "qwe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700abf7e-a852-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675930753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930753, "uuid": "c7e7d722-7f2b-4a41-8a60-949d84f0af5f", "comment": "Malware payload (Formbook)", "value": "9896ae3f066dd4344e46da75d4a3ede7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930753, "uuid": "9a5f78b6-28b1-404f-adce-768e9319cabd", "comment": "Malware payload (Formbook)", "value": "ab29ef95908c5f4ad5acd6dd35f3fa8e5bf788c4cfef602324737b5cee0c00ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930753, "uuid": "6e995f57-6181-4cb7-8d52-109d9695aecf", "comment": "Malware payload (Formbook)", "value": "8fc4068116ef806a26f8a425559a34b21d748ecf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930753, "uuid": "a6edbf80-f450-4650-9c4c-cac7ee9094c1", "comment": "Malware payload (Formbook)", "value": "a06bc49cec0e4e446bae6a11fdb0f9b74d5c78175503de55e697df01d19d8b46e088541307d274230c1c01bc1c55ec5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930753, "uuid": "70136e91-1efd-4f71-86ce-233539fdc9a4", "value": "T1A964231837A1E177C86605329A395B252BF9FC161AF49B8F73049B3E76336418A0FF51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930753, "uuid": "cfb522e1-2f6d-4896-acba-ecb03cee4076", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930753, "uuid": "be90aba2-197a-4822-aa7d-5261de0d7114", "value": "6144:/Ya6R1N7ftsDdxHa4cfge4/3LjEjz2dZ0jmBZE2QdpF4si2+IrLbvDah:/Yr1N7fsdVa4cfgeI0v2dZGeanF4sRlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930753, "uuid": "fc2e3e98-cd7a-4887-9aab-97091b6faae4", "value": 316124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930753, "uuid": "f1f1fbbc-b809-4b67-88cb-1e891c9d5e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930753, "uuid": "386d85b7-c285-4fe7-815e-efa0f891833e", "value": "TT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d4607a-a856-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675932500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932500, "uuid": "d0c210ce-929e-4ca5-8895-5c01edaf1157", "comment": "Malware payload (Amadey)", "value": "352c1315efe9948cbec7e98feb6a1140", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932500, "uuid": "6e594fdb-ff64-4f44-a202-a41e2baa1a59", "comment": "Malware payload (Amadey)", "value": "ab403607a05fd452777b688db1b3226d7e4cb67e9ed0d01964ab9acd8e3bec4d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932500, "uuid": "f2c013d9-9927-4fd5-8eff-c8b4360dcc37", "comment": "Malware payload (Amadey)", "value": "57c9d2e77edb38a5c30c069ad9439a798b9a80a8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932500, "uuid": "dd45943d-23c2-431d-b946-b13df2f099bd", "comment": "Malware payload (Amadey)", "value": "438f9093044122e3787c79a61a588d35ab187af48f71993dded1ad1316813f48a76604204c54528e1713c12a758cd40d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932500, "uuid": "ae903f22-abd8-4a0c-ba87-2098299a7e59", "value": "T10AB4021BA7EC8172E8B5577019F603C31A367C616B38839B274F695A1CB26B0B17137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932500, "uuid": "bf32176b-5adc-4a45-ba35-f15f5fd5d765", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932500, "uuid": "d6217804-cf45-426f-84e9-e4314cccbe8e", "value": "12288:WMrry90I2BJaDwlowYpmd6EOVhS1uWmMY3wMNWoNyiO:hyZ22YOmJuWWwMNWqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675932500, "uuid": "c5888760-2fac-4e88-b49b-072b70e49019", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675932500, "uuid": "8064851b-1959-4ee5-bfd5-015eb2311f45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932500, "uuid": "1f04d235-bda0-4ccb-b99e-3964bb9e6104", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800fcb49-a81a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675906728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906728, "uuid": "8fc44d81-0af4-4fb6-8d5d-b37413bac87d", "comment": "Malware payload (Amadey)", "value": "7e2d7cb81e1e6e8baa63c323d6e3eac5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906728, "uuid": "f8c52954-2724-44c3-8b4a-e95156095d61", "comment": "Malware payload (Amadey)", "value": "ab52149f206cf44fd2c654b489a7e86a8b331826f110b491007bd1dd2641d65c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906728, "uuid": "f5300c7e-04b5-4bf3-aa30-51b7b1361e42", "comment": "Malware payload (Amadey)", "value": "841cac89200e3be6163e67e7628f74e6069eba09", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675906728, "uuid": "aafc7201-19a7-4c4c-93fb-dd970055e3e4", "comment": "Malware payload (Amadey)", "value": "929f34707d092ba1081478c079dcdf163c5fd805029ee87ac6a12a97b43e96d8da9419f08367c7b84a0eff1353922882", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906728, "uuid": "dabf8c03-e325-41f0-b642-2e05935e63be", "value": "T170C4125BE3E88033D8755B704CF643D31637BEA1563483AB674E9C4A48B36A0A63536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906728, "uuid": "2592f20c-7e0d-4de4-b39e-7b36e66bb763", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906728, "uuid": "81a6d07a-40b6-47e3-91a0-c3e62433b0f1", "value": "12288:QMrjy90eLSCJSumPxzd9+zed8UqM9iYAbmIaS8gMiB9:jyslP+6e2yo0MG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675906728, "uuid": "d75aec87-817c-4d1f-87ce-d18365469689", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675906728, "uuid": "f96b6c2b-ef6f-4f7a-929f-513e2019d36a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675906728, "uuid": "bfac9bc4-bb16-47a2-9f6d-a12f1085c9d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6700de-a86e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675942939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942939, "uuid": "6a1d7bb4-2496-4f97-abba-e2b8920cd1f6", "comment": "Malware payload (Vidar)", "value": "7aeb24bf65dae934778587835bde3053", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942939, "uuid": "da3ceee1-f2b5-4981-94ed-65f4702a3699", "comment": "Malware payload (Vidar)", "value": "ac6b01b2b51cf53bb97fce01b141c6795a438a11ace0b26735834f2ece3160f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942939, "uuid": "9b2b581c-dd02-4203-9ff5-3a15788623ef", "comment": "Malware payload (Vidar)", "value": "2979f9f4f9d9393666a2025828486ee1f758fba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942939, "uuid": "6e193d2e-d18a-4538-99d0-130cec804e25", "comment": "Malware payload (Vidar)", "value": "c2aaf3ed79fa41427348e991068a63913a8b560e2ac3cc359613455ad09f4f8e5f34460186c3b09348c7d8c459d86dc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942939, "uuid": "52b93557-d188-4abc-861b-1b5067eb051a", "value": "T1F714D03639D0C072C56B50305864DA796BBEB831C679CA5BB7D81BBE1F303D1663A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942939, "uuid": "6072f1f4-bdf2-466d-b571-64030f21372b", "value": "83d1b8095e33f74e23ddae505b88bb37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942939, "uuid": "ff292d8b-3239-4485-b313-ffeb9e14b4ff", "value": "3072:9hOOFf0lBj3VLM09WCh53Wr8c2p3oqnlbk8yc3AeX5TpvI:9hOlTVLP9oAc2hoqnxCcQYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675942939, "uuid": "a5b59158-536a-427f-acf8-631a6ee52db4", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675942939, "uuid": "52ac606b-1b4f-4d80-bb71-ee330f32e388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942939, "uuid": "95aadef9-bc9a-454a-97fc-3496dfb9c86f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a56bcb-a84e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675928996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928996, "uuid": "0b44ee63-8442-4f4a-8274-74a2994c8f20", "comment": "Malware payload (AgentTesla)", "value": "1bf99e182b1677478deb32072c4be8e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928996, "uuid": "719205f7-e18a-4fa2-b162-44eee2c70c75", "comment": "Malware payload (AgentTesla)", "value": "ac9cd8708896cffd7fe69c4aff60a31a57beb5078d91832e2ad31c570a1ef1b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928996, "uuid": "baa6dbe6-005a-4809-a7a1-c38b08daff03", "comment": "Malware payload (AgentTesla)", "value": "656daa9cb34a53ea5cd567167e6406af6675312d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928996, "uuid": "01441f47-cb7c-47ee-9112-261068048bd6", "comment": "Malware payload (AgentTesla)", "value": "42ec08eae75ae7271b2f3b7d2b4f40b37df08d4e19cb63eed64359b67fc4962624c1d1d29c524228433b7375e84fd50c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928996, "uuid": "55bb1f55-53c4-4e36-8b80-a6980a8bd0fb", "value": "T110E4127525F84A5AE3BE43BE29F10206A7F5A582B193FB2D0F4478D11F77BC0022A557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928996, "uuid": "240d5bd2-b0dd-4df5-b6ad-92989f87cea4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928996, "uuid": "71bdecf8-350e-4cc6-8b09-3fb8aee18b50", "value": "12288:sRlrMnR04RvapjXzkxZBD5Nsp/lKJYME4sKC218upMmQlQX:k3RDcZBNKxd4sKx+cMmQlQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675928996, "uuid": "bcca465d-82ec-4d0f-8e1d-24f19fce5342", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675928996, "uuid": "085927e0-dcb7-4d5b-bfa3-28841a8a374a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928996, "uuid": "c3064354-b10b-4a52-854b-198190886dfd", "value": "PO-000001306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349c100f-a881-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675950840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950840, "uuid": "3e2edf03-8eb3-406b-873c-a20b74e5f73a", "comment": "Malware payload (Amadey)", "value": "0d2ef328de221b4cfbc427a3af4310dc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950840, "uuid": "94b4fa8b-2b84-4e8f-b57b-5d45c4b2d6e1", "comment": "Malware payload (Amadey)", "value": "acd26375a277738b7fcf4756a8ed8fab5609367364d06576cc4241cd87d2be16", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950840, "uuid": "43d7e609-8622-4ffc-adbf-c26b882301b5", "comment": "Malware payload (Amadey)", "value": "4c9badd6c4951cf24cad48d69212fc404ee2cfb4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950840, "uuid": "ffc36dc2-5150-4443-ab8e-f2cc162974a8", "comment": "Malware payload (Amadey)", "value": "93e97205eb3556dd38daea151fe6c0d4a44624676b249227a172236f9aad5d30f0011d735f32dc216c3b0a4b5546b1ad", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950840, "uuid": "073a1a7a-567f-4553-bc8c-56dcb38f11ae", "value": "T1E5B40207A7F84066E8B95B7009F703D30B36BDA46774839A234F9D5A18729B4F23572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950840, "uuid": "6ac7919f-2e87-4e6a-ae9a-2483873240e6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950840, "uuid": "18e6d905-6a65-4309-af8c-12ea2eb9c731", "value": "12288:kMrOy909LPCSfvwaSif/JC3GaLYbWmhH6FFT3pz1ZrO:yy4+SfvLt3oG4YbWmHEF7pz1Za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675950840, "uuid": "110cae51-be49-4462-8e20-5bbd3236f4ad", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675950840, "uuid": "6c35f7b0-ead4-4c7c-b2b2-c5f644941e0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950840, "uuid": "a89fca02-5295-4d6c-a331-2308010fecac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123b59e1-a838-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675919429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919429, "uuid": "a0b0e4a0-3fae-49ac-8cb4-5812e6b09631", "comment": "Malware payload (njrat)", "value": "71a3b044e92a772e1a80b0b0b464a0cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919429, "uuid": "f87e38ab-db30-49f6-b4b5-65cc6bc75ff9", "comment": "Malware payload (njrat)", "value": "ad23adcfaaa54129d414e83b710a2f365a7833d920e32e361725b32de6e7d05b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919429, "uuid": "f806ee14-e975-4b42-b7cb-f4d2042d3fa6", "comment": "Malware payload (njrat)", "value": "61a5a671a5b9adcbbd38030aa507ff72e70b5c92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919429, "uuid": "d1eaa251-8efc-4814-8d25-126ad7b8a791", "comment": "Malware payload (njrat)", "value": "da1d3662c861308364fb426c93beeb975017a5a1894e3c3bcbfd20945a95e96dc70743406a1f9275639000cc24029658", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919429, "uuid": "9d496629-af99-4eee-9ca4-850206ab1787", "value": "T198032B4D7FE18168C5FD0A7B05B2D41207BAE04B6E23DA1E8EE164DA37636D18F50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919429, "uuid": "1348b825-94a2-47e4-a869-b00289dd8600", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919429, "uuid": "ccf76e0c-7652-47d8-8c31-ddb6b8da0f9b", "value": "384:+8oIiuVjtD+P3V+y0bf2TKtvN4suKvIrAF+rMRTyN/0L+EcoinblneHQM3epzXjD:t3mV10bf2TKtClKQrM+rMRa8NuVBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675919429, "uuid": "ddb1437d-76af-41ac-a9b9-83f209c6a9bb", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675919429, "uuid": "edb2fc82-72aa-486b-8a35-bee08874cb74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919429, "uuid": "844981a1-ca59-4b10-b98b-fb28cb451bb9", "value": "71a3b044e92a772e1a80b0b0b464a0cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c757d6d-a887-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675953591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953591, "uuid": "d4831ab2-2b55-48d4-b997-7890706cffda", "comment": "Malware payload (SnakeKeylogger)", "value": "52c29d474fa46a54b428745c6b03432c", "object_relation": "md5", "Tag": [ { "name": "r03", "colour": "#399009", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953591, "uuid": "029c8fb4-a43f-4254-841d-872598b7ae4c", "comment": "Malware payload (SnakeKeylogger)", "value": "ad2add932f6a5cdc6c38c08acbf596cf1e4bb7434de6884db8595ef5d10b5b83", "object_relation": "sha256", "Tag": [ { "name": "r03", "colour": "#399009", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953591, "uuid": "1b1d2caf-3cc3-4f3f-8260-7786f07fd209", "comment": "Malware payload (SnakeKeylogger)", "value": "822af715bfde887d2facfda7029ed64771e33e85", "object_relation": "sha1", "Tag": [ { "name": "r03", "colour": "#399009", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953591, "uuid": "196eab43-ad14-40a5-9fb0-bb5eb0ca5c20", "comment": "Malware payload (SnakeKeylogger)", "value": "1a1acd8d46e9f73b2e6d06090c0d159fc04cf49a8827fb8cdc8e1029fe379d55f9a35e163895e7b9cc0c2b8ebde4572f", "object_relation": "sha3-384", "Tag": [ { "name": "r03", "colour": "#399009", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953591, "uuid": "35f2d841-c47d-491e-8754-916e606ea6b0", "value": "T1C7742369B656457F182B155EA63CF2FDE7C9D113E1AC3A50F9FBA20538201B120BC87E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953591, "uuid": "258ba06a-f1d9-4d98-8a47-75f35affc3a7", "value": "6144:cNb8JuV5BVirZ1QdwB9RnNrWsorXBR9icBqHomXukm4X6Y6j3ugsuSYH:cNbUuV58+wB9lcrXBR9iCqIm+kmOt+sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953591, "uuid": "7f26a41a-62d7-4dbc-aaf5-8ed179c6dc42", "value": 361332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953591, "uuid": "0787ebd6-b67f-440a-8592-411cee08f497", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953591, "uuid": "b727e42b-77f7-4fe8-b795-f112c15c3d8c", "value": "AWB 80258723268505_1.r03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c62b9e-a8a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675965103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965103, "uuid": "fcb59d85-6390-4db1-bdce-d1f5f92389c8", "comment": "Malware payload (CoinMiner)", "value": "d6f5c6434cc1ddf51e4c9fd6f1a7c829", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965103, "uuid": "8eb2ac65-cad6-43fd-90a5-a684fe9d7039", "comment": "Malware payload (CoinMiner)", "value": "adc48820e92c296e56c351024f67262c9c1d4f77267957394095a55228990550", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965103, "uuid": "56440f30-cf9a-4f47-89e9-9dbcae672e76", "comment": "Malware payload (CoinMiner)", "value": "9ad1e3e4ef356fa13ecc2538776f07098f378f04", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965103, "uuid": "01abc6a4-2a30-4801-96ad-b28c288c39a2", "comment": "Malware payload (CoinMiner)", "value": "b7abca2a0c755105dcf2a9edc365c4b8e213b186686c7c8adba39aa4bc49c27ef698c240bea9d8ce5f3453bb9f7ccc1e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965103, "uuid": "97d3cafc-d35b-4f88-8dae-1f753ab94e0b", "value": "T181952382F647DD47C41516B0DC52C5BC0521BFA8FC330A5732C27EEFE5B56B2481AAAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965103, "uuid": "687b1a76-1845-41f7-bc6a-86f59757e980", "value": "1ff5a3edcdd92c5764b36983d775f976", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965103, "uuid": "7c6a2634-538c-49dc-8ff2-71b6c10ad449", "value": "49152:1AD6KiLGJi7xgVJ/EKUC9EiXmFfIE80lrmc1AHROz:1ADTiLGJi7xgVJcPC9B2Ffrxmc6HRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675965103, "uuid": "05635629-1a4c-4219-ba75-6c07c2b4ad15", "value": 2002720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675965103, "uuid": "9404fe90-6c70-4958-975a-b71fa82d1ab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965103, "uuid": "39f6739e-7198-4bdb-8dc0-50b1b8567783", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4dbdc1-a878-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675947308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947308, "uuid": "258c30a6-6715-4dba-bf10-326c7e98fe3a", "comment": "Malware payload (RedLineStealer)", "value": "9f11bd99bfbcea926407437c9f964868", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947308, "uuid": "e7f2d8b7-eb2d-41d8-b347-f46295594f36", "comment": "Malware payload (RedLineStealer)", "value": "ade8a43186c386a850ab564c076d80a389ee3be1e0293f1210ebf328e0e72ca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947308, "uuid": "59dca40e-2139-4a87-a611-83672bc7fe19", "comment": "Malware payload (RedLineStealer)", "value": "211eb34b0bac5ebd4a6ceba8c4be1a1b2b8a0950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947308, "uuid": "8782b638-6f2b-4885-818f-efbfbf21d8e5", "comment": "Malware payload (RedLineStealer)", "value": "beb46a2f671f4c71e3a368495f8d77d99838d4cb11b6a51dd58772748d357a6729c786bffaa18a1aee0e6c5ed130cf42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947308, "uuid": "71f9b347-4331-4f90-b7b6-ad72714708fa", "value": "T17A04C51437FCCD11E1BA1A3F6961A05086BF98026852F75B76C367CE1E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947308, "uuid": "f76f918c-7e2e-4da7-bb6d-b83de1861f52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947308, "uuid": "7799db14-14d8-411e-8add-f017dab0c3f6", "value": "3072:MtxqZWN9abUP0PMLb/a4imekK9Oh1zxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0E:M3qZ5MLb/xidOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675947308, "uuid": "0aeccd12-d322-4469-a624-4f4336da54cf", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675947308, "uuid": "07d4257a-ba3d-41af-941c-6181f6610d1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947308, "uuid": "1d860f27-ab63-47e8-a564-21e79ef8263c", "value": "ade8a43186c386a850ab564c076d80a389ee3be1e0293.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd10537-a854-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675931500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931500, "uuid": "cadff097-3a72-43d5-a344-5ec17861c2f5", "comment": "Malware payload (Smoke Loader)", "value": "e693806ca13c6fab9b9b2bac19a255ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931500, "uuid": "d0d04fae-cfb9-4f26-bb07-316c15408a4d", "comment": "Malware payload (Smoke Loader)", "value": "aded428c9966adbadae848af5e22dd2b89246d9ce8676dd48d5e46d564dbb360", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931500, "uuid": "45c40bc3-2fb4-44ab-8ac8-d24f6e449873", "comment": "Malware payload (Smoke Loader)", "value": "efb9b9703a91aba0a7cb71766fdda3ca6b47d6dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931500, "uuid": "02d0df51-54bc-4fcb-bb4f-b0cec63c3d63", "comment": "Malware payload (Smoke Loader)", "value": "d02bf9577fd0fc8205712ef6559180d9c7d7aa34f30d3f7acddded21ee20dfce8465a7cffbd9f0fc899c0d734e8e2171", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931500, "uuid": "f698197f-f434-4723-831c-78d61563c9c3", "value": "T12114C0F23690C072C12B14315874DBA56BBDB83156B8DA5B77A81BFE9F302D0563638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931500, "uuid": "b75dce20-7da3-4d56-862d-b3e24ad8cd53", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931500, "uuid": "4d7f2351-bc3a-4694-8399-d19c1ea80828", "value": "3072:FVqUOMUY4wuj3L24pWid5LppT7q4jrzwGIweFks4/69BNHLnaBEyupwX:bqUperLRpXpT7q4UGIweFks4mBNb8lJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675931500, "uuid": "226b07fa-29db-410d-a8d7-f601026665b9", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675931500, "uuid": "92fd1c78-8980-4208-9e3a-1a3cb40a2fbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931500, "uuid": "712be7b5-83e3-4a9b-82b6-f89d4d5f329f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830b506f-a886-11ed-88f6-42010a9c006e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1675953119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953119, "uuid": "98097ff6-3896-4e0d-b6f4-300dd62dba2e", "comment": "Malware payload (CobaltStrike)", "value": "a0876f96aaaf9470f65a5c1d7b8d144c", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953119, "uuid": "3a0244ad-2f95-4e4e-9284-5b948482f183", "comment": "Malware payload (CobaltStrike)", "value": "ae62ac2596c41db7d18fcfce29955d6b420a5783c0f27ca8d667caab3ec16398", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953119, "uuid": "778a5ba8-fcf6-4246-986c-f1454143f0f7", "comment": "Malware payload (CobaltStrike)", "value": "872674f3602757d70255360106c442a9057a4b14", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953119, "uuid": "d02fb55c-5fa4-4a1e-9fb0-1e20a6134447", "comment": "Malware payload (CobaltStrike)", "value": "ecd123fd8ab604d4889b85b0e835dd6635d76e00f8cbaf4ec81b1275cb9c3eb0b6931ff67233292171fe201c50595890", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953119, "uuid": "5865259c-5c46-475a-b3fb-0ecb5988c7bb", "value": "T126248D5135C6F436D4970079634BDBB28FBDBC3416B1A887ABC40A9A5F226D3D72A307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953119, "uuid": "c8b61c72-e623-4ae3-bd22-598d22c8793a", "value": "dd2ee89b38b455d38772c37d994f2beb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953119, "uuid": "b78d654c-e66e-4c29-a4e1-1afefc7e265f", "value": "3072:MfyTFpXSc43UtiD8Umh8I6lk0bF+EjJeNDU2a7i78nifiRjdUN5Y0BS:MfsD4ktiD8UI8I66C+6AsXnifuju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953119, "uuid": "24a4dd82-998d-4afd-aea6-b5f2733c01a0", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953119, "uuid": "14788695-ac3e-4356-8109-8413d53ad9dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953119, "uuid": "9c889f22-0e28-4e91-95db-982977c14f4d", "value": "2023-02-09_a0876f96aaaf9470f65a5c1d7b8d144c_cobaltstrike_meterpreter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587a955b-a85c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675935009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935009, "uuid": "c4fd9f05-222d-47c9-a0fe-0c3d285f7cb9", "comment": "Malware payload (RecordBreaker)", "value": "c2d9fcd6501857108227cda6e97fe0d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935009, "uuid": "f865c850-55d8-49b3-be65-4730468834b4", "comment": "Malware payload (RecordBreaker)", "value": "ae69b10c0be08888532b91e869c446e93a53bd3a7076030e82d0a671487642bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935009, "uuid": "33ce5d5f-18c5-454e-96e6-49a7b234a6d7", "comment": "Malware payload (RecordBreaker)", "value": "8b9c4d1161dfb0fbb4135b650ceaaf14ab365bca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935009, "uuid": "e7daacff-7859-48ba-a8d8-57c224c5a815", "comment": "Malware payload (RecordBreaker)", "value": "4ca8f5fb7048f7d237b6b1926c07a34a9c75a272e8229dd490ea9772c71ec9fe7a5e4cf1fe9651de2d35ec402bbdd411", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935009, "uuid": "f54c8795-3f74-4ae4-a6b0-02b3d17b3338", "value": "T1A814D02236D0C0B2F57A24305874DAB5EBBEB8304275CD5777981BAD4F332D1AB7A246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935009, "uuid": "730c8c54-933f-4d99-9227-0077790595ab", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935009, "uuid": "4a1adeb0-5b69-4ca7-86dc-b51695ebe5a9", "value": "3072:4GzOZbrFKONUMLHK4WWzd5p2bDxKCXF5CxgcVpwa1ogQ:4GzOZdRLq40B1c2cVpwMob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675935009, "uuid": "dd763c4c-0799-4fbe-a17e-945bb486f9a0", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675935009, "uuid": "aad019af-1f7c-40f9-828b-b868b9b3ac01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935009, "uuid": "4afab80c-ec06-497a-8eab-4f048c226cc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72120adc-a89f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675963828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675963828, "uuid": "b80ea85d-e8a3-42eb-9182-4ec131d66da9", "comment": "Malware payload (RecordBreaker)", "value": "21e620786070c646052291d85898ff06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675963828, "uuid": "bde7db2c-9267-4970-8580-0ae9805eae3a", "comment": "Malware payload (RecordBreaker)", "value": "ae8545468d9a734f07e13aeba20a1ad1d3f87c69e1ed2f40f4fcb8723de63428", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675963828, "uuid": "81bd1de7-9dbe-484d-9ec2-9701263188ce", "comment": "Malware payload (RecordBreaker)", "value": "dc457a43c0d92f2d706a562371838cdebb963630", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675963828, "uuid": "da89e707-8f40-4687-bef5-d8219f25a2b8", "comment": "Malware payload (RecordBreaker)", "value": "5e9dbf1f7a2bbf21cf2c73cc93d5cce01f309b3438789bc9413173acad86c7ed07b7dedac2a3729696f02d2a5bf26550", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675963828, "uuid": "309f47c0-0300-4e2e-a0ba-02a4cbbe93d5", "value": "T14204BF1232D0E871D476B6318C27C5FD2A6EB921CA789A9B3728273F8EB02D19675345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675963828, "uuid": "a571370a-b2cb-4b5f-833a-bd7d6d49bdc4", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675963828, "uuid": "be87eb66-229c-43cc-b831-eec466ea3de0", "value": "3072:TFgdiHb9BWird+jVPqMdZq0Zw8LBMRx8YfVcyc+e4Hda2wA:TFl7FrsjVLJw8LBpQcyc+ta5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675963828, "uuid": "9166619f-f3b6-4f8e-9ae9-b12e8dbd3ab1", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675963828, "uuid": "508a51df-0847-4d58-8cae-0f65379ffb70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675963828, "uuid": "355fe66f-a1cc-426c-ba3e-56dc5f264593", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e88091-a856-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675932340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932340, "uuid": "4ebd6a2c-e0e5-4c5a-bd22-6cf0d4909421", "comment": "Malware payload (NanoCore)", "value": "0aec457469de534eb2074e96c24021f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932340, "uuid": "84128195-0d3a-493f-85e1-5792943afd72", "comment": "Malware payload (NanoCore)", "value": "aeaa1d0b93a6bb7b94c8afcea3c4f33558a94b6543974bbe51ce422c9ab99d5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932340, "uuid": "ade4d4f6-377c-440b-aaa6-38bb5bcc408e", "comment": "Malware payload (NanoCore)", "value": "d673cbb5793dac7f65a5a4884af82626ae502f91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932340, "uuid": "b5756c4e-bcf4-4f5b-9df9-09c4a0353a88", "comment": "Malware payload (NanoCore)", "value": "84d1ba8b546da8fe75763f3c72307c413a57f113f79f23bb91bd3f481811dd45ad106ea03b83da54af0be126023fa1f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932340, "uuid": "09d3b3d2-3f86-498e-a868-ca7acd69521e", "value": "T14704B00777D47CDAC415A4FBC3B7F16A863F89124F67286B743D32958AF10822E9B815", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932340, "uuid": "905dfb0a-6096-4056-962d-7aae533d87ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932340, "uuid": "b21a9d30-6dc2-4d64-998c-2c611b5f2650", "value": "1536:G7gS9eobM4pqrOjRrpqcmvIADTdt2xrMS89X5+PEflS:89eyJpqrOjlpqrvIADTdt2xMj5+PwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675932340, "uuid": "3ea60ce7-c474-46ed-b2fe-35518816edf0", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675932340, "uuid": "20f70d57-d6ba-48d4-8bd7-7ef57957a1e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932340, "uuid": "1b03055c-f8ef-41fa-a404-4dd77cb25db6", "value": "0aec457469de534eb2074e96c24021f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b9d2a2-a8ba-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675975558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675975558, "uuid": "ddf836bd-eafd-46eb-bbcd-e7bdb66d3760", "comment": "Malware payload", "value": "6b4b3661ef81418292e32583b89fcf80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675975558, "uuid": "77c600ce-6329-44a9-810d-9ad7a55d7a74", "comment": "Malware payload", "value": "aee7699b3ec508b621d68c6e7f235007756d688e40ab6fd360d84b9b592acdc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675975558, "uuid": "95b86f71-adf2-4cc5-ac33-075385a9fd74", "comment": "Malware payload", "value": "717ae9d3256472d4604dec915340d4f57ce471e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675975558, "uuid": "23276bd5-5bb9-47a6-84d1-9c9a9079e2c7", "comment": "Malware payload", "value": "afea0e220989a5c1c1e0b4dc67763a0c2ec305cebbeb0ab86ef1f36e3c90bfbf3a9d5ce85c85a7269d05ca89eea789f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675975558, "uuid": "2d504036-e5a8-4040-89fa-1ab136c15d4c", "value": "T1FAB5127C7115C46DD280BEB4CC3A98E75CDA6DE3E9E0A16270DDBF3F92791848A0A113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675975558, "uuid": "725ab683-e556-44d4-8ffd-fb776cf466c7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675975558, "uuid": "51915959-b91b-4283-a6d3-149d2e8b833f", "value": "49152:rdHSKWhnSoeO2ExlCxUWSsbeOdSaeCZSEbrRBfUq15evLCgv2MR:JHS3hnSo5267nEeOfe4SEvRBfU0eLv2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675975558, "uuid": "a9291580-f054-4a0b-9636-613ea03cade2", "value": 2469411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675975558, "uuid": "77e2c671-8f57-4b1f-bfd2-8adc5275d4bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675975558, "uuid": "3ddb9c2e-3633-4548-a169-19055e50c47b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ef2f57-a83f-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675922489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922489, "uuid": "662073ae-e8e4-4129-bf9f-8ea3f758f764", "comment": "Malware payload (LaplasClipper)", "value": "033001e779c76f1e73d81837c80687a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922489, "uuid": "e0e08c58-3f12-4d3a-a3e6-0907f0851c77", "comment": "Malware payload (LaplasClipper)", "value": "aef6a55f2d70e833feace062ff68e3be787e94510ee983aed62d45bc2a1652a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922489, "uuid": "37f5e216-99f7-4deb-8d9d-a391332af50b", "comment": "Malware payload (LaplasClipper)", "value": "4db7ce3f9ec3e8e15c039ef9e2d67cd26e005733", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922489, "uuid": "b969c823-5add-439a-b73b-f67ea2e10f39", "comment": "Malware payload (LaplasClipper)", "value": "60f5a1d4c1a58435afdfdffa00a499766496b1e4c7d42c46547d7ba86f7419995abba6a13da8dca16663bfe1b7d75dac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922489, "uuid": "22767922-9746-44d5-9d1b-e161c579a689", "value": "T1868533193580C1BCC69212787C61F5EC1EBC25201735E59B7BA82AF9BF307F16A2A3D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922489, "uuid": "79259a28-4835-41df-89bb-6acd1dbfa76a", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922489, "uuid": "ba815f63-e7bd-4c48-84ae-f1fe1b3709be", "value": "49152:4LLMzTo65D8ulSA3CNUhiRaHGOPpTf2oGzzC+zgbxoAH8:kLJID8ulj3CCY+tpTWaSg9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675922489, "uuid": "58bb00bf-e6a8-47d6-b799-56483afbfc13", "value": 1873920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675922489, "uuid": "2e77e1f6-915f-4f50-b9b0-3945ee2d59e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922489, "uuid": "36ff48bf-f039-4c58-9799-fee895e138d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b266f6e4-a836-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675918839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918839, "uuid": "233689d5-1674-458c-a90c-7d058d0478ff", "comment": "Malware payload (AsyncRAT)", "value": "70584743006a75235d2512c39388b397", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918839, "uuid": "6460780d-3b3b-4433-8d0d-fe2125b28500", "comment": "Malware payload (AsyncRAT)", "value": "af3c033987c0e4eae24199c6523c669c3b50f913a54b8373a1487c9ad0aa6ca5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918839, "uuid": "93d1051f-19b7-4a9d-9b6c-0352a9b8f99b", "comment": "Malware payload (AsyncRAT)", "value": "93629afe905e3cb251916f515803f7cf15875cc7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675918839, "uuid": "b74d9ea8-560d-4fc7-833c-cef61f6dde49", "comment": "Malware payload (AsyncRAT)", "value": "0cfd0cdf0c82094a25b30ef7522abd3e53c880d7d10d05061f6b89358e3e2801f32dc5d9ae8690b5487b7fd3e9e56100", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918839, "uuid": "03a01636-ff51-430c-81de-61bfb29ba923", "value": "T1E2D38D593F49C84BC9646AB40E52E861063CFCA15CC44AD7B5BEF3AD0A31B0ECC569BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918839, "uuid": "ff7cc9fc-7a04-42f4-a883-fb50fc5025c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918839, "uuid": "c2ed4e26-5ad4-4692-b0b0-a5fe0f1bbf2a", "value": "3072:IqmKjfjulYlP6gAlg6zGkuL58e4irOzgx7:ESuKlP67vEV8eXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675918839, "uuid": "02eb1a1e-2423-462a-847b-4130ae99897e", "value": 135832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675918839, "uuid": "3bd7f87f-ac55-44c1-845b-ae33c737782d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675918839, "uuid": "986727c0-1279-491b-854a-94e1d6db01fe", "value": "70584743006a75235d2512c39388b397.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953ff767-a851-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675930386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930386, "uuid": "daee6700-21ee-4b14-bb28-896be55488a7", "comment": "Malware payload (Amadey)", "value": "3b96bdfcfb1526637c8e102d025948fd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930386, "uuid": "10801479-1699-48e3-8443-8f071f05c0b8", "comment": "Malware payload (Amadey)", "value": "afa34b3368467d6ef49c6b67fa3373db151ad1b50865ed862dee30d65aa129b3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930386, "uuid": "20e74e47-ffa2-4155-931b-505d05a0e2fc", "comment": "Malware payload (Amadey)", "value": "6a7f1d63c850f6b7c9ee7434030d78016952d4d6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930386, "uuid": "242abde1-2931-42da-a1a9-7606b2fc218f", "comment": "Malware payload (Amadey)", "value": "09cfd9f48c047d816f5d4db59650e3163f940b15e76bc1840c93d9085db06204b0439055cd4e980b7483f4dbfa0c6b07", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930386, "uuid": "e47e140f-1c1f-4977-96ed-c4a6d3d55fc6", "value": "T18EB4020BA7EC8026E9B4577119FA06D31E367D605E38835B234F5C1E1CB36B1A23676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930386, "uuid": "b6a548d6-d69d-4cae-8c26-aa60d18bfcf1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930386, "uuid": "b1350dab-5bb0-4cce-94db-07de9b4cbbdb", "value": "12288:FMrmy90lcl6CFoQiCRsB6thS2ubQdeWI1:LywDCCQjubMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930386, "uuid": "b580c85b-fa66-45ff-b5d6-12566b7506f8", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930386, "uuid": "3e942169-eef1-423f-a95b-fee9c77d3610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930386, "uuid": "512b354a-7a99-4f56-96a0-6ce579479cec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9293c7ea-a817-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675905471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905471, "uuid": "99377451-696e-46d0-80cf-5648f58fba21", "comment": "Malware payload (Formbook)", "value": "d777dde09a80850ec8ab3c7c58593076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905471, "uuid": "78a7b224-4963-431a-ad22-e02957375f41", "comment": "Malware payload (Formbook)", "value": "afd6ad942845a9ea52703b8fb6128cf7a2ed015f8ab5b331e27a818d965a53a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905471, "uuid": "3692cf7f-387d-48fd-893a-3335f78108b3", "comment": "Malware payload (Formbook)", "value": "327b1b47cfd09a06b0a40162f058d409c0055ed2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905471, "uuid": "4204e0ed-522e-497a-b7f2-75f5831a4bca", "comment": "Malware payload (Formbook)", "value": "193fe57bcecba5089bdf4e5b9e1aaa9ae813c0b116e8f0969076631231c479222c269c999807b5d2ee46c86835d4ae3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905471, "uuid": "017f1035-e038-47e0-9b66-72de261782b7", "value": "T108157E5337F095F2E68720B108287A885BF07513BE16EA538FB737C06785DB672B815A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905471, "uuid": "6c6c0b70-4b82-4301-ba5c-37800a091748", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905471, "uuid": "ba0363ca-fe18-4c67-ad95-ee0ca3b1cbc1", "value": "12288:MphefaqG4yPamXRz2oVkm1AEOZNelM7iLB63s6Fy2Mxzo3:MveSqG4yPaAFVOEeNelDLo3s6F0xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905471, "uuid": "446d0939-39c6-4a09-9056-ec411238bea9", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905471, "uuid": "52205a1f-4ebd-4efe-b73a-0279f38dd4a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905471, "uuid": "016dca71-7675-4507-8821-dad957208bee", "value": "J1sYhwPxxiSiUCm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f5f673-a8b9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675975194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675975194, "uuid": "53cb590d-e498-4604-a5db-359b53bf2e1f", "comment": "Malware payload", "value": "8080584caa0773d72e05ed8fae4cd78f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675975194, "uuid": "c34cc469-6ecb-4af2-bf64-5af314cc0beb", "comment": "Malware payload", "value": "b076b5edd0ef7e143caf5507aa8d946a93ef4d63ab036887a36ff619ad7223e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675975194, "uuid": "ca008f05-6276-438a-b043-94133abc455d", "comment": "Malware payload", "value": "0daffa45ca45dacc6d00ad96178b8cf899ce4a48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675975194, "uuid": "2f83d73d-2b0d-4495-9cd5-ed87c28e0c52", "comment": "Malware payload", "value": "04701563f1709045cfc3c72129b23a25e4767832ed60ade3051352558553233963c7bcd028dad0b1bd59cdb10370d3f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675975194, "uuid": "ad9a88f7-3e3f-4752-8669-ff23df7a3b62", "value": "T1B204CF1232C0E871D07267319D68D5FD6B7EF8214A78AA9B3728263F4EB03D1967235D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675975194, "uuid": "53412bd0-ce2a-4468-bfe0-869df0f0fc20", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675975194, "uuid": "d93154f8-8b56-4b3a-9e64-bb9bcd4e345b", "value": "3072:yR8oOws5vwC02vz6ETuBM9NwoO2eE3mR4gkDn2zxKMYW9Alxc:yRS922uETuloPeE64gkDuDb9Ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675975194, "uuid": "a972f84c-a18e-4308-aa13-e21d5575e6c3", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675975194, "uuid": "a35f86c1-ad1e-48dd-8f9a-4d8494c9e434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675975194, "uuid": "3ad106d0-bc07-4278-9af5-08292274daa1", "value": "8080584caa0773d72e05ed8fae4cd78f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae48411c-a870-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675943743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943743, "uuid": "b81f5e0a-1c54-481e-8c66-233bd11fe2af", "comment": "Malware payload (Amadey)", "value": "320fd9ae672b8b7da41eb53d6b272256", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943743, "uuid": "fa3a9a49-db2e-4fc6-8166-6b692befa656", "comment": "Malware payload (Amadey)", "value": "b0817965aeff24ac0ad11089cacbbc5116a2900acdf0ce94108f176c76fb2c67", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943743, "uuid": "059dcfba-2311-43c6-b1d5-443b50cf28bc", "comment": "Malware payload (Amadey)", "value": "2d5cdea2f4e4949e0923a1ca210b6542bab892d7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675943743, "uuid": "94dc5760-7a66-4e8d-b3f2-4acd363eb292", "comment": "Malware payload (Amadey)", "value": "ccc10d0de026e5a99892dc4694ff8d12db806cafc1d190e63867aa584971ac98cde81303d183357f9e08ca7f6a7ed4e6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943743, "uuid": "8df20f25-4049-4023-b1a0-3cfcad826914", "value": "T127B40207FBF84076E5E51B7008F60793063A7E615A78839B524E5C4E1C72AB0BA3676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943743, "uuid": "e5832254-f6ba-4cb0-a225-c0b5bacb9160", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943743, "uuid": "1581385a-817a-4d91-923e-2098b87e3a46", "value": "12288:EMrry90YrfjDoDi1CHtb+sfP4HavxLvELbFLgomXxMRs/:/ylztub+s3wuLQbFMobs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675943743, "uuid": "7f723208-04e1-48e8-9501-3d21d6e09658", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675943743, "uuid": "9708dba4-e28e-4b9d-8e87-3781b8f83bfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675943743, "uuid": "94f9f205-49fe-46a7-a026-e9bbbac58a9f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1587178b-a846-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675925448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925448, "uuid": "b4fb9a61-36c6-403f-8d7c-8eb40ffff831", "comment": "Malware payload", "value": "1938581d6a8014db45518cb12b0f7205", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925448, "uuid": "15928ca7-32ad-45d9-a0bb-349eaf720b1e", "comment": "Malware payload", "value": "b101d52054a4635775ed7aecdbc5844fee823783c655e77e96d1a27b70950a45", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925448, "uuid": "2826f5fc-3394-42b0-a445-33c439f95407", "comment": "Malware payload", "value": "3a73a6ef8c14e251e7bc21ec8babe4b1460f0ded", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925448, "uuid": "415483f7-245a-4791-a91b-89c9f3b40d7b", "comment": "Malware payload", "value": "dc5ef4f2e608fae7760d790a0ab9600536e469f18968367e7420fd473510c19e7fa0a4d24c0635f517c4d65fb09d91fb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925448, "uuid": "5b5299ba-0a92-43c4-b8f1-df840a305235", "value": "T1DF13F75AE78F02A4CF411277131B0A8996BDB33EB35155B1746C933433EDC2E46A69BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925448, "uuid": "23f8b321-a98e-4495-b662-15e79cef85e4", "value": "768:qFx0XaIsnPRIa4fwJMMrZS6xZCTUmQMbhogrWQvqGpIOEJ74gNDXRHHKf:qf0Xvx3EMMrE6DCTUmQyZWQiGpT8MMXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675925448, "uuid": "9fc15fb3-a364-4258-97f3-5e15c7f99e8c", "value": 41460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675925448, "uuid": "3cc6e488-71ac-483d-8680-3d22a3dbc0be", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925448, "uuid": "963d4b1f-c25c-43da-af70-0e835456cf25", "value": "VESTEL-20230209-54.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67aeabf7-a863-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675938041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938041, "uuid": "35be9dc2-9cd1-4afe-b2e1-dece0c4ee301", "comment": "Malware payload (RedLineStealer)", "value": "123b2ec99a0042c9320cf63d7436eb94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938041, "uuid": "450cf14f-579f-41f8-9784-b472abaad31d", "comment": "Malware payload (RedLineStealer)", "value": "b1939858649f87737aba2d73cb7650f65e5667e69c36429d597432747cac567a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938041, "uuid": "5cc8d8cc-2b03-45cc-a19f-894dd36bc25f", "comment": "Malware payload (RedLineStealer)", "value": "069f430acaf0f3af6ac46cfb280c8186ddaefda2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675938041, "uuid": "2e2d2b1f-27a4-461d-8c55-06a1c240d44c", "comment": "Malware payload (RedLineStealer)", "value": "5cb08817e075d608994734b04bb0ffbcf5ff9ddde22ef3bb098b10fc0b4c5983cc7c5e712c6b983a4a436a7c8ce403f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938041, "uuid": "1de2d2c2-1367-422f-b17c-c646e0c1ad2c", "value": "T1F7851224D791D0F7F94A1F32342B6E797AE2F025961848A71B684334763A1F30DDB1AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938041, "uuid": "eeecccd9-155c-4631-9779-17a747930dc0", "value": "38c9297e3fd6cd15e5c646a66c28ebf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938041, "uuid": "8e9696f7-2a59-4f6a-908e-e1889322cc55", "value": "49152:d0oAkjc6bhW43pHT//xblwBur6JMGtOOOp:d0yQMZpHT/hr6xtOOOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675938041, "uuid": "2517491d-4a25-4ff5-85a0-fdbceeacef90", "value": 1706008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675938041, "uuid": "090392a5-604a-4d94-a119-6af2e2166335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675938041, "uuid": "85e521ba-efca-4dcc-99ce-b50f80170ca2", "value": "123b2ec99a0042c9320cf63d7436eb94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354ce9ee-a853-11ed-88f6-42010a9c006e", "comment": "Malware payload (SilentBuilder)", "timestamp": 1675931084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931084, "uuid": "a3bf26ca-7882-4509-b4bf-a051cba3cc3f", "comment": "Malware payload (SilentBuilder)", "value": "927005139a0be61efe849c715d875dd2", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931084, "uuid": "031daffd-5426-47be-ad5a-f50cdc0691b9", "comment": "Malware payload (SilentBuilder)", "value": "b23491ede17f9a5b7d6ad27d3051a2224c214a5afa2139e5147bd26319577f85", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931084, "uuid": "d57f1be3-e1c7-45dd-b34b-9d15fc3d1cba", "comment": "Malware payload (SilentBuilder)", "value": "0f6a91916941d85b69e5320873a5d1c45055bc4e", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931084, "uuid": "166fb1d3-f6ca-4a9a-8e24-5beae7b8890e", "comment": "Malware payload (SilentBuilder)", "value": "0838cf078d5047b2df4e2362c9231937cca845def129c8d2494338507ada825ce31e4c922a0922fcf7ec84fc3b99328b", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931084, "uuid": "8c4ac599-e08e-4d94-aa84-f00c55206e1f", "value": "T1D8E47319E21BA159D321537BFE318385812FBDA2492DBA4B774D7A3EC6F41D0E74A308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931084, "uuid": "c454fed2-56c7-43a5-972f-da2b5eec5364", "value": "6144:Hknl9oBdySAx76F6XeyTVtW/9Ny9ABnl5/PBgxOHjuM9Mq:jl5/WxIjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675931084, "uuid": "405573b2-13ea-49f0-9e3e-8f95fdd28d3e", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675931084, "uuid": "95a2a78c-e8b7-48da-85cf-f18c84596ea7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931084, "uuid": "38586f7d-0b4a-4f27-855d-fc5a3c71f3c1", "value": "research-1646684671.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3837da-a89e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675963394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675963394, "uuid": "81701b04-ddde-4350-87db-594e8757b4a6", "comment": "Malware payload (Amadey)", "value": "b47ee182c4a71f005309905a86597c5e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675963394, "uuid": "5b0540d5-308f-4dd5-9310-46bb96978047", "comment": "Malware payload (Amadey)", "value": "b24f0592bb75d357f3d1efb6270cebc6bdb4a3bc1d8c3e2b181ce2e53dc6c600", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675963394, "uuid": "d44f4b25-9525-4c8d-a18e-e70ca390dfd0", "comment": "Malware payload (Amadey)", "value": "f0b1197b6180d0f1c7ade426ad60bd830d4be1ae", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675963394, "uuid": "9d38bf1b-479b-4f7a-b48c-d420ddf67318", "comment": "Malware payload (Amadey)", "value": "18772d9112e86bf51b80e37a2ff86b5f3dafa5c8f86c968eb7d15a6c010fcafd40cfaed32f2d6fa8181e4ff3b1e58abd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675963394, "uuid": "b431caf0-e804-458e-8f0e-ccf4964757e9", "value": "T125B40207F7EC8072E8B0577059F703D32A367DA09A786356168E685E0D72AB4E23177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675963394, "uuid": "ccba44fd-e2ea-4cd3-851c-4629da4f59c5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675963394, "uuid": "4a648495-c8cb-4502-b4f2-a40859e5dbc4", "value": "12288:NMrGy90sDaqyul1NwB1CNOJ2XhS8CArO:ry5jyul1qB1Cg2xfCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675963394, "uuid": "6577e404-4f9c-4657-8a0b-e84d483d7ce7", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675963394, "uuid": "cf38fb62-c7e4-4165-b4c1-87357683b067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675963394, "uuid": "fa42fa98-ff6e-4584-a38d-6e5bacd9b49f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f128ef2b-a852-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675930970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930970, "uuid": "1b356a02-1660-4c0d-b905-d3316a9d1f56", "comment": "Malware payload (Formbook)", "value": "a59721bfddd808ca572a3b6d2efbfe01", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930970, "uuid": "64a03f13-c8eb-41c2-89e8-cd78ad4feae0", "comment": "Malware payload (Formbook)", "value": "b2add1ed737a7b2f4cbc819f608fca8d06c64000f56551ea70ac34ca002862ec", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930970, "uuid": "d4402268-bf30-4470-b375-e32b637b9397", "comment": "Malware payload (Formbook)", "value": "037a5e29ce1c0a7c18a94031154a861ebf1c7521", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930970, "uuid": "3b76fe90-4e27-45f4-9f1e-8de72b9b9239", "comment": "Malware payload (Formbook)", "value": "d59418ea84e3e8275d82b1b553b821ebec8c11a57d7496b480e156a2ca19f3070e9559f11b4f2f3d3e5c8597e8c8df55", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930970, "uuid": "fb04ec60-6129-494d-b502-8ff5c1193e81", "value": "T1B854233C5C7C3D5C4518C54E80971B3D28E1B79FB3B92782DF4A97AA9C9398B22D7086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930970, "uuid": "b3d17d82-fac6-4de2-abd9-381a842b4149", "value": "6144:I/jUb7hBVB0VN0nM/Vxi2z2cW3bxgS7/RdAA0Iv1oqOt5AmrzMn:IrUbrO/Vn2cW3bimb9ovt57ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930970, "uuid": "61db9d09-8074-4baf-8d26-64e4f2313574", "value": 301213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930970, "uuid": "d3133dd7-308e-475b-bef6-b7e6a0cdfc09", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930970, "uuid": "1fffd35b-ac56-4299-b545-549b4c580847", "value": "DSG2011001_INV+PL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336a0f5f-a86e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675942678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942678, "uuid": "adc2d1ed-468c-4018-8518-85442e258243", "comment": "Malware payload (Formbook)", "value": "f6f8e7854865f42d7607810488aeb4a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942678, "uuid": "e71b21ef-fd91-41e2-ae69-530951bda5fe", "comment": "Malware payload (Formbook)", "value": "b2c983f76b02245e87e5b264f1a89fae3f3fba72772f11615de582d1804acce9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942678, "uuid": "3d503b2a-5108-4a23-a39c-da3be7a2c5b1", "comment": "Malware payload (Formbook)", "value": "303fc8db50848166890846756c5b1d2176394149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942678, "uuid": "8326d049-664c-4ce4-8ccd-7eb14d8d8f6a", "comment": "Malware payload (Formbook)", "value": "ac567861aca8e245cacf58d5ffab49b894387fd9efd34d8228b4493e3c1ecb6769300307e1a91b45ac2d79a4284b37ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942678, "uuid": "39dded51-72c4-4ec2-abf1-a93b9bb3defb", "value": "T13E15F16C2CB48715D16DC2FE86A32635E77F7E83B489D6290E8271CA0C787E35058D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942678, "uuid": "5d9e4d31-08f4-44ab-9e6a-551c424f79c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942678, "uuid": "87fa5d23-e4e1-4193-88b8-304b257e025f", "value": "24576:mHCtn9BoO/NTSQlQXDQOtRyjfCG1odiDoy:NjKMjKmodmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675942678, "uuid": "1bca3904-a9d9-40c6-9096-eef708ae43ca", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675942678, "uuid": "10f98084-6d2c-476e-986e-df41e3cab7f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942678, "uuid": "34a9180b-8613-4be5-9127-68ce41eec3fc", "value": "DHL Notice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebce736-a889-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675954239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954239, "uuid": "b10fbce6-c283-4fef-b798-6cf02aab5c3c", "comment": "Malware payload (AgentTesla)", "value": "38bcd75b10a8514175c27025d87f6c18", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954239, "uuid": "83d1eec0-e539-4643-b49a-c1473e8b95b8", "comment": "Malware payload (AgentTesla)", "value": "b362c914752624d07988ff806611b5510fc02da6f58ad109ee6e9b66685a7b29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954239, "uuid": "d0a6998a-7e5e-47b7-83f7-d7371f45104d", "comment": "Malware payload (AgentTesla)", "value": "712cbbe33ad6fd6562d544853a238d8941a88bf8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954239, "uuid": "3e840120-fce4-47ff-860b-8ad4467b7d96", "comment": "Malware payload (AgentTesla)", "value": "a0fd5722716265b4363d34d0307a177be9b4ea5ce31eb568fe7cfe11289b71da5cf11117f01fd17836dc89dcee12641a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954239, "uuid": "68faa11b-3e03-4475-8814-ec75f289d648", "value": "T170F33A2892C59DD2D32D8074D4A01158CBB2A3475607E79D0EA1BCFA3F467C73E2B967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954239, "uuid": "b507de8d-96a9-4859-b9e9-b656839cbc65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954239, "uuid": "70995888-b943-4e65-8d1c-134c78af1637", "value": "3072:rjIm1i6g9ukR1wSvqihbt/gKba6gJpoYT0pKRecGlHxGdY:06gPrqUbOSz61IdHcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675954239, "uuid": "a27cd0d4-0833-4399-b272-c1f95014b0f7", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675954239, "uuid": "4a6d1306-63d5-4377-bc4a-db5157f6ae68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954239, "uuid": "d787bbd1-9970-4935-ada1-481ee59eea30", "value": "30cf2237-4816-45db-a692-0cc5361a92f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fe574e-a854-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675931460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931460, "uuid": "c9049bfc-968e-47da-9bd6-16e0b225e644", "comment": "Malware payload (RedLineStealer)", "value": "f34444bcd2fa0663fc17937192d6f098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931460, "uuid": "30a50477-11a3-40d9-81bc-243b8288a48a", "comment": "Malware payload (RedLineStealer)", "value": "b427fff84de68deb7b6860dd5a30c70e968ac64480f395406b71762805b8d113", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931460, "uuid": "c368888c-185b-448b-a1a3-f237fa4cd142", "comment": "Malware payload (RedLineStealer)", "value": "17132ea8fca7bdf0a9307e9c96c18f1fd8fa1cb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931460, "uuid": "8c1af612-ae65-4acb-a8ad-f7a4722ce2a7", "comment": "Malware payload (RedLineStealer)", "value": "a53469fe7f179b88c68fe546620bda8d8119ae3686319606d21d15c4e64969bfdc9ca4b02f99661a68eaec2fb751c266", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931460, "uuid": "379fc73d-b310-4181-a6f2-6c10075a4fe8", "value": "T12564F12231E0D033C46A50355454DB79BBFEB8B0E6BC8A577BA42B798E313E15A37346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931460, "uuid": "3e828432-f7ee-4d42-9fc2-62b1da883639", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931460, "uuid": "3f959ad2-acf9-44dc-80c5-97c0c6c7c26b", "value": "6144:sqghwOhL4slcY0DMC1yw/npAoeOvzyTow/B/hwDi:sqguOhEsr0B1yw/pABbR/BaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675931460, "uuid": "0520e4c6-3340-4234-8cb3-aff2a6a0a05b", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675931460, "uuid": "86a077b8-c6c8-4fa5-8334-95b21b28ca06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931460, "uuid": "12bb54bb-da7c-431f-9f65-d6d223fa4262", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312d487b-a881-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675950834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950834, "uuid": "f10275d3-0c6c-41d8-8214-80afd5d310bc", "comment": "Malware payload (Gozi)", "value": "a21c995ddb9263d7d7fe6498b399c80a", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950834, "uuid": "b75dcb01-4bb7-49dd-8319-d81d0bfbb6f6", "comment": "Malware payload (Gozi)", "value": "b471c980a7fd108eb25b54568f9231d72a4b8569940de38bbe1a245428dd2b8a", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950834, "uuid": "ddc7258c-117c-428d-9d1f-bb942c1fabf1", "comment": "Malware payload (Gozi)", "value": "ab3eea9ebea0ca4b7b32ec7ae3d478620ebeb2ab", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950834, "uuid": "61a2a57f-32d4-415e-a15c-e2463de932b7", "comment": "Malware payload (Gozi)", "value": "b6a630d193f6ed6f14fbe2b1fa75af65e778b77b797aae4d319317c53efbe44e49412010e65d1145a7078f483f84f404", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950834, "uuid": "f6f1dbe5-e910-41ab-9c2d-af200a8c11e2", "value": "T189D0220A8D8DC2A1C142480AE058BC58AE0EF04829F7CCA86282CA8A9C514D0CD0CABF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950834, "uuid": "f53852e9-4d45-48e9-ac21-848b22194dc8", "value": "6:HRYFJb/4sZO6KNj69Qvyc1yc54vVG/4xHy:HRYFJDohN69Qvhy3VW4xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675950834, "uuid": "4d01fcfe-b7b6-4a94-8d71-590a5ba940d5", "value": 196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675950834, "uuid": "c4f20223-4bba-4ed5-87d5-ce3d8b186910", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950834, "uuid": "64439e33-3aa9-4450-b3e2-c99baba4e6b1", "value": "Agenzia url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8e0c02-a810-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675902377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902377, "uuid": "4ca7e554-49b4-4adf-b290-093509be221d", "comment": "Malware payload (Gafgyt)", "value": "7a70dd51e5c2129b12285a519fe79110", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902377, "uuid": "95460578-8ce9-4fdf-b99b-677a7ec0705f", "comment": "Malware payload (Gafgyt)", "value": "b4d5cde5b73864d55c010537777c825a7aa6ce6afa709a41ecf7e4758e26c856", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902377, "uuid": "4d589566-db34-4388-bb69-7ab848f4f921", "comment": "Malware payload (Gafgyt)", "value": "beed2334b77208c819ca4c215946f1e5d08039c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902377, "uuid": "2cbe3dee-1dff-497f-a1b5-50574f06c15e", "comment": "Malware payload (Gafgyt)", "value": "430b63d099be6fb903f0fe266216440c1eb3faace212548c90ca99d5c237a29adedd4b8eaeb39d8c34b5a2e61d6440ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902377, "uuid": "07729b1c-c34c-4358-9e5f-3442964c7844", "value": "T115932A47E9615BB7C0C66AB169E68D310713B9912F4F1B89713CA6F8074B8CDBC0EB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902377, "uuid": "acf47b0e-e7c8-492f-903c-e3a7b84e2673", "value": "1536:4TathcyY/axr6BrVtJtpGxgdKX+W3x8p0CtuzccmknVMOMuIfaW7:4aLdY/ax2BrVtPp8Xo0fFmknVMOtIfau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902377, "uuid": "957063b7-7652-41a4-859d-ccc1a365a9ee", "value": 89186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902377, "uuid": "c4d75a37-0fb3-4c34-a01b-b3e999078347", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902377, "uuid": "dd0442bc-8dfb-45b5-8278-9b0d24e3ed34", "value": "7a70dd51e5c2129b12285a519fe79110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b7697b-a883-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675951706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951706, "uuid": "c4032375-1d4a-49ef-b7e1-a026544963f3", "comment": "Malware payload (Loki)", "value": "0e632812853eaadaff3e5206fc81e194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951706, "uuid": "2f255819-5ca2-4d77-951b-18a96e500a8a", "comment": "Malware payload (Loki)", "value": "b60fce00b8b73a1a9db6746f4c82850b87a2300f8e987357e363d1a7d2576c5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951706, "uuid": "a5c52617-99e3-4444-aaf4-cf397497c4c9", "comment": "Malware payload (Loki)", "value": "93a7a625766ff07e3bbb750ec29685657d524633", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675951706, "uuid": "2e81657e-0750-4282-9ff2-a9ff8437b7f6", "comment": "Malware payload (Loki)", "value": "9082d56232813b8da1734f31227754011af1bf9941cb730dfd6fbd2e4c59de7951e70d9c8e9bbf4e05bc31d36237cb7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951706, "uuid": "27cd06d7-fbc0-4309-b63c-dc005b78f5c1", "value": "T12ED402693AB8895AE2ED47B955F1420593FFA082B193FB0E0F4870C61FB6FC0461665B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951706, "uuid": "edc620d7-7f36-46f0-8eba-bf26c572cd3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951706, "uuid": "88c881a5-237e-42e7-b688-717c3ab557d8", "value": "12288:Q/dG2FX63kX6EHr0+BVSLm++jzsFc0F6JdYfQlQX:Q1/60X6A0+B4C+2zn0udYfQlQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675951706, "uuid": "99f27558-58fa-4113-ad52-e54cd1e708ce", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675951706, "uuid": "84f3e5e0-c7ed-41dd-80d3-dae5fa647806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675951706, "uuid": "0385aeff-a745-4701-a21f-3ed0adb02545", "value": "SOA_JAN_2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3abc3c66-a881-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675950850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950850, "uuid": "7094c682-c3f0-4836-9523-a83ea2edb913", "comment": "Malware payload (Gozi)", "value": "edca65cabb466cc4d38738f4661bfe47", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950850, "uuid": "d4fdfb21-d8d4-4b72-8d0c-773f2d827762", "comment": "Malware payload (Gozi)", "value": "b6ece3b9c859b0baa1d09bc27a77df0e35a9bb0f866eefc726a3237a0eaa37fc", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950850, "uuid": "c2a6c979-d57b-4a9c-b524-0eed884bd04c", "comment": "Malware payload (Gozi)", "value": "3d3ab1139b38b6e3fd16f26315b57fe9d904397c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950850, "uuid": "0da4a42a-14ae-4a19-bc9a-401e3c207ba3", "comment": "Malware payload (Gozi)", "value": "2499abe6c9343e78c4d21d2b42311aca6fb8684e2d843c69ad245dd739c88ae3601675e216c675b1950ccf2e4706f800", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950850, "uuid": "afc2dd9c-689a-4ce8-9bbe-2c35a1e0e4ab", "value": "T142C022058E8DC0A1C14244069058FC98AA0EB48808F78C682182CE8AAC800C1CC0CABF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950850, "uuid": "f77b5309-158a-4410-a3ef-8d94963630b7", "value": "6:HRYFJb/4sZGR8j69Qvyc1yc54vVG/4xHy:HRYFJD4Rg69Qvhy3VW4xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675950850, "uuid": "9fe1abd0-006d-4949-bf78-8b3ead506175", "value": 193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675950850, "uuid": "f3330d62-04e1-465c-ba2e-90d4c0bc02a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950850, "uuid": "0fac3612-d7bd-4e58-b670-dd8f74372571", "value": "documento url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "118a2a24-a818-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675905684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905684, "uuid": "18e1d22a-696c-4f8f-947a-4ad3f6fc086f", "comment": "Malware payload (Mirai)", "value": "0bd225235c36881cf35a1c5ddcd0c3e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905684, "uuid": "6f7985d9-6bae-4d58-b780-8b02fcd57449", "comment": "Malware payload (Mirai)", "value": "b738df7cfaee44672042fa9f386382f1458ea49e6df7f91cb13c66db2b767fc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905684, "uuid": "88497c7a-a7e3-40b6-b157-692951c637f3", "comment": "Malware payload (Mirai)", "value": "4bc45ca04f6ee0b0a010ea501cc5705d3b05fea7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905684, "uuid": "bf108ff1-ff46-4f19-a38a-2eb57d6203d6", "comment": "Malware payload (Mirai)", "value": "70abee5e19b0b3ad1b6d2724dd586b5f919a45d995a9d9611d58dbd97befc89fbda4973abd32b468f7f3481fc5f7cf9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905684, "uuid": "37927c89-d220-4dd2-9308-2e8aedffa5d9", "value": "T181B35B23FE620817C4D0613A61AB4321F5B353CA21BCA71B7E730D99AF756452267FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905684, "uuid": "41c6fcbe-b5fa-4eb8-88aa-15a3164e7df7", "value": "1536:xT1tcdCPCniU+rtBuPBaVa4LcNM5dStXtNDOw:xT1ig21P6cN8dAHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905684, "uuid": "45e51bbb-ead1-4937-9194-c29013f93de3", "value": 108692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905684, "uuid": "1b8c9cce-e3ff-4a31-adc6-0314a8cfc539", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905684, "uuid": "fa11f24a-2687-408a-b8e2-24558c2303be", "value": "0bd225235c36881cf35a1c5ddcd0c3e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f86f0c7-a8d4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675986668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986668, "uuid": "d10888e0-5d8e-4ca6-a428-675e77054e74", "comment": "Malware payload", "value": "1d60c641b68be5678fa88b9dac11f680", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986668, "uuid": "e25e98cf-c6d0-4652-943b-2406b4cbe99f", "comment": "Malware payload", "value": "b7b8b01adcf10487f1d542375b0637188133c355c8342161275d8c3f17d76cfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986668, "uuid": "9382c15c-2ca7-4005-91e9-9af93ff23af1", "comment": "Malware payload", "value": "0aa1ca4f4fac148dbd4a4d4aa81cd1f1e6245980", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675986668, "uuid": "57c44d82-6eaf-477b-8288-66c79e2f7f3b", "comment": "Malware payload", "value": "0a5a298fab8af733293a9d961b81f85a4f153163705f0925b8ac2e34f112b08d8d44f546196f3bb7bfc32fa3d3e85f57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986668, "uuid": "f898c2db-cb89-4a40-9332-67476ec839e4", "value": "T18505C67D987A56E1C838FA3542B1C830B55D9F963323C95C9CDA3ED2EF721862C8A11D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986668, "uuid": "fc49abf2-308d-4d79-b299-dac535ec5b3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986668, "uuid": "86320e3b-1ce5-4ea8-be61-6ec90f9d7512", "value": "24576:6EVe7MTyPdLX2tuCAe/ZXidrn+zIZqPlkrUQlicmO1q:61dhqWrU8m7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675986668, "uuid": "9043ad1e-27b0-4e16-aefd-2fd0d67909f4", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675986668, "uuid": "e8e3bbce-3396-4d36-9618-45178e868d8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675986668, "uuid": "7be469d4-6383-478a-9406-66b133a882d3", "value": "Statement.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b5060e7-a874-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675945375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945375, "uuid": "b8571dda-0edd-42af-9c8c-511ca7cb18a2", "comment": "Malware payload (Gozi)", "value": "4bc244204214a6b343cdb9a12059f494", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945375, "uuid": "ae1267e7-3525-4aa4-aeef-2f536480a3c2", "comment": "Malware payload (Gozi)", "value": "b7f500066e622fcd4e4bba2d7cd909f2d12d5eb9d87fa2df7684b5b246e63f23", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945375, "uuid": "e740be9e-4564-4d12-89f4-df71c8ac74fc", "comment": "Malware payload (Gozi)", "value": "a646a57b4b0c1ce87e6e33ada2fdbebe02f38050", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675945375, "uuid": "b86b2a35-ef77-49b6-891b-3f207cb01a5d", "comment": "Malware payload (Gozi)", "value": "bf2384f41c7fdd860395f18c206531891bc56ab6c0f51680ba729d4a49a0334d8eabcff2dc127412f07ad87d1a5807a9", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945375, "uuid": "c2fc8629-80fd-479f-839b-aca19df9e7f2", "value": "T118F05C20FD7D4D35F625C37DE08129ED766299CC82316C1B34D3431A04157806FE954C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945375, "uuid": "e7178c56-94b6-483b-af9c-fd6c39cb5394", "value": "6:5jj8ACTl0QP/rHi+i94iRqOS2MpnTyc6D5DVrt3+PD1BICrTqtLl0pE88N7n:5jj5olnLS4XTyc6D5D7U1BICrwe4N7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675945375, "uuid": "812c82fd-063b-49b0-8f0e-6e4f1e9f57a3", "value": 487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675945375, "uuid": "30d7d0d0-b42b-4724-9839-2b619a22cc7f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675945375, "uuid": "f1365023-81cd-46bc-b9a1-fee488679a46", "value": "verificare.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d98aad-a85d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675935426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935426, "uuid": "f2387134-6c7b-4084-b096-9c791e7e42f4", "comment": "Malware payload", "value": "b2071af668945dd95d4b717b064bf086", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935426, "uuid": "42fa2b53-a175-47e6-a4e3-dd3ad2988bdb", "comment": "Malware payload", "value": "b8a74e94521386eedc2fb9bbdeb7295a8fc0c7336e7ddc28b54c3af821981e8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935426, "uuid": "c9406678-057e-4bff-9484-640c3f68d519", "comment": "Malware payload", "value": "b34b4fdf9860f6f6d704f9356f334a005442244b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935426, "uuid": "5ae8bdda-64aa-4706-b0c7-53ca245473d3", "comment": "Malware payload", "value": "84e506af58ff9d775103b9cb5d3464cc2e648466b0bf618b2277532d52e9da3f33da8d183345e1848d71e1f6a9b9fdfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935426, "uuid": "f1bae3de-c2d5-4d62-85b0-15ee40015322", "value": "T169473322B193807CE9B70D7699F398410D7A7C2708F01582ACB4E5FEA839EC89D75797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935426, "uuid": "d03a214b-ac5e-48ed-a804-a8f3067044eb", "value": "48aa5c8931746a9655524f67b25a47ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935426, "uuid": "828e16d3-9630-4a35-9cd2-b85d981f7587", "value": "786432:zKbAoJdnz3Bk0tgDH6aLUE/Rtusl3M2qyb:GbPPzBk04j/RtJc2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675935426, "uuid": "18072033-b6e5-4665-ada7-f30c59014513", "value": 26396728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675935426, "uuid": "992fb3e8-09eb-463c-836f-dc04f9191210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935426, "uuid": "6355b55e-dcd6-4eb0-bf82-f35754b012cd", "value": "iTopVPN_enseo_win_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638b21bf-a84e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675929014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929014, "uuid": "f7bffa80-0248-458f-af4c-b7de607228d3", "comment": "Malware payload (RemcosRAT)", "value": "9e1a9254e0e02fb900db8d4723002a5b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929014, "uuid": "0682ccd2-ca2e-4add-80bb-89087d2e5264", "comment": "Malware payload (RemcosRAT)", "value": "b8b2664eba2a3c40cddd5cad8a4f6cf5b08be6eb4acd79e20f02a3c5cedd4db6", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929014, "uuid": "84bae76e-8534-43ef-a284-7148df039f9a", "comment": "Malware payload (RemcosRAT)", "value": "3bf76d1a6a0a5520fb80a1908faeb2c7186a556b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929014, "uuid": "b5bfd5c2-472a-48c1-8fa1-13f22577e552", "comment": "Malware payload (RemcosRAT)", "value": "636e1a926d81ea93d437d98ab840257f7c54f2a07100255bb401e047dc93453e252c6535317b41b6722d3b17e1b1a1ed", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929014, "uuid": "828fafc6-3ecf-4009-83f6-cc323e909568", "value": "T1CBB423819A91F56807E159CFA9310693582078D96CA76F4FF71BFCA20339DFAE325620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929014, "uuid": "4b704391-ae7c-4c6a-bf68-0636fea0af20", "value": "12288:XtYuhJCE8JfVH/mUOkKzY0G44jzVCRORqwXFZUr54yv:XeEeH/XOtzGpjzbRqwMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929014, "uuid": "79897a40-3f44-4877-a810-ec86d70b0c07", "value": 530506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929014, "uuid": "e2625a5e-dc73-40ea-8f28-66848979028b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929014, "uuid": "b27a3e57-4173-41e0-8ae1-99f3af22074f", "value": "PRE ALERT SHIPPING DOCS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f1eb82-a8af-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675970861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970861, "uuid": "90704fc2-3565-48bd-9d4a-3d60a85d23a2", "comment": "Malware payload", "value": "03c3fa212635023b2b43704a8c9f2a30", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970861, "uuid": "3d96d841-45fb-4b91-ba0c-aa724b09afdb", "comment": "Malware payload", "value": "b980a6e6806a042f0cea2bf32f4c70e0cf0f6eddef3327722f7c0e15ee37c301", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970861, "uuid": "20707caf-6069-4047-9196-00a4c8626944", "comment": "Malware payload", "value": "6ee41cb45cee4de09ac16cdd43d7048e5e2a4b92", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675970861, "uuid": "51522b2d-d926-4938-9901-198a24200871", "comment": "Malware payload", "value": "c5340e57c10ecc11321d457c6c6850534065cf75ad56ea337977f971cb2159ee35da28f10d8cba5004091bf022252161", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970861, "uuid": "7be6d9a8-544d-46d7-9160-cad6e39e3623", "value": "T149B19EF27F7535B5D6D300BE9210604FCEAA600CED919D9172E2466E7A4A75C99EC308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970861, "uuid": "0edce7ef-d38f-4fcd-9bcd-a1da7317ec66", "value": "96:spWfmC4iwGhvn+BjHYe8C8qW5sQlrkPZPn4FtuQwgf1YdiWMySd89E+61LrdF0:aiwGhEjuD5zlQPxnWuQwyGiWMySdxrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675970861, "uuid": "9f0bb85c-2250-49a9-bde8-207b971d1f24", "value": 5167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675970861, "uuid": "395d93e6-0b6e-47a6-8558-ab5a747f1a06", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675970861, "uuid": "ab9839c7-98a5-42ca-aa48-9d49fcb5ff43", "value": "Agenzia_E4(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb185aff-a84e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675929188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929188, "uuid": "d03641d0-1295-4ce4-8482-5024c3ff758a", "comment": "Malware payload (RemcosRAT)", "value": "8de03f1102db0bd3608ff662b22262c5", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929188, "uuid": "57e04329-ab04-4552-b4c4-3f1486845879", "comment": "Malware payload (RemcosRAT)", "value": "b98d4f2e7f59188456341fb81f310d0a063d41b1ae947a0225ee087397957ff5", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929188, "uuid": "963b229c-2f23-4185-bce3-4e66fef009ad", "comment": "Malware payload (RemcosRAT)", "value": "2bd3c51e2a9498e3f4a22ebf31ce14fb1105f44e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929188, "uuid": "5c06a0db-a7fb-4df7-b475-bf4275e053d0", "comment": "Malware payload (RemcosRAT)", "value": "38dc10c20257ffaa09ea714e60abe239f89f2897d82789ddcebfe16c162478db7e669b92301b60dce3a44f20bc2a78c5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929188, "uuid": "7fe93305-2196-4dcb-9271-6dd9ac236d12", "value": "T1E1B42314EEA7AFC904DEC42B7C8ACB184A574D5C4BC3A04D770D0F65978F24F9A8D662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929188, "uuid": "c9789962-3c9f-4e9b-b399-282402249555", "value": "6144:lp+IhIOQnIWCxU472AirXpM8k72LRMVadKpNQ+VXB9xeluA20DYbyaS0FDZUTd+r:jX4rqmj212YadONPVHeuhuaSkDZUTdzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929188, "uuid": "86790e32-a25d-48bf-bca1-f73b8d2790d5", "value": 510202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929188, "uuid": "6ee7f068-6e2f-4c49-a26f-159e0892ad31", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929188, "uuid": "9e67c494-4c71-488b-85ed-cc5c197b4fbc", "value": "Draft Contract.pdf.r17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30671c64-a854-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675931506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931506, "uuid": "44135412-d2f0-4e65-b585-7d900a3239b4", "comment": "Malware payload (Amadey)", "value": "ff3b73c8a2dc1626b7eb231c01a8782e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931506, "uuid": "0fb56171-b5df-4d6d-8143-f478d88cad07", "comment": "Malware payload (Amadey)", "value": "b9fbeb0d4162a593501da9f5832c2d4cec4e474e24466f84bcee54492297eefa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931506, "uuid": "f2438175-118d-46b0-a3fa-ce31d74e64f7", "comment": "Malware payload (Amadey)", "value": "bcee28ffa7b70162e12f8b88619d149e281ff8c2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675931506, "uuid": "a37ba384-307c-42c2-bb1d-4ea676fb72d4", "comment": "Malware payload (Amadey)", "value": "bc5ede6380662077c21a031ff74be851aa39b9f5f201369c6ea31a65b7d8ed163788300d96a5c3c14bcd51524a4d3287", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931506, "uuid": "09cf7fed-820f-4c76-b4f4-ee44d2d87ff1", "value": "T1C2B40257E6EC4061E9B02B7019F706D7193B7D716738829B234B2C6E1C726B4A27137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931506, "uuid": "51ce6aa0-4f56-4547-870b-459d94b960ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931506, "uuid": "f2df7a0b-4fae-401c-9fa5-0c0911cfbd43", "value": "12288:kMrSy906l7gP10KmS1AY/nhQthSUuCW/I7:+ydMPmKmJacuRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675931506, "uuid": "e3bd689e-6897-463f-93a9-505c52779618", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675931506, "uuid": "0546d4d8-b88f-434c-ae70-31c639966abb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675931506, "uuid": "772b6fd7-502a-44db-b962-9fe56088b6ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e108ca-a815-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675904435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904435, "uuid": "6a6c66b7-87ec-44eb-aa29-1c2582d1d493", "comment": "Malware payload (RedLineStealer)", "value": "6c92aa5416ef0b1d384651e6e39f0f9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904435, "uuid": "99f78ae3-f5ad-4f87-b9e0-dbc7242c008c", "comment": "Malware payload (RedLineStealer)", "value": "ba06dbb9474f3051a6f5ea7c7cec3fa103d2f764d59ff1b67f1d5456e0e142a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904435, "uuid": "bc54fd1c-201e-43bc-beb6-02069f5530b9", "comment": "Malware payload (RedLineStealer)", "value": "292a3bc12423bd6d003a7e6efcae5f724af1c9e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675904435, "uuid": "63a848bd-eee8-4dc9-a114-4cfe68096849", "comment": "Malware payload (RedLineStealer)", "value": "83009bcfb117eb18a5024b70c1f349237e33c3ef76a317013fa6898a826a7f494322e687d0858090218367b2d31af52d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904435, "uuid": "28f6270a-bdf8-4683-90db-e6f68496483b", "value": "T1A5946D039391BC80E6268BF2DE1EE6EC766DF5908F4BB77D12189B1B34B1172C567A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904435, "uuid": "cc9059b6-95b0-44d8-9474-be9d19e21d84", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904435, "uuid": "1011f64f-c743-4a88-9b2d-7cee76dfde26", "value": "6144:kMaPnA55h6aecejp9mwy2R1HsYxBExXZVsMw4QkeQGSmF:kMwny+lceXmnm1pxBExbswQkei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675904435, "uuid": "4c5d52d3-97a1-40f7-96f9-7e6d507f033e", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675904435, "uuid": "18d7c1fc-bb77-47ec-b1c4-a8ea14cbffb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675904435, "uuid": "712b4a8b-bfc1-49c4-9168-0cc9c741bdde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4077669b-a884-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1675952148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952148, "uuid": "6dedd4fe-6fb9-40e9-941c-2f363a89d2a9", "comment": "Malware payload (Guildma)", "value": "9babf2a01fee5de4307637f15cd1ed62", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952148, "uuid": "db343fdc-41df-4b6c-b3b7-56738ce2932e", "comment": "Malware payload (Guildma)", "value": "ba3553c02c0744592e15454ad234f0d2711b74a021b134334c0263bc502af7dc", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952148, "uuid": "c6f3f029-47c8-4407-857d-d7883d068768", "comment": "Malware payload (Guildma)", "value": "54e311e07cd8566f637f1f15292b5c21ed8da35c", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675952148, "uuid": "9c75c4f4-cbcf-4194-b57b-269971db8313", "comment": "Malware payload (Guildma)", "value": "c18ca2e859085f2e9820b2dec772880ad6cd9f75fe72ff17b56ff03ed97122e5bf62e6109bd03ca904d4295a0b8e35c1", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952148, "uuid": "ce5be360-9512-40b9-a399-7816a62ea7cb", "value": "T1AFE0728DE0D28F82400E180D2AB42E02290C2C750C90B8878ABBBB025F38C08A43EAC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952148, "uuid": "ba64c593-1192-4005-bc26-7a9192dd19f5", "value": "6:SGIfGlkw5JtncEtfoVIjd/L8KOm1msXel9hWJIB84vpYjvbWgBAril61:QgkQD9oijd/L8KOm1m74JwujvKpe61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675952148, "uuid": "7fdaa479-f6da-4ff7-a6ec-02c6b27d47be", "value": 309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675952148, "uuid": "f366b204-7594-49fd-a91c-c38196440f32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675952148, "uuid": "f995e5d4-4ac2-45a3-9ef4-320879e7d1c3", "value": "9babf2a01fee5de4307637f15cd1ed62.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab18232-a8b6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675973801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675973801, "uuid": "ebb7158f-7a83-4250-932d-8cbd840c82a4", "comment": "Malware payload", "value": "262a9c846d31f82aba3546d6099bfc6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675973801, "uuid": "ec8b29b3-2efa-4448-8f40-2df6e7f9a5d9", "comment": "Malware payload", "value": "ba5cdd881f9f00d471e168281e367ea1ea8744a79ee488c23f0fb1c61b321a6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675973801, "uuid": "a607665b-ef7e-4e55-ac86-dc2190dbded3", "comment": "Malware payload", "value": "8e3193c110f3d5e00281b48f29165da231b7bad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675973801, "uuid": "4f75ce03-750a-474f-959b-21fdc3a714e5", "comment": "Malware payload", "value": "f738bdf82ac582f84da7c78adf2917fe2ceb0cda15be29f5bdc9d559a15410f86afbbcd8707cd885215e3390dc356925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675973801, "uuid": "a1df7bc3-5f08-4293-ac3a-aee372f3f06d", "value": "T199B5027C7145C86DD280FEB48C3AE8E75CD66DE3E9E4A06270D87F3F857A1889A09513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675973801, "uuid": "2c894aa9-734e-43d6-89a5-f1a5223e2e45", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675973801, "uuid": "f724b1e0-c453-48fb-8584-a630d7e0f6cd", "value": "49152:rdHN3mnCaMm05vJaeYdhQXH6AW2kwzLLCgv2MR:JH8nwpdYdhQXjl37v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675973801, "uuid": "8763a41e-4adf-41aa-ace9-6c1fd39fc136", "value": 2469112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675973801, "uuid": "4ec19418-d02f-441c-949c-a51e35630533", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675973801, "uuid": "8731e2fd-8264-474a-94bd-398e4f6cc8e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55bbec9-a88e-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675956666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956666, "uuid": "e613f7fc-15e0-4e08-8c10-da59f2a20d20", "comment": "Malware payload (njrat)", "value": "68a8e2843f9866243c6d2afa0cfeb574", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956666, "uuid": "3023cc3d-f057-4c5b-ab21-7f7fa3cdc9f1", "comment": "Malware payload (njrat)", "value": "ba82b07f535e8521a5e9ad4f6ae491d1456035ae8dd07a93be6342ed1b04018d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956666, "uuid": "9bb3f805-085f-460a-b8e4-6f75749c2cf4", "comment": "Malware payload (njrat)", "value": "fde9c0ba2addd6446badccac48c2c3f98b2ab3b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675956666, "uuid": "a9f8a43d-2cdb-442b-a155-084e20204869", "comment": "Malware payload (njrat)", "value": "9f04079f52a3363d950a67b81bd3a3684db020e2ffd79bd1a1f9fd3190f78cd97797d34d416ffc7ff6ae9f6cd0f5679f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956666, "uuid": "22698bcb-dd61-4928-ba11-9c8b3f79d1ba", "value": "T138B2180E3FA98856C5AC16748AA5D65043B491470423EF2FCDC550CBABB3BD91D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956666, "uuid": "69a8e965-c526-4a35-96f5-be421193f6bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956666, "uuid": "736cac08-0a5e-412e-8163-7f5565fcc228", "value": "384:qMK6b2GZsx/Yr1+liORH1kciFQ6Lg9gSOYRr9mRvR6JZlbw8hqIusZzZMb:Vb9glF51MRpcnu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675956666, "uuid": "00494e0b-2cca-408a-8b89-efd85e9835d6", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675956666, "uuid": "ee1bc446-1f5c-47b8-8874-8122e6aee9df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675956666, "uuid": "113dacee-8d9b-44c0-ae15-f50f10af6e3e", "value": "68a8e2843f9866243c6d2afa0cfeb574.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5d884f-a886-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675953113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953113, "uuid": "c45e139d-3500-4dac-ab2a-0ed8caa0ec0a", "comment": "Malware payload", "value": "49e0221721cbc1a9bb5e192f155df9fb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953113, "uuid": "32ccf7a0-36ae-4fb3-a24e-2f9b71487c22", "comment": "Malware payload", "value": "ba86f6e708ded396df7b36f37f3e20bb5f8f6c2675d77611b6c8c1efa1fdb3d8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953113, "uuid": "f09e413e-27aa-43a1-a9ba-e10793098362", "comment": "Malware payload", "value": "d824b4e135aacb41ab1b670b4d03a77dfd2fcdbd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953113, "uuid": "b8f0dc3d-7a90-497d-8085-de7e54656de4", "comment": "Malware payload", "value": "5e7b5b6bedd60f9744717b0b578bd46727e00a27b7b78956e4cbbaf994c461590ad9f422945f669cdf34bea7204d16b2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953113, "uuid": "1b3ee02d-b47b-420f-920a-cbde1428e66d", "value": "T1D9E34A17B3E831E8D626C53589A0C516FB33BC651A219F0F26544A7A1F323A1FD3DB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953113, "uuid": "32632315-3f10-4f25-b4f2-d333b02dbada", "value": "1bc8760ae70fb16e8bcc6416dce42e07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953113, "uuid": "735647fc-7435-4dfb-a84d-dd370e0caba3", "value": "3072:CpuydTBXnC1mr/U9AOMMvuQwxAnfpYl7D4F+bwMq:Cwyi1m/XQwspOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953113, "uuid": "124be8d7-7e9c-4f7c-ab78-49809fe0697d", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953113, "uuid": "72d2bcc3-8a36-4616-9f08-01e5be387b1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953113, "uuid": "f705ac67-70fc-4cc1-a408-8f2a3670ccd2", "value": "2023-02-09_49e0221721cbc1a9bb5e192f155df9fb_lockbit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820e454d-a818-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675905873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905873, "uuid": "974f3fe5-112c-40ff-bc7e-3e6ecd84ac08", "comment": "Malware payload (Tofsee)", "value": "a49562047d3ed09555ad6a1429c40ae6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905873, "uuid": "8ba46049-f3da-4f07-8348-d595aeaaaeba", "comment": "Malware payload (Tofsee)", "value": "bb60b4c41a6c6b2c03a26ed80eb7d43ee3904b5f3dd0a52e4a821a74fedb3501", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905873, "uuid": "badd91e9-0135-44f5-878a-16206ed7a26d", "comment": "Malware payload (Tofsee)", "value": "596e1daf29cb6b80b494ac16b97e03a3c061b156", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905873, "uuid": "2bb6636d-18f0-41ad-9d7f-f791951bae1f", "comment": "Malware payload (Tofsee)", "value": "f7231bff861b6b30e16c50cb8c066f99bed1485f700b561daa796f3edd95b882c79dcab215685d1cba139b5fe19533c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905873, "uuid": "2d527c4a-8dd4-47b2-9479-59a98c7dd1ab", "value": "T110641A03A3E17C84E63A8BF2DF1EE6E8765DF5908E4AB77512189B1B34B1172C563B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905873, "uuid": "6520554c-1e37-4d94-9ff7-0a3ac96ec848", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905873, "uuid": "59ab6360-405d-460d-b68d-6defb11d1ce0", "value": "3072:MPEFDGVHWPRdifljMh0TgcuKmgXVVWH//lxXXKcVwLCQENe+pGS3jiCz3:MMFiRAiflMnXgXVAjHDVw2QkeQGS3+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905873, "uuid": "8cf4a6d2-16d3-4a1a-97f7-5e2bde805f91", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905873, "uuid": "b6a1c7c0-e7e1-4572-9248-b8011cac53de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905873, "uuid": "c8e5df9a-93b1-473c-aff1-e14c8ca8348d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a29fec1-a886-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675953051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953051, "uuid": "ce264a6c-0f42-4cd6-b1ad-6c2e62f66d8c", "comment": "Malware payload (AgentTesla)", "value": "ba5ca5f354552dca47ca8ec309945a89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953051, "uuid": "adb1afdc-290e-438b-9a29-26416134776c", "comment": "Malware payload (AgentTesla)", "value": "bc3bca932a25560bad07745f5a506d10a3c44e5cea59c9cf93f92a75ad506a7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953051, "uuid": "390ac0c0-3a79-4c91-9dc5-9a296c8e4d58", "comment": "Malware payload (AgentTesla)", "value": "ef65843297c312e79a2298d433d57a380d977fc7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953051, "uuid": "ab287477-b5b7-4350-b0c8-5cdf8c2e8054", "comment": "Malware payload (AgentTesla)", "value": "c6550f329b28ab21c4c8ff38b12ab47d8d092c8cf7101fe89d548dc5057e6844b73c13384b46c702a46f2f04de7ad6aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953051, "uuid": "08f21ac2-8759-4c96-bd28-4deb642be30e", "value": "T129F34B68A2C99D53D32D40B4C8B011480BB291475607E7AD1EA1ACF63E467DB733FFA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953051, "uuid": "f167b926-f670-43b5-ad6c-5abcec9e76ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953051, "uuid": "19361b02-6d55-44e4-952e-52ad705bd18e", "value": "3072:+NJgtBqryAnO10ysHsVTRI6V31UF+h0XuXKTCalgQUrFFD:SryFRsHs1e6UF+MB+ZhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953051, "uuid": "93990030-468c-431d-b14a-1ec9283dac15", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953051, "uuid": "fb288e10-a8a2-4abf-9e7c-c368422907d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953051, "uuid": "7adcfaeb-848d-4daf-a947-1d9dab09b5b6", "value": "ca865bb9-e407-4bc5-9409-65b3b1d9d236.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02423eff-a86e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675942595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942595, "uuid": "ce78d5f3-fc94-4cb7-b0d6-d52d1c4da666", "comment": "Malware payload", "value": "9bcc18a834e61f6cf1d9e6b4720b43d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942595, "uuid": "f6448e11-4552-410d-b301-5d6ed8ffe22e", "comment": "Malware payload", "value": "bc5a360ad6ea689ccf06068eafd86eb9a5a87e8ffeacbcdc925e9086887d8da5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942595, "uuid": "7ce631cc-731d-4e80-b9d1-3682ac78c9c3", "comment": "Malware payload", "value": "f02560cef50d0a6d66fd0c948d75b024f6a58413", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942595, "uuid": "dee1947b-5b30-4df1-8da9-fac5f70b52f3", "comment": "Malware payload", "value": "390212013b59955b69e0e8da48a6f24872c2272178e3c22444f3900bc6d870cbd7342d59808acc4f88f9fe54b6eaf337", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942595, "uuid": "b5619209-0e3c-49f7-9510-24ec51f370da", "value": "T15DC37C5178D0C072D46629314878DAB05E3EF9340E749EABB79C167E5F302C19A39EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942595, "uuid": "1957a386-9073-4673-983d-42fb4ca5b59b", "value": "975cca30fc6fc8cb327e3c61bc677b38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942595, "uuid": "c42774ca-7f85-4a31-bf78-5b6da6c0f36b", "value": "3072:1hfSAPbxJt8vSRbKc2lMn/ez7W1YyqDzkydo/8NiEXIgdKPvsaDAi:PJJtBYcpn/ez7pzkCiBAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675942595, "uuid": "90ce7e86-83d5-415a-900a-c45d921014f2", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675942595, "uuid": "e53aa9b0-13b1-4c9b-812a-32cbee0738a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942595, "uuid": "2959bbf2-d306-41ad-8dc3-52743aad95f7", "value": "SecuriteInfo.com.Variant.Jaik.95172.5605.22089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d3c706-a8d5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675987029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675987029, "uuid": "31d09e1f-6e7d-44f6-ad91-524900016005", "comment": "Malware payload", "value": "7438feb1076be1f3830aeac8d6fdc495", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675987029, "uuid": "b0a191d7-8c57-426c-bcaf-3b80f0b969c0", "comment": "Malware payload", "value": "bc9f0c7b6db2825d23331a1e32a21ca969bbc04eb684a99899c709e59c06591e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675987029, "uuid": "b19a576c-8efe-4a67-9caa-390dcff4a1a7", "comment": "Malware payload", "value": "f5974c38420622e5385a877e85cdbf90aca76bb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675987029, "uuid": "2e0c2bad-19c7-450c-b69c-136522e2837f", "comment": "Malware payload", "value": "d6b03fc9f1bce5ed65d99bc92120b7de804d33ed9f4e404ad9fd3200617fd17bbfb1bb3b132631de4ca2811829863159", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675987029, "uuid": "ae8c8b6c-1707-496e-a10f-d9c76d352ae0", "value": "T17CB4020BEAEC8072EDB1177018F643C306367E916B34939F278E6C561C736A4663676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675987029, "uuid": "ce8c1ad5-08ab-4625-8be9-d2fc15833f49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675987029, "uuid": "17fad2bb-f3e3-4a4d-bca5-fed268c9f6a9", "value": "12288:KMrTy90xHeJxjqM9eUWlnvUAytRFPgxQ3UgRw0Cbmpdw5UR:lyW+JxjqM9pAytXGQEgKVbmbwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675987029, "uuid": "6efa6bbe-17a3-4e72-a38e-5b79385e6544", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675987029, "uuid": "2a235670-c79b-416c-a5f3-1c1e89ed7a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675987029, "uuid": "31a2900e-7583-4587-967e-56c2c725bfdb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29fd576-a84d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675928825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928825, "uuid": "cbc1b244-81b1-4b61-b5b8-a5ba65b78ea4", "comment": "Malware payload (GCleaner)", "value": "1c22527ae5961ae786c5668fda2c96dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928825, "uuid": "2e8cd6be-ed4f-4f78-8050-4069f2406b6e", "comment": "Malware payload (GCleaner)", "value": "bca57bbcd20f63906ca73327caf208ec5b34092abec9bf6b54df448351f64946", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928825, "uuid": "c141b1a6-2e89-468d-9a5b-5562d3ce11f4", "comment": "Malware payload (GCleaner)", "value": "4297b2fbef21d3d0eaf2c0668396cee18e3f8e28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928825, "uuid": "c404a60f-1817-4fa6-8292-c16820b4d4d1", "comment": "Malware payload (GCleaner)", "value": "bc44a27b0f81532f6e94b5646fee2fbf029d704d29198400259a14258196d948f35843dca5cc42014540bfa5952540e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928825, "uuid": "e73c491a-e09a-44e6-a665-0a425dafd831", "value": "T1D2D5127C7545C86DC280FDB48C3A98E34CD76EE3E9A4A56230CC7F3F96B91849A0A517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928825, "uuid": "09b33885-eb69-44c8-a509-585c8c8df671", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928825, "uuid": "5d004c76-0c46-4eb4-91f3-307fb26ab8c9", "value": "49152:rdHcQj2CoA25yOU39FMuA2QLu8xjJTxXcVOLCgv2MR:JH9CCoA2tU3DQLuyjRxcuv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675928825, "uuid": "9c74abfb-daa2-4c94-8ad6-89f4bec241a5", "value": 2752212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675928825, "uuid": "a6512ce8-920a-4745-a977-3edc25f6075b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928825, "uuid": "eab63140-ad0a-46ed-9102-a756f2495969", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3224d56a-a813-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675903591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903591, "uuid": "38864e72-0255-429e-b870-3e00c413e483", "comment": "Malware payload (GCleaner)", "value": "0c6166c86d6e5567d07089b17ee9621d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903591, "uuid": "8a11ca21-7f01-4e07-92cb-4520e9c8c6a0", "comment": "Malware payload (GCleaner)", "value": "bd26e2e684f251f318f5ac8ef5105fd235e21fa338a26b1d3238fcd9cdf5271b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903591, "uuid": "b5f2b64d-fdd6-49f4-8556-1a8a74aa1742", "comment": "Malware payload (GCleaner)", "value": "46a1a8a77443a49faf3cfb00de1f4ef146a0de33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675903591, "uuid": "6179d9d4-065c-48a4-af06-da599e9a643b", "comment": "Malware payload (GCleaner)", "value": "e927b12e1f5a547c039214a0c3e3ee40605468e82f83aee4f8b08b4afa3a424d36d2afe700e69e3b8310207cbfbaacff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903591, "uuid": "9d6bc8d7-2b63-4203-8a68-1cfa5797d436", "value": "T1C3C5127C3145C46DD280FEB48C3AD4E72CEA6EE3E994906671DC7F3F95B92849A0A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903591, "uuid": "dda0c029-24dd-4f42-8659-58e69249d2f8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903591, "uuid": "a08c5627-bfa6-444e-827e-4e1116fc5cce", "value": "49152:rdH0hF2CXHYIfMFIrcgophkrxWC/cReVecs/Rz1JqFHuiFH1LCgv2MR:JHcQ5If2QToha/cREuV3sumpv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675903591, "uuid": "8fbb0d8d-5556-4a37-b69b-1ae674987c6b", "value": 2681261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675903591, "uuid": "b3fd918e-f7b2-4909-9fc4-48ea04fb1866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675903591, "uuid": "2ab3878c-79ee-42ee-a362-e07e77581dcb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042e3fed-a80d-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675900937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900937, "uuid": "304d66af-3cf3-47c0-8484-3ba5cd09d8a0", "comment": "Malware payload (LaplasClipper)", "value": "a446af44034eef656f41f7472e8e7a5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900937, "uuid": "5ed3a776-3b6b-4148-a807-b1705b05981b", "comment": "Malware payload (LaplasClipper)", "value": "bd4862c187e54926cf692ecd34a80c282f2d2992769459197bf5b7691da0a358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900937, "uuid": "3d3a2d6b-512b-406e-b436-ac6e63d99eb1", "comment": "Malware payload (LaplasClipper)", "value": "f09246cd2d0f689eb46d05db459eea9ed6f8f6f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900937, "uuid": "dbfb6a2e-00ae-458e-8ca4-ee78c64c8ba4", "comment": "Malware payload (LaplasClipper)", "value": "2988b767254c1e6e7a7891a2f7e5e4ba97a01112a39ae7e1f72f31cec25aa011c8ed992b37902f70d01f4b87eacb4b8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900937, "uuid": "7dbad0b7-7bf4-4e32-9642-4aefa28228dc", "value": "T1F995120392D1BC91EA2A46F2DE1EE1E8765DF5448F0AB7791205EB1F30F2276C663E11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900937, "uuid": "09b7039f-7ba4-4f44-9a51-017ba815d46f", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900937, "uuid": "39c6c3c1-01cc-4b4b-8a86-20adcb4ce8f1", "value": "49152:CesDgONK+fSF9x+mzqEAQ7M6huXiZuphPhsYWIsuU4lbA8Xe:ChD/E+SDTM6EM+hPhsYv68O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675900937, "uuid": "a9de9a81-cbda-4d6e-9468-4c4ecf49c9a2", "value": 1992192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675900937, "uuid": "f9638938-7861-4db2-8c3a-49d69b1b4efd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900937, "uuid": "5cc7d23d-10c8-4a2a-b65b-f51c63a7ba96", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09109f7-a85c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675935210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935210, "uuid": "9870278c-775d-4d0b-96e5-fb46649bbc25", "comment": "Malware payload (AgentTesla)", "value": "c707110b5d3e33f6931bb66320972fbf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935210, "uuid": "3ef1c2e2-cf26-4da6-b86c-ebe6dda78ade", "comment": "Malware payload (AgentTesla)", "value": "bd5bb196241d12eaa18a459c997daf76cca50aab22e5530e11f441e5e6047e2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935210, "uuid": "e2f7544f-5ed3-428a-9487-082a412e9c3c", "comment": "Malware payload (AgentTesla)", "value": "c3bc71cca4af8ee4b8646d8bbe4bde5b5abe3cae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675935210, "uuid": "3baeb93a-9137-439c-86b8-08ae6f1a7369", "comment": "Malware payload (AgentTesla)", "value": "ccd47e75f9b73672865f81053a3d92ad83290904ef22b6be23ca83d5487531521bf84f5e81ed3da6775970c75b43485a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935210, "uuid": "e7354e84-43e4-41f9-808a-55c566319a94", "value": "T1CB925C642BDC2003F8BE1FB4C9E999528B7CB6E37C11D66F26D5508A6DC23801990F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935210, "uuid": "ed9de035-5547-4b0f-898c-6f7337782f5f", "value": "384:BYVYVMIL/FQIIbE3rUPzZKF6wzbaZNHZVGmGovy8ZpHGH8X:sYVtL/fIMmzM6SbSN5PyiRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675935210, "uuid": "500b4d4c-858f-4ca5-a75e-8fc522b813bf", "value": 19752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675935210, "uuid": "2232f301-01de-4b2a-b22b-cfcc1d7eb145", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675935210, "uuid": "5f131761-823d-434a-8729-ae25b4f4f0a3", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870f4181-a8ce-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675984050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675984050, "uuid": "e23dc0e9-6ff6-4b78-a6e1-5011cdd17990", "comment": "Malware payload", "value": "24046b9d4cf023f3ca0160e737d40630", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675984050, "uuid": "455ee739-fada-445e-b8bb-69361de53e4c", "comment": "Malware payload", "value": "bd5e7c52d4dc3be4205620c532d926014d4aceab2dabed28e16553d9d1b3e559", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675984050, "uuid": "85c52445-2248-4f7c-9cc7-f7649ceacd58", "comment": "Malware payload", "value": "f1e3682479bfc5e14961017857d303564b64c139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675984050, "uuid": "d872909b-ced1-40c4-a84b-37e66ec1bf82", "comment": "Malware payload", "value": "f71fbbbf1770e9350a4c72b64885dbc97120f7819a9f4d1ad33f579e1ee179318aa8e6859a0a4f47af38480fc5aac01c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675984050, "uuid": "5f404969-12ae-4058-a99d-03d654b5c936", "value": "T12EB40207E7FD4132E8B447705CF603C3093ABD916A78875B2A8D9D4E0D63664AA317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675984050, "uuid": "3431e858-db2f-4bfb-9f5d-85daf2056894", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675984050, "uuid": "d5ad834d-d7bc-4c2c-b9a8-05415cf762f2", "value": "12288:tMrny901q/4PRDp9W8M34ciz6DOYiEvWWv2GfNGWYAUCo:uyEq/++iUOYdOYvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675984050, "uuid": "f3ffb3d8-c97d-438a-b293-e190b863b663", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675984050, "uuid": "0f1441d8-197d-4cd6-b47d-e5913acd8d36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675984050, "uuid": "81d8fce7-9c20-4cb9-b25b-d9fba2005b96", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a4a3ba-a89c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1675962405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962405, "uuid": "b493a1b9-c920-4712-a9cc-cb3aa152eebb", "comment": "Malware payload (Guildma)", "value": "b4a76555d7b05a8be295ed62f1c07a83", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962405, "uuid": "ecfe36c3-50c9-46f2-aa30-33566290a148", "comment": "Malware payload (Guildma)", "value": "bd888af51a4611d91590ccfdd71bbe43102a06760cef7d35180e1682f58198a1", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962405, "uuid": "9cf798b4-4b71-43d4-9c33-d6c4d4189770", "comment": "Malware payload (Guildma)", "value": "7b6bb7ab9c3079bc15cb3a5ad0dabf626bacd32b", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962405, "uuid": "dd270411-6bdc-46df-98a9-a06bae6014c4", "comment": "Malware payload (Guildma)", "value": "4079ed99317e4b42047799f179be806e51b7eca0520aa67dc526a9f4d0fda61810ae0f3157334813e3bfbfe314476d2b", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962405, "uuid": "088a517c-3df6-463a-b951-0869f9e4646b", "value": "T14AF0AB0DB2B22DC2E82C4233DC6A4B151C6F3CD60F1660770A4F128D8DE4D09AA0DAB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962405, "uuid": "110e377e-86cc-4e50-ba99-ed7f7db15d59", "value": "12:8rflM8OBE6ZG8WgkpaZ6PWjdHVLJnOmPm7vT2atmUPT/fpaBEz:8loG8WFpaIWLLJnOMm7viazT/0Gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675962405, "uuid": "5ce590c1-191b-4927-a421-dad89a3df10e", "value": 493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675962405, "uuid": "56e24c26-7612-4899-859b-c18085c675a6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962405, "uuid": "121b90b2-0654-4ab8-9339-d162d16685ec", "value": "b4a76555d7b05a8be295ed62f1c07a83.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a290920-a80f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675902021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902021, "uuid": "1572dc79-a901-4807-bd8c-975de760429b", "comment": "Malware payload (Amadey)", "value": "f34cda104f60d2cd7977e74991be0172", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902021, "uuid": "f49934a6-ad26-49b1-9c41-99641b569505", "comment": "Malware payload (Amadey)", "value": "be43abce69e4ea23de2ddd033c9f8194a6296b08263ce45b64df431a780dabd8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902021, "uuid": "b1c5ca10-db77-4027-a0e5-f6d92e5d4e58", "comment": "Malware payload (Amadey)", "value": "be19c126d42c7633262819643b45e9be0c2c29de", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902021, "uuid": "5f8c66f0-4bf4-4bbd-93e7-374fb10353b3", "comment": "Malware payload (Amadey)", "value": "349bb7743b58e90732b1e0f232212961bef488e907b2b2e71787a9c25258e9bcdd57aed4b0361a0b16986eb3c1537e2b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902021, "uuid": "00b5abe6-e19f-4492-8cfe-519094c74a92", "value": "T173C40247E7E88032D4B527B018F603D30A36BE61AB38C3667747A95E18B25F4A635737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902021, "uuid": "563bd54c-ec03-466c-bcef-97fd6b71767f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902021, "uuid": "9a53493d-e7bd-4925-8112-aabf5a50fd0c", "value": "12288:RMr8y90kwQ+BmY4AtlRN0XtTupp2NWeAtmaMUYDQIcLAFGWwUW:5yZ0F4s0XtyGEe3PDQJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902021, "uuid": "ddc6d293-aa7e-4729-96c7-438fba6ccd77", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902021, "uuid": "4c2f0931-b994-4ec8-a415-f3b952ae905d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902021, "uuid": "d0320edd-6495-4ec4-9952-ba3d7e67b545", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a78994-a8b4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675972672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972672, "uuid": "92615113-fbad-4681-b600-6c95cbb85b82", "comment": "Malware payload", "value": "00b11b6b3083d69397733ad54eddc213", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972672, "uuid": "943f0fa3-d84b-4f6b-8d17-e1ae25d6acb7", "comment": "Malware payload", "value": "be46e3379dbfe1abaccb957d5b8cab32a34dca5bc32cbbda1048dab41ac1fe4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972672, "uuid": "4f640e95-aed1-4b55-9e4b-49bb042cf729", "comment": "Malware payload", "value": "17b8533d4d86d85548a743b530347ccbb77e3f7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972672, "uuid": "3da6f86b-e486-4e1e-a629-7bd3aaedbfea", "comment": "Malware payload", "value": "1db2bfd64f84f87eb3a24cb20ea75927e4e1ff8b2c6276f55471920fb7767bd532489c0d33959ecf383a98798f1559f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972672, "uuid": "03b48c25-7a53-4123-936a-ca77ee4b7da0", "value": "T112B4020BF7EC8032E4B5577048B702C31A3A7E916B78929B235EED5E19722A0B570777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972672, "uuid": "0ac316d0-71e7-4538-9075-13b7a5218ec1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972672, "uuid": "064680e1-4b96-4cbf-8292-314f715ab6a8", "value": "6144:KXy+bnr+Ap0yN90QEXXJvqgXR5S9xFrsUbv9/GBTLsg9HqCoqInFTbKEEUvHpcHh:dMrUy90pJDXR5SXm4+BHsprFTdaHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675972672, "uuid": "b6a617f0-0829-41ad-b92c-59fb1091c3c5", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675972672, "uuid": "63e4bbc3-7bb8-4f31-9dfd-87f30a0380d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972672, "uuid": "896e8c74-40a4-4dcf-b515-431c1f2c5cb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dcc743c-a8cc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675983148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983148, "uuid": "0ef502cf-cdce-4b24-811d-9d21772c90a9", "comment": "Malware payload", "value": "5126251d8f9f5998e1814c047e44565a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983148, "uuid": "550d7ef3-add5-42fa-bddb-93c2a3bd6efc", "comment": "Malware payload", "value": "be934f29b1c69ea0afd0b983f19102d167fd73d255edb3e2f1839fdc21ea9a7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983148, "uuid": "f6926f60-6e4e-4120-9662-a79fc6319468", "comment": "Malware payload", "value": "24c5a358c6e6db2b865f028dcd737895da2fcc44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983148, "uuid": "f2be5839-da46-456d-819c-84cdd39533f0", "comment": "Malware payload", "value": "29a25f317e4800a5b442b28b25238aa400aa9978c9f60369de16d0c237b8e1df417ca912a123efcef89cf8b5c54f75b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983148, "uuid": "f4e822a1-1cb7-4a62-857c-50a8f4b966bf", "value": "T1AFB40207E7E88533D8B457701CF203D7093A7E609A78875F178EAD5D0CB26A4AA72727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983148, "uuid": "4681dfe2-3f0b-42dc-92b1-c440a4c570e8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983148, "uuid": "8cda9c0e-3f2f-4bc7-97e4-61ef86ddcab4", "value": "12288:yMrTy90W7xdR5lnKN5mZhliz6DmYKEvWIvOkJklvFTxi:ty1dkKziUmY3GkJkr1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675983148, "uuid": "c01c4343-7392-47fb-8080-6c69276dfff6", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675983148, "uuid": "b0b201be-90da-4840-9470-dd6eadc2a34a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983148, "uuid": "d027c817-f0c0-4006-a563-28b8bab90b9f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4731318-a80c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675900884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900884, "uuid": "c81ef402-833b-4b0a-a513-55931ad681bc", "comment": "Malware payload (Smoke Loader)", "value": "7fedccaef9250657cc92b975aaafb422", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900884, "uuid": "378d37af-88ae-4ca5-ac42-e4af2c2610db", "comment": "Malware payload (Smoke Loader)", "value": "bf186ce696de63f1e1cb403cb30a7a0bb085eab2533e2f44df6b9dc42d436661", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900884, "uuid": "6442e07c-885a-4ec9-b3eb-3c3bcf29cc41", "comment": "Malware payload (Smoke Loader)", "value": "81b657d19ddae24af2fb70d3057277f90be46569", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900884, "uuid": "62519af3-a78c-4c9d-b3d1-5cb8228c4de1", "comment": "Malware payload (Smoke Loader)", "value": "88053d13f426223f4b975e437b209b270fdc6a442723c08cc281d8d17ce8be0e5683f02a711b06965bd8714e4d302a93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900884, "uuid": "1e0f2438-ae69-4f1b-8f26-0e5ebf897df5", "value": "T1EF640A0393917D80F62ACAF2DE3EE6E8766DF5508F4AB77512189B2F34B1172C563A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900884, "uuid": "510a5f48-e8a7-4ac5-bc1f-55f8989a70b5", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900884, "uuid": "deeb3cef-35b9-42f2-b63a-baced06d20ad", "value": "3072:TPEanYGSPRdg7Hi3wzuDPOhAVhNSXOIqsCQENe+pGSNQNdz3:TMandEg7Hi1POhOhHIqVQkeQGSqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675900884, "uuid": "d7d2fe14-d016-4904-a728-42fe27e9298b", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675900884, "uuid": "9c747b2a-e89a-4227-b32c-28971fa8e430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900884, "uuid": "3850318b-01b7-4ed8-baaa-d0e69f584709", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b003e298-a887-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675953624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953624, "uuid": "344fae98-74b5-4b06-a777-55064e970a81", "comment": "Malware payload (GuLoader)", "value": "3d462377b6c4e55e95dca0071ae425b4", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953624, "uuid": "b5c2b766-5bba-4b31-9431-dea8f2b7b282", "comment": "Malware payload (GuLoader)", "value": "bf5eb0d4970537e8773a20dccfe051e9380fe0817abbdb4cb547a70c61410f30", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953624, "uuid": "2b7a65d1-7d81-4c89-8dee-62dfd925499a", "comment": "Malware payload (GuLoader)", "value": "f713bb3a622e78eee4886527b29515ea0b96af9f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675953624, "uuid": "7c987415-b398-470b-9a38-88d3043261bc", "comment": "Malware payload (GuLoader)", "value": "57b5734823cecc3d8f55043a34146f6519930b50836b4140eb298a3ec689459913eb934cf0b3e4e0a9e2217185d99d52", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953624, "uuid": "6f7290c7-79de-486d-a8b2-a7ec434c902f", "value": "T15D5423280662E833387FC2B789B01994CB5F8677F4579E00F56E31C8B571BAEA415DCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953624, "uuid": "2824342f-7f21-4645-bc9e-4b8600c6aadd", "value": "6144:0NW7s9gQbzaqkLaXZjYYpwYx1f6r/YYUY89afc9gtsEynX:gzbzB7pbpwUqYY89TK8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675953624, "uuid": "ec1ca475-d0d8-4bc9-b574-0b2294d81292", "value": 287690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675953624, "uuid": "1c070322-900d-4733-9cc2-543324a3c0c5", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675953624, "uuid": "aed36046-02f3-456f-90f9-5743c9b12cc5", "value": "Rechnung.pdf_1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de80dd3-a8a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675967150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675967150, "uuid": "e7c4f6e3-4609-4fad-b01d-47a10fb21f79", "comment": "Malware payload (AgentTesla)", "value": "5478729e3225d4f158f811d03a8d4945", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675967150, "uuid": "60501900-5d1c-409d-9f1f-af3c9c5ec290", "comment": "Malware payload (AgentTesla)", "value": "bfd2500b6963725aa9252fed8eb549a976ca73c9317746c40e5eb406641eae17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675967150, "uuid": "ce7ba0b1-e059-45db-9efc-72cd01a32615", "comment": "Malware payload (AgentTesla)", "value": "e0dc6b437e0597da471e18d2ee55d412a7e5cf1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675967150, "uuid": "36ab52e3-5591-4731-a675-1bc8a5455d95", "comment": "Malware payload (AgentTesla)", "value": "43d07eb4bc6171f8d42eedb9c5ab994ec8f88ed03aaf50ca013fe344b7a0a9416a0c6194f5c07e1456c7ee05e758ceea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675967150, "uuid": "808ca9d7-d079-46f9-a295-ed790ef93d4f", "value": "T1B7F42310725AD638C8BEF6B2ABFDB8D0537CA3222956D96C8CB810DFDD61759C1B0613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675967150, "uuid": "5a7411f5-6b43-41c8-8fb9-255b2d714495", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675967150, "uuid": "86d02ecf-d796-4931-9d91-a5d961127d0f", "value": "12288:DpkOPAdcXnyXx6q171UTaZL3vIuGBxh+A1FmJEbJHP2OJ7eEahRZ5G:5Ad1NhZL3iBxh+A1Fmibhz7hS5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675967150, "uuid": "936967b8-4244-49d7-8c2c-d90914d739bc", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675967150, "uuid": "526ff47a-fc12-46d7-a35e-bfb120907442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675967150, "uuid": "f61722e7-b62f-4ee9-96ff-7c6c74f17e39", "value": "TTRef06022301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0daa6d-a8ad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675969863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969863, "uuid": "ccaf6179-af24-4eb6-a912-491c5a93827c", "comment": "Malware payload", "value": "032a1a78880ddbdd33ec0c5d59dbed92", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969863, "uuid": "65d14964-491e-4fe0-9ac5-70813cd3db0e", "comment": "Malware payload", "value": "bfd472f0290a97e0ee7e267eff2eade11a5bad98c9ac0762576f8c844320a3a0", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969863, "uuid": "ff440c52-79dd-455a-818a-34d0034e76dd", "comment": "Malware payload", "value": "1c28b743175eff3e1bb2912679033e7d40ec856c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675969863, "uuid": "c3828747-249b-4aaa-bfae-63355f360398", "comment": "Malware payload", "value": "78564f6db1e3b807d08591a8fcb9c9f894f90593bd189a4f2795ff6711740ae7fa81c63da4985bea9d89d717e1ff4b58", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969863, "uuid": "24ff16ba-94d3-455b-a5c9-5fa575937f5c", "value": "T1ACB17B882F26542AD24F913FDF95417266FABC0969C885709128CE2D2484844CAF23FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969863, "uuid": "558e0983-011e-451e-9775-e8b15fa7d6ae", "value": "96:hRpLHjPVsJltwusX8/XrVAE+t9JNBBoZPcKiFlqxuLPQNhoywnAs8KkU+65V/G/e:RZsJltwxad+5BoZRlrNnwn6+5V/GrRcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675969863, "uuid": "0e9278b8-f839-4317-b254-49d8b1c32321", "value": 5205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675969863, "uuid": "b009d9b7-72c6-4e9e-b159-1f04d1f8af18", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675969863, "uuid": "b09527e3-72da-458a-9071-eb82a3e70644", "value": "Agenzia_E1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c2bc36-a852-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675930954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930954, "uuid": "cf4cb6cc-dc86-4895-9d7e-9055278b0a26", "comment": "Malware payload (AgentTesla)", "value": "12d4a404019d5ce076e6be0cdeae70fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930954, "uuid": "19ccac3c-e698-4de9-8422-5e84aea6b649", "comment": "Malware payload (AgentTesla)", "value": "c0c6c61ded9403f961e7134723d6d2769cb614344a0bc40ec4d73a64e7d19105", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930954, "uuid": "f9c699f0-ee7e-4805-8d12-2127d9218c3a", "comment": "Malware payload (AgentTesla)", "value": "11b2f70135bb1366b6112daad939440a152ad32c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675930954, "uuid": "a4ad3008-1bc9-41f9-962e-412af604885c", "comment": "Malware payload (AgentTesla)", "value": "a130b193c80fa3000d520aa4b7b360d52659911259c480c61296066c55eed28354d4cd600d5e671c55a00919185523b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930954, "uuid": "ea8d7f90-dbd6-4a83-abf3-73853c491575", "value": "T1C205072D797647E2C238F936C6E78A20BABC51933303D95D89DE67F50F822416D8B85C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930954, "uuid": "95c7c330-2cbb-4c7e-a33e-9921395596ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930954, "uuid": "8ef2c169-ea86-49c4-8849-91fea8892f7f", "value": "24576:QLaLsRg9db30NOQA+/7lhQuZNVyS/D1FKYEn:AvZWM5F9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675930954, "uuid": "290d5faa-b5b4-42bc-8494-e0293552225c", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675930954, "uuid": "8f27b9d8-d0e1-414d-bdc7-9a8985284d28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675930954, "uuid": "bc531306-3f72-4805-9108-82d5aa207991", "value": "M000206 $250,000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6914acdc-a871-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675944056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944056, "uuid": "e5fc452c-2379-4873-8aa0-029a5a44deab", "comment": "Malware payload (GCleaner)", "value": "73ca131fd2f4bbc958d9b63d08993768", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944056, "uuid": "32b157de-fdd0-4e2a-b054-014ec30e0a1c", "comment": "Malware payload (GCleaner)", "value": "c0c74c16edd9e2bd286dc291119104cf62b411dddedd51bb8a8d1089bff18c55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944056, "uuid": "7a31ffb0-ef93-4e72-b442-771fec5eda90", "comment": "Malware payload (GCleaner)", "value": "e6dd784dbb64227e71c2daa445892c35fdaa2a69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675944056, "uuid": "d53deb49-0105-4f8a-a47b-96e6beaca674", "comment": "Malware payload (GCleaner)", "value": "0b40438ff7a28dba0587bda3e7cec992f720633d51061a18e491ff75aad78d385043898f0c4d2670cd4f060b9b22536b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944056, "uuid": "92889e99-fd50-4506-907a-cc6cb1678a3b", "value": "T19EB512BD7151C96CC6C0BEB48C2AD8E71CDB6DE3D994A02270DD7F3FA2791859A09603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944056, "uuid": "8862e5ba-aefd-408f-8b1c-a48bc9dbe073", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944056, "uuid": "35f8253d-35cc-40c7-85da-8d1e9b86e5b1", "value": "49152:rdHBLYdWXD47wxkc6GaKMfgknDcNstTkrKN3UoLLCgv2MR:JHFBXQwxkfKMI0DcNYQwbv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675944056, "uuid": "29d2b426-8e60-42c6-886c-6d0bc929ce9d", "value": 2470630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675944056, "uuid": "745e0fad-46a7-4c32-be43-e7d40a5cfc85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675944056, "uuid": "eb66ed42-b725-4d10-ab83-23a52110fcdf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2549ab2b-a818-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675905717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905717, "uuid": "1a6ffc95-2387-4872-9ca1-53b2ddfc2f2f", "comment": "Malware payload (Mirai)", "value": "8a163ad1f387fe788b42685862643ba9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905717, "uuid": "e6de2dd9-91a9-43e5-bf97-60f472ff53eb", "comment": "Malware payload (Mirai)", "value": "c1ec4dcbda3efec5f791aee11532d838ba5fbee4e81ded99881da9f9ef5316c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905717, "uuid": "488881d7-005d-4f96-a471-1db66ea301d1", "comment": "Malware payload (Mirai)", "value": "51d94a88d070d6528055026c0b14baccc8d11fb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905717, "uuid": "8a15eafc-3b56-487f-a406-5bf3d0a0eb6c", "comment": "Malware payload (Mirai)", "value": "b074fd60079c0b0e5139e046c9e956a2bb1757b89e36501107ef3e5db36baa0246c99f80788741d57c99f3576ca237af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905717, "uuid": "9e4bd117-9d83-4670-a291-37ceeefb7f24", "value": "T15E436B0272280A47E1565FF4393F27E083FEE99121F4F5882A0FDA464276F77158AF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905717, "uuid": "ca25b7c0-16d4-4a93-ae8c-2f1052f33d92", "value": "768:sYfPffzWfQuxL/j4oy9RTcEYyrm/EkCx7qn5yQCGEgvM3f/3JxitZAIsYs9Jx5Er:sUSfVj4oKJryE32yQTJvM3faDsDxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905717, "uuid": "1fddea36-b459-47a4-bedd-a545f64ecab9", "value": 58284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905717, "uuid": "219491c2-412e-4b91-b6a5-721ab3fd29bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905717, "uuid": "be2d2c2e-af36-425b-b9f2-97ab85e950cc", "value": "8a163ad1f387fe788b42685862643ba9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d867a86f-a837-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675919332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919332, "uuid": "d69f171e-db3c-4798-94a8-a438b976d29b", "comment": "Malware payload (Amadey)", "value": "68f0a3e24de0f9ea3f99163d76355c32", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919332, "uuid": "ca3c0f89-cc04-4051-8fd0-ad8a3378fe09", "comment": "Malware payload (Amadey)", "value": "c1f62ad25330193aead450f14108f7d493e037a7ecdf83d5f6808f8758212636", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919332, "uuid": "2ad6ec2a-798f-4c3f-9718-23f922fbecef", "comment": "Malware payload (Amadey)", "value": "f31054ae1136ce1f0737819e4c73f2ce7d6cebb0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675919332, "uuid": "086fba7b-d94c-4ec4-88d8-84f6d6518957", "comment": "Malware payload (Amadey)", "value": "a130f7a7c17e5f32bbb19056ff4da9481219fd76a9ec51033f9f3edf52c54dd0b4738fb5495293017dde5f01d293ca30", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919332, "uuid": "0eed0535-9934-40a4-bdaf-0f26e83b6920", "value": "T108C4124BB7EC8132D8B417B068F703D30A37BDA06B35D296175E9C1A1C725B4A631BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919332, "uuid": "03fc77c2-03d7-48e6-bfce-7fed60143fbd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919332, "uuid": "eda59d67-3273-42fa-a1e2-dd87b8720420", "value": "12288:JMrgy90Tgfn8Rs1IIzkSh0B2XiWp5CxeWpyvXt+U1p:FyZf8Rs1I/2FjC1pyvXt+Sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675919332, "uuid": "db43b49e-e781-49f1-a504-c3a41704e5c5", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675919332, "uuid": "8ddaf7a8-7a11-47e7-ac10-429a4068e23b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675919332, "uuid": "e50c0444-804a-45f6-9eed-2fb6f1cccd7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4f4f6a-a860-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675936623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936623, "uuid": "6063ad20-90f0-4bfd-907b-889b21a3bea4", "comment": "Malware payload (GuLoader)", "value": "ea59ca8d8ffac9480f698d02da0bb012", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936623, "uuid": "e15befd7-77fe-4ac2-96be-ee32718d44a4", "comment": "Malware payload (GuLoader)", "value": "c2324e732d79304b3216610958caca5e934de75cf6751df30b03277304692a29", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936623, "uuid": "3c0e98d2-f5d9-4a92-af90-7fc1630d277d", "comment": "Malware payload (GuLoader)", "value": "d9068e3cf63a2a21818d9a98aa43d9b8ab15fa89", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675936623, "uuid": "23e84332-cd9b-46f6-a587-68652cd37742", "comment": "Malware payload (GuLoader)", "value": "0945cd7b6072d0bef338b5c5eba201ea9beded9c2e7741a4f045fed27babf8e653f1afa1f3388416705bbe6b0665b50a", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936623, "uuid": "890e001c-8fa7-4670-b67b-c2a927114101", "value": "T1DC9402F09D432731943F1ADBB8C21E84DE6C4E972E12277E5D91124E39022ADD63B7A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936623, "uuid": "ad8d0825-63fa-408e-af20-f2a50815e304", "value": "12288:+kJ8tnuWFji/fYxT0ZIgCDQ9JGZFM1W0D:FcnfPE/kMA0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675936623, "uuid": "7a398af7-8282-4d57-bd8d-7944da06d9d8", "value": 427343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675936623, "uuid": "19b726d2-b039-449e-ad3d-61e01208dbea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675936623, "uuid": "db2215f4-2ac9-4a14-a4c5-08a0825b9502", "value": "Solicitud de oferta ElectroStocks Salamanca ESPA\u00d1A N\u00ba 2100176 02092023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a74548-a89d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675962811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962811, "uuid": "43fd4c52-c58c-44a8-b404-8e874d7fc443", "comment": "Malware payload (Tofsee)", "value": "dd26e4760ea90d7fa722175fcc824ddb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962811, "uuid": "be68e184-afb0-4c80-9c61-6aa899493dbd", "comment": "Malware payload (Tofsee)", "value": "c2b0d2493461846ebd056dd6ae67939bfbf35f0ff1758476cba95edd45ab3741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962811, "uuid": "80a8e4bf-baed-4dec-8420-b93f09bad723", "comment": "Malware payload (Tofsee)", "value": "dcadaa8981b2fb96954dddb3c912500fae4ebb2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962811, "uuid": "d65d15cf-e1d9-4d1c-b5b2-62f217e1aba3", "comment": "Malware payload (Tofsee)", "value": "598563b5694334ea9d9ddb9a96d5e1b45ad9a5ed7f85ca04fd7f8902fae9fe9d3e7c51eb55ce2b27967dc8bb8d917743", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962811, "uuid": "72e0c8cf-437a-47d1-9280-b469131da5a6", "value": "T11914CF1333D0E871C032B6319C69C5F1377EB9714A789A9B7768263F4EB02E19676391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962811, "uuid": "6887130c-95be-464a-b657-1eb72c37fcf6", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962811, "uuid": "31c35d50-f9ee-45f4-96ff-a0ae269fc2f5", "value": "3072:0FgPe5Fw2IstSa3HeiMwkpL/P1rF+cWYiFIb54nz5F7IC5zhAWE:0F3jhtf3HmP1fW4dKVyClhzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675962811, "uuid": "d183e0f4-2446-43d1-8710-ab590c034752", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675962811, "uuid": "84c66c39-0e59-4181-a2cf-62cb769f272f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962811, "uuid": "2e4f9995-f18a-40a6-b628-a8ac6097d909", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c48270-a86e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675942680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942680, "uuid": "481e71da-c199-4edb-ba34-46daa848f63c", "comment": "Malware payload (AgentTesla)", "value": "c42a242cf76daa67b76de6ca90d7b2b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942680, "uuid": "e03e4c19-4cbb-47c5-8b1e-afc3b6ae7491", "comment": "Malware payload (AgentTesla)", "value": "c2f0191da8ee68f635ce529d3eb06fdffb6349a46326cfacf3f6844c04dd617d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942680, "uuid": "84cfcd6b-17a3-42bc-abb5-40079a21285a", "comment": "Malware payload (AgentTesla)", "value": "c616f2bcc7dd2f9da82dfef122ac13881ecef555", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942680, "uuid": "88ee548f-5ceb-4184-97bf-22f0cd514281", "comment": "Malware payload (AgentTesla)", "value": "c14ec418864605ec6b183780cb28fc72a92b74b7d4a500d2e29bd9a630e5e9f5d64336f372349982b16b3c0983e1a565", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942680, "uuid": "0edb0397-889b-4802-ba0e-511be4299cb5", "value": "T16BE4127C1DA85C57DB9C40B896F1038267FAA62BB08AFB9C4E44F09616F7BC1952F443", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942680, "uuid": "f6e7720e-9153-4deb-9f3f-b23fdabbe6c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942680, "uuid": "3911a0dc-1a93-4ca9-ab5d-dd02b4e70f0d", "value": "12288:8iXd7V60IxzlVOtTsFFt7mcuf6sv1bJLk6rJuW2HvwEsYvQlQXZ:jXu0IIgt7mcvsvV30W2nQlQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675942680, "uuid": "aa08e8e9-603d-4d24-8a35-b61a1f9894d0", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675942680, "uuid": "1810db65-d108-4a02-83b2-bfe2d8a57556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942680, "uuid": "fef46974-8e29-4f82-801c-926864ca7054", "value": "TT copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b711ff-a8a3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675965639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965639, "uuid": "36f1f7c6-8d6b-46d0-9b7d-6cbe3d04ae4c", "comment": "Malware payload", "value": "ae5cb7fbca9b8b67f5c2266f359e20d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965639, "uuid": "0f7c7027-8810-4024-aab4-0d0edac5e42e", "comment": "Malware payload", "value": "c3f139f53549f049713a320747a070a6a6ce759d9958a771bd9697bc5963e300", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965639, "uuid": "a0250c07-eb74-4c46-9987-ab1af476bd99", "comment": "Malware payload", "value": "a48365d20da5c9b3f6f87ad6fec74c8c1f3ef425", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675965639, "uuid": "2f0ef3b2-ec21-46c7-bced-69d7eab889f7", "comment": "Malware payload", "value": "cf5516ef8a32f1f4aa82d514fc1e2b29a3e90dd5f80ece232a456431690b4b9a1c05900e1f56f48bcf9b6b3a473dbe5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965639, "uuid": "08e70b1b-7ace-4f08-bf1e-2db2d1045b98", "value": "T15A04D0923ED0D871D473BA309C68C5B13B7EB8214A349BAB7758D63F0E702D09A72395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965639, "uuid": "8b76c763-0397-4760-ad1e-fd0e6481f6fe", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965639, "uuid": "fe289787-e107-495a-9537-607ad6ca10f1", "value": "3072:kR8NL3VwyoJngrX2E5CM8Tk68mD+D7kHRtvEkCBTBCSQwkd5+Ez3PxA:kR0lOgrGE5K8XS1urSfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675965639, "uuid": "eed67118-4ad6-4e0f-ac39-ce8bf20db033", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675965639, "uuid": "aade9f9a-a98d-4b8b-bbd2-271d9342ebc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675965639, "uuid": "5a08da24-071d-4dbf-a754-cbec36eea673", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f2ff70-a880-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675950646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950646, "uuid": "05abb467-2302-42fe-845a-45ceac1cc5a8", "comment": "Malware payload (CoinMiner)", "value": "d826900f79f28c84039cc0a6f49765d9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950646, "uuid": "b2b6e797-774b-437b-9671-c1902dd47a42", "comment": "Malware payload (CoinMiner)", "value": "c515446567eb17bbcfcef6bf1a4ed436674df485b5b77b877ab83ac157b60808", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950646, "uuid": "47bc1e32-84e5-4072-a559-c0ea3333bedd", "comment": "Malware payload (CoinMiner)", "value": "e8f6e741bd520725ff155262e37a0b7f29c55a04", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950646, "uuid": "728b2962-4c21-4459-8f13-bf3e48dd538c", "comment": "Malware payload (CoinMiner)", "value": "5818585fdb594209b708cc3b5847f102d6456ede92e6c2d307a9514be85238557d3d79044ab20602852e600038668d2e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950646, "uuid": "2cf46d7d-d3ed-4161-b6a6-ba4f0ae75e81", "value": "T1A095225AFA17EE47D8140976ED92C1BD0231BF2DF8230A4725857FAFF875AB11A09072", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950646, "uuid": "1acd294d-6836-4329-96eb-32510188f121", "value": "6da813bc761fd3485e58ce0ec90fbf4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950646, "uuid": "8104ef89-dc04-4ef3-b9fa-144febf6526a", "value": "49152:Zt/jiaQQToDmnUEQa0r+kHECcrGMbdR5YdLOHnNI3VemcU:rbqDynUEQa0hH6rY6HN5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675950646, "uuid": "a2208a16-8f97-44ac-b948-bf16dbbce0d2", "value": 1987360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675950646, "uuid": "9852888e-d2d8-4e12-a055-88c80681d1e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950646, "uuid": "a37cc1d7-07e5-4dcc-a98e-9c3277a754f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d51df74-a818-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675905677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905677, "uuid": "1e057486-ccb3-4d38-a5b5-0c3af0e1d5b2", "comment": "Malware payload (Mirai)", "value": "f9cb526ddeb469423dd14e2c0c8a99af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905677, "uuid": "2671f891-5e05-43fb-83d0-56de00bf2fce", "comment": "Malware payload (Mirai)", "value": "c52af9f6ea97725a0f110d1d2720f476e7adf8cf0f4add79d2291fbea44c1695", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905677, "uuid": "a77e0949-3c0d-497b-99ee-6355fa2a8879", "comment": "Malware payload (Mirai)", "value": "473540ee8a2ed6f7986fff610ebd129f584c4553", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905677, "uuid": "2a22869a-8d5d-47c8-9305-8ad83bc0a3a8", "comment": "Malware payload (Mirai)", "value": "df924a2506612e040d5f8b67b52fb7b2a1e8ba394c86f037961afaf2d76b2dbef0e61142e76be04dd538cda969c4dfb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905677, "uuid": "6d5dc2e3-acf7-4310-83fc-3176ae9213df", "value": "T19FF2F1439943AD5ADE909E31B8228082B0A94FB8E0E5BC527145737D6DC542DBFFD8B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905677, "uuid": "cc0ecb6d-2b38-4e82-b47a-e2610efef30a", "value": "768:SywzGtvr13xewWu8ALW2zENfGboIPF4/4Xmx+kiGY3UQwAt:SywzGtx3Yw5g1GbZd4hYJrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905677, "uuid": "0337c6c0-5a22-4727-aa36-6aa6ab365b72", "value": 35640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905677, "uuid": "aed109d7-822a-45f9-829e-cba0c962fe5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905677, "uuid": "1bb5e34a-3582-45d6-9955-4ec7a8d864e5", "value": "f9cb526ddeb469423dd14e2c0c8a99af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1999c199-a856-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675932326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932326, "uuid": "7dd0fff7-52e0-4977-beee-f8674d48b542", "comment": "Malware payload (RedLineStealer)", "value": "117b4870c119d44dc292597d2300c134", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932326, "uuid": "2d828523-6c80-4803-b045-e0ee20083c52", "comment": "Malware payload (RedLineStealer)", "value": "c590dcdd6bd4f25367b1843589157c2d1e646d907594b044ac624310d3b0c50e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932326, "uuid": "58f786ca-447e-49a8-a678-7bd4ca9b5a54", "comment": "Malware payload (RedLineStealer)", "value": "0bd53d777863079826de8b99d7320d8d2811ffe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675932326, "uuid": "0862f73d-5af3-4f7f-8510-32954f83730a", "comment": "Malware payload (RedLineStealer)", "value": "8e88ebe8fcbaf29c7ad88e065ff1cfba08464e2c50e4a782e6776ea391f070157ff4d7009ba0884879663ee5d92cdd83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932326, "uuid": "b80e876a-a3a6-49f3-a64d-9d7f81e398dd", "value": "T149851702A0434A21E26D18FDC5B6C55CD4EBEBC20E13169616AAC4DB8B937D1683FDF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932326, "uuid": "ed6fedcb-efc6-4130-8c8e-28c8ce8ff774", "value": "ebd11b3f90837127466222812adfd903", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932326, "uuid": "ed74cf9a-f8bc-479e-a8fc-1459f60edf6b", "value": "6144:MrOOW0SXQm4WrXTsbJH+01NFqX27AOZ9Ew9Hx1s10j4G4Ic:MaHXQrWrXobF9H9EEfsSj4G4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675932326, "uuid": "83e67d53-2641-412c-8066-1d8389f2cd95", "value": 1717264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675932326, "uuid": "0639232f-f559-45a7-9234-42d4f2920ceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675932326, "uuid": "1f9dd2f0-6aab-47fc-b253-41ec3e4e2c80", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f384c61-a8ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675968950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968950, "uuid": "84ee6861-0f57-4eec-9606-e7880205666f", "comment": "Malware payload (Gozi)", "value": "2284baaecbb830a756082985514d6025", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968950, "uuid": "f957bb99-0d2f-4fbd-9efc-85945d1bd765", "comment": "Malware payload (Gozi)", "value": "c5a2cc51593e55744e3743c9e1e960a3c96f211555b38d3f4cd340f847206166", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968950, "uuid": "beb55399-be7b-417b-bee3-6768fe9b83c2", "comment": "Malware payload (Gozi)", "value": "072c096487e3fcd43187849ee80300dde2ddb163", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675968950, "uuid": "9a8cb3da-cd05-4eea-afba-3d6294d64f40", "comment": "Malware payload (Gozi)", "value": "da64083282186b82045b6eade1bf072962e6a56c544de2376ceb05d1cae78ef40cd0bf0b33330ec7ac34b4bd50279642", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968950, "uuid": "8c40de65-063b-424d-a91c-bcf64891b38f", "value": "T16B04C02237D0E871D473A6318C28C6F1767EF9217A355AAB7B58273F5EB02E09672341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968950, "uuid": "5b63139d-a886-4915-8da7-001af6db23ad", "value": "3eec0fba6b043cbe25b0432db71dd656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968950, "uuid": "8d2df034-db23-4ef7-aab9-11c2e2e17c66", "value": "3072:iFgvgVhdhDzXENKUEruxMfSs7UWGSVJUFRfV4hm4kgTJPj/4pRgJxbThA:iFHjJEIUEDL5LKOhm4FJPz4pR0bTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675968950, "uuid": "1e217941-bc26-44c1-b752-47b2967bc5c7", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675968950, "uuid": "a12cfa3c-57f7-4106-b1e2-f06bd424ec0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675968950, "uuid": "e074b97a-9d6e-4d9a-b301-6efa9d64e353", "value": "scarica.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d8054f-a823-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675910468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910468, "uuid": "d7841a77-8149-4ae1-9cb9-3dfd99b4a2fa", "comment": "Malware payload (Amadey)", "value": "beb16c8f45f3df7dec9cd1343a1e4e20", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910468, "uuid": "90e389f8-6860-4a52-92c5-288e76d43655", "comment": "Malware payload (Amadey)", "value": "c5e683015b8563bf55a8fe83cb4df28c16cee71165d2751764681dd27923bbda", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910468, "uuid": "7819f663-285f-4e59-8fa0-d973ab2f7df7", "comment": "Malware payload (Amadey)", "value": "cad73ec3998835788f97d3112fa024841d8a44c9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675910468, "uuid": "3f594b81-62fa-491c-93b2-e2806b12eff7", "comment": "Malware payload (Amadey)", "value": "0d5946e9ad93fee5fd6d4c343fd8fcda8c9e66d99c862690895b996d1f1589034c4e7fb09df0baf9d5050edd5e2d3186", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910468, "uuid": "e0a10294-5fdb-4504-bb58-a517c2146cab", "value": "T187C41247EAEC8436DDB5977009F203C31636BEA14B38875B128F6C5B2973970A27572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910468, "uuid": "5d76a60c-8bca-4d5e-b355-cde56bfa69a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910468, "uuid": "4bbaedbb-cea2-44fe-9208-e0c1365e7356", "value": "12288:uMr2y90SZcs0Gg5L2B/T6TBLFBn7D/M6UaaNFjYeoNO:QyDqs6Bqm9L7X/M6aEeOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675910468, "uuid": "c48e1066-ef2d-4f34-bb77-45d942a8bfdb", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675910468, "uuid": "fcfc28a6-dc9d-4f63-8c23-7a2cf6f9aad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675910468, "uuid": "1c72d4aa-85fb-4b12-8588-be1f484619dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d43343b-a878-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675946909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946909, "uuid": "edcce866-68dd-4f54-a700-8f7c856edb5d", "comment": "Malware payload (RedLineStealer)", "value": "bb0eeb31a94cc30163d67602f769c600", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946909, "uuid": "8716e37d-06e0-4b89-a3bc-275ba68c00fc", "comment": "Malware payload (RedLineStealer)", "value": "c5f37ddafa3535a6a3b76acc5c6509b5381012e5d126c2981cec46a272409e3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946909, "uuid": "507b50e0-3864-4dc2-82f9-5e97453a363f", "comment": "Malware payload (RedLineStealer)", "value": "9d537b9bbae6018d9006ee9ea0ee415c19c3a530", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946909, "uuid": "51d1651a-a1fd-4b94-a48f-f8cb31f65328", "comment": "Malware payload (RedLineStealer)", "value": "a967422fab81633648af8f2f5a07f7ec6dc3149652fbf5e0a4171829b843c78345469b72184a879fae6116b36ec1c727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946909, "uuid": "780f95c4-668b-40fb-bd49-34e415a5080f", "value": "T17B64F13335C0C032C56624745C29EAA5A77EA831167DDA9B7BA41BBDAF303D0973B346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946909, "uuid": "6d4553a9-1bf1-4ceb-883d-ef9b223ecaea", "value": "83d1b8095e33f74e23ddae505b88bb37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946909, "uuid": "157487c5-7ec9-4d45-bd5b-4fa7a0a83ae1", "value": "6144:vhC6ylLSXDDNCuRn9olHsT3he7hy8kXcJI7nIYyd:vhC6ylGXDDUuv+Mbhes8BY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675946909, "uuid": "23da2a6c-9fd4-4799-9efd-f1ecd2602eec", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675946909, "uuid": "9a180183-1ed0-4588-9878-ca10a6954261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946909, "uuid": "60026837-3726-4c9b-b030-de6a5a9b0ebc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c94d814-a893-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675958584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958584, "uuid": "47524c2b-00d4-4907-9e54-37099498623d", "comment": "Malware payload (Amadey)", "value": "408ff469381c5dc69c4d4b88e62d9857", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958584, "uuid": "adacc628-2a6c-4a95-9430-fe3e26623309", "comment": "Malware payload (Amadey)", "value": "c699aeab43fa947fa9c11123b67dff93e464ff156f2397d676b42f3f02bf61b1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958584, "uuid": "fd0ca517-4046-4377-80b4-97f316380013", "comment": "Malware payload (Amadey)", "value": "b9e8049d07c0e6c820dddf6204ddbbfc30eeba93", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958584, "uuid": "34491575-77f8-483f-b228-55edbc85bb74", "comment": "Malware payload (Amadey)", "value": "70d9ddb5fece1e6724f8a07a61a70eab34ceeec53a8d0aad4671a4e1468841e9b0be1ff4906b771848d7fc13f98a27e2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958584, "uuid": "dfc22b8b-5319-43c0-b8cb-ee99fc1fbbb4", "value": "T1DAB4020BEBEC9072D5B5177059F202C31A36BE515A789B9A234FAC5E09732B0773532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958584, "uuid": "ef8fb64c-51a2-4c73-b690-6e2845744de3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958584, "uuid": "274bb38d-9c98-43c0-89f3-3158d967f5a1", "value": "12288:QMrPy90Ll9VU9SgvCTDJ0mF7DQxNtNId:PyaVCSgvWemF7DQHt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675958584, "uuid": "18dfa2a6-1a03-4e81-b646-9b79a0da9af0", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675958584, "uuid": "06aa12a0-62e8-4c6c-acde-06ce2d7c669b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958584, "uuid": "88bbce09-087e-4df3-bcac-3dd3abc0cf1a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319bf98d-a829-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675913039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913039, "uuid": "622aa873-355e-44a0-a9e8-f82b4e93df79", "comment": "Malware payload (Amadey)", "value": "839cdc6db794b0bcf3f85c9f04d95c37", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913039, "uuid": "12ce133e-9b85-4555-adc5-cde16f60afee", "comment": "Malware payload (Amadey)", "value": "c6c1bb8ddec4450ccbeadaebe6fbaa6c2201d392dbf6d571d09b134e1ee28941", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913039, "uuid": "b9dd8950-5455-40c7-aec0-b73eec516e76", "comment": "Malware payload (Amadey)", "value": "0cb7ef7effc5e021281771a623f55d57a77012a1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675913039, "uuid": "369e79b8-803b-4cb6-bbbf-0118db3be652", "comment": "Malware payload (Amadey)", "value": "79bee16818b06b05f0eaab0d537b8046bffad049c8223f54301a2ad3f5e69a06d4104534c25043292a3b62a843238dbf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913039, "uuid": "9c7c8e62-770d-49f5-8892-1e0aded3c73f", "value": "T19EC40257E7ED4022D9B15B7018FA12D3093B7D619B3983E6234F2C1A1C722B4BA3576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913039, "uuid": "236cf250-c5f3-4bb3-9826-3f7eb3000dca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913039, "uuid": "fa95aa6f-af2a-403b-ac8a-6e37aee46fae", "value": "12288:RMrky90KZqzB6zfr2vZk/HarFbxvuo3XG8Xld/sqFjFGm:xyFq8zfr4Zk/ar/vuonG8b/5FGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675913039, "uuid": "70dba692-7cc8-46a5-9d3c-fb056a4596bc", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675913039, "uuid": "8e85e113-7ea3-4b29-ab44-deaea43e5dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675913039, "uuid": "5b1f964c-6515-4a9a-8605-68135d12647b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730f7352-a81e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675908425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675908425, "uuid": "b7301319-38cc-4041-a0ce-d2614490e012", "comment": "Malware payload (Amadey)", "value": "7c56af43906f1361ab3040865fe38609", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675908425, "uuid": "dc969930-c6a9-4683-98cf-0c356bff05c3", "comment": "Malware payload (Amadey)", "value": "c6d1d7e173c3370b36fa350d38f4cad58f239d1e8622642db38fe84edc27c54d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675908425, "uuid": "32f76bcd-4aab-4880-8738-6f98b0cea3cc", "comment": "Malware payload (Amadey)", "value": "c62e0179d4d75d93505fc3768b3b3851c19ee160", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675908425, "uuid": "eea04a73-2bd9-49dd-affa-cb9ce2bedc5c", "comment": "Malware payload (Amadey)", "value": "1a9dd211fc7ba79ceeb42ad712e069e78770caa81ffe85766938c2be1f409b681bcb8ccc2bf058b8e9f824c2414ebeb4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675908425, "uuid": "a7b94371-0d01-4ab2-afb1-89cf9ce044a3", "value": "T103C4020BE7E88072D83567B059F243D31B36BE614538876F578F9C1A08736B0AA3576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675908425, "uuid": "61275fa1-09a7-489c-8de0-031e31ec6363", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675908425, "uuid": "46030c1e-33b7-454e-a969-6eed66bea816", "value": "12288:dMrby90kVYg9fonuU8Hzed8UqM9iYAkmppZrM:6yuFuU8H6eml2PM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675908425, "uuid": "e22258b7-3bf5-4f3d-b5ec-8b7f93414554", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675908425, "uuid": "ea8da7d5-a991-41cf-9ce3-5d6a5847605e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675908425, "uuid": "599b1af1-beac-4ca4-a247-1f06c1f22b37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e18258-a877-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675946754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946754, "uuid": "82991cf5-901e-44ba-8ef1-d89391062202", "comment": "Malware payload (GCleaner)", "value": "b645e870545f7f6245ea02b20831aa22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946754, "uuid": "f25cc904-afd9-4bbb-90fc-77329138d8c8", "comment": "Malware payload (GCleaner)", "value": "c6dbc826f82f618cee705e0c5880bc164a0a4961121d7a9f484e2f8e7ff3e850", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946754, "uuid": "c221b3ff-9234-4a4a-86fd-bf85df53d754", "comment": "Malware payload (GCleaner)", "value": "23f5c1c6283c35bb1e9259ce8fb6f08466755efe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675946754, "uuid": "f55766f3-4ba4-4967-8416-4b565aeb307b", "comment": "Malware payload (GCleaner)", "value": "19142ca2f6416fa07a8ba0426ae1579add9d34bc1a48b9b2205d2c3bc0f17d9fc513592bf1d2459ac8c1314e7efe126b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946754, "uuid": "dfda000d-fe0b-4c00-99aa-7746308de968", "value": "T13DC5127C7045C56EC180FEB48C3A98E71CD65EE3E9D4A42270DCBF3FA5B9285A60A507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946754, "uuid": "c12fa08f-58c9-4f66-8867-a66e3c58bde0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946754, "uuid": "0816df82-8c70-47b0-a5be-c79f6e4e0fdd", "value": "49152:rdHKMmVkVJ5Ayy5Rd7yCUFqm4nm6Ig+qrhhh8enm6WYN4fx4rRIUgFgGCRZLCgvV:JHKMZCXsCUFqTNT+U98Nw3gpCR1v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675946754, "uuid": "5f949eeb-c1c5-4fae-836b-277c525eeb7b", "value": 2654508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675946754, "uuid": "60792791-5692-400e-a660-faf1d7361c16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675946754, "uuid": "09756820-ecc4-46d4-8990-d12d34f6f829", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cfa9b91-a89d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675962961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962961, "uuid": "54225063-7e7a-43b5-a127-92a8dee72a2c", "comment": "Malware payload (Amadey)", "value": "19cc70670c880799bd8adf47d8969f52", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962961, "uuid": "2aa16cfc-ab1a-45bd-894e-33b99efea675", "comment": "Malware payload (Amadey)", "value": "c6f6b4f617419a7d788a12b63778268d64767d78dd6429a60b0eaceb73a7e404", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962961, "uuid": "c8d77fba-8902-48f9-b264-0458d3316e17", "comment": "Malware payload (Amadey)", "value": "b859dcfb1c44d3dbfe3079c61f14623e5223a6d4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675962961, "uuid": "651fed5f-73f6-4e09-86b0-33a1b968f012", "comment": "Malware payload (Amadey)", "value": "f3c2cdd1d4ce6b25c64f5393e34d3917c2047a492a73c894119d6db2f6a05bea0e941f44cd828496174725e274c328e6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962961, "uuid": "27aa3c07-6d4b-4da2-a225-528e6395ab07", "value": "T174B4024BFAD88132E8B12B7019F703C30A76BDA09978479B274A5C595D336B4B235377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962961, "uuid": "098062b3-4e81-408f-9b29-cbf47f2b5843", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962961, "uuid": "37eb26c4-5216-47c5-be20-cc2042853e57", "value": "12288:vMr2y90HyhB9D0/XqCszgH2meCN0JUXhWXoJ/P6Ur0voA0:1yesB9g/X1PkCaUx6opG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675962961, "uuid": "b6a69d76-6b78-487b-bf71-576e17095f03", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675962961, "uuid": "23334bfa-1df1-43cc-ac5f-5da64b8ea96f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675962961, "uuid": "e76ba117-adb4-4ee9-bbfb-6d9ea11ebe1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fc1a34-a83e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675922306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922306, "uuid": "19a49d1f-8718-4cc9-9ddf-8f6fa545bdc5", "comment": "Malware payload (Amadey)", "value": "fe5c9f33cb6458d7619425923f4e4b24", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922306, "uuid": "1fa4006b-7a2f-49bd-93e0-4ecfb1cf31a8", "comment": "Malware payload (Amadey)", "value": "c6ff28e767f5b2112b53ee2fce98dc4b1abce9aff3cac037b7ba0860e1e0979e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922306, "uuid": "4c85d9a1-c1f8-4a4a-99dd-3156a96b6c6b", "comment": "Malware payload (Amadey)", "value": "33ddf6ccbb8d602fed882252f8d1977bd62c0713", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675922306, "uuid": "d3764b0c-885a-468a-996a-5a2314b2b571", "comment": "Malware payload (Amadey)", "value": "42d847cefa8550e26504d115248b526f1aa5373c0fe20a2af8ba87cb80029fc5e4209aed68103ebaf8cddae7f00998c3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922306, "uuid": "8be66879-6546-4144-8e80-bba446ed1c9c", "value": "T1E7B40207B7E88032D8B5677019F607C31A36BDA15E38869F634E5D6D08B26B0B73536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922306, "uuid": "3d41df4d-2d9c-42f5-93fd-4cb4a5ab8d0e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922306, "uuid": "1c90a1c2-5d88-4f48-8135-8dece07d1055", "value": "12288:9Mr4y90m/Ov9oiVdeNuNMBN2AYzJiOmqskNXaeEB9HuqbSzmA+o5h8:By/WrVogq2AYtiOFR0gqyBTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675922306, "uuid": "8f7049ce-ecc8-46b8-a657-cb4a2bb7cd2c", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675922306, "uuid": "6fae4120-bc6e-452c-a9b1-b27df07239df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675922306, "uuid": "c3e5327f-7790-470f-a381-a9b5bec01b74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a772fb8c-a889-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675954469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954469, "uuid": "77a4b107-a5ab-4936-a3ac-cf2b84bd8aa7", "comment": "Malware payload (RedLineStealer)", "value": "e29835d972294e50a73a8635d0e346d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954469, "uuid": "d809cb40-000e-4aff-ad35-0180a84e5297", "comment": "Malware payload (RedLineStealer)", "value": "c73ee5ff6d3d7dd78bdbef01343d0cdf222b5fce3f7a5b3c8fd81bdbf0518cfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954469, "uuid": "1970b44c-53ff-4933-a145-f65fe07bdb5d", "comment": "Malware payload (RedLineStealer)", "value": "4b9dd9634022bdc37600f2d7cbfc5b93032d3987", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675954469, "uuid": "469b451e-a1f2-4a9b-bf4d-1a0dd81fe202", "comment": "Malware payload (RedLineStealer)", "value": "badb31b0a7470c10b7364f3fee11ed1262224ae1db35975a13ca632f93b5d970e0cbe509dd75064f41d23c9c74c0217b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954469, "uuid": "ffce338f-01c6-44cf-aff0-9d0283ff4a7e", "value": "T1ECB4024BBBE89072DDBA67701CF607C30A357D906B34835F335E6C5A18B2164AA3176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954469, "uuid": "680e363e-1f58-4dca-9bbf-17e07bc3c4d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954469, "uuid": "1009916a-a3be-4a55-9cfb-ee5d74632746", "value": "12288:iMrJy90EE7/69RidyH8KsTsjaE2UYUOqRQRyiZRVca:XyM7/69Ridu8ojD0HqRG9nca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675954469, "uuid": "622806ad-c209-4883-984a-9002028f7726", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675954469, "uuid": "faabdf41-0029-42d5-9ad0-001b82addc6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675954469, "uuid": "185138a9-4588-4583-968a-cf27719ed096", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09399c17-a881-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675950767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950767, "uuid": "39b7d938-835b-4e46-af0a-95f7fe1d0239", "comment": "Malware payload (Gozi)", "value": "71911dd8d14e0e0a185c8bcd624db589", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950767, "uuid": "60724d1e-1a95-43c0-8d61-d6422df0a14d", "comment": "Malware payload (Gozi)", "value": "c8083e5da1d714b99de807e2c6777aec8e778afec39866e9ddeb4aeba66ffa1a", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950767, "uuid": "a11f2671-6c34-4663-9017-2ee1986dd531", "comment": "Malware payload (Gozi)", "value": "616ced065f3830c5513923c23ec52166ea40187f", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675950767, "uuid": "e32c3536-daee-4915-a72d-f5db724188d0", "comment": "Malware payload (Gozi)", "value": "56c113cb03e31e1af13120c92f55c73c96d20ca236bff11786e26b11af7d7ca6a2d1beea442cdbc4c9160a2efe6dcd19", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950767, "uuid": "68471775-ef22-4700-991f-80f1551a43d7", "value": "T180F0AB020A240828C32AFB3FC2A79AA9F27195CC259B3CB3242095300046EC4064F50F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950767, "uuid": "1f37b8f1-bf93-434a-986e-45120962d84b", "value": "6:5jU3j9k64W0jLZNYrnrK94iERBOCTPKZbjhAEE4L6n+tMLjllbqtc64pjjLZNniv:5jyjO9HjLMrn+V5r6zjlJl9ljLTitx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675950767, "uuid": "c46d70de-1d0a-4945-9595-5fadf9a4e385", "value": 469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675950767, "uuid": "4ac72f5d-d4cd-490c-a0ad-a09cb5940ee8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675950767, "uuid": "0ae6c319-8c8d-4d65-94c1-40937ff3de6a", "value": "Agenzia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0057772e-a825-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675911239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911239, "uuid": "74d37b5a-5ccd-41f6-8d7c-56c605044888", "comment": "Malware payload (LaplasClipper)", "value": "ce8d5e1343219b698d016978743e845e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911239, "uuid": "53f456ce-7cf2-4177-a2f0-ae0ca8791090", "comment": "Malware payload (LaplasClipper)", "value": "c82be6d39f5dfcf23581234b22352895844b5aebb79798b3d6bd1eaf22560925", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911239, "uuid": "e8b8e524-6686-4451-88cd-ed501f24657f", "comment": "Malware payload (LaplasClipper)", "value": "9af36c02a96635b33c90a51572a71d27aa8743d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675911239, "uuid": "c611b9d4-ca79-4e24-a50b-0d76ce1124b8", "comment": "Malware payload (LaplasClipper)", "value": "240052957a7465b673f41c2c5c28c089010bb7718d8f66f3b33504267b42759e2c21efe64a04a02cc6aa829524bdbc50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911239, "uuid": "c040e8a1-0aec-4674-8d0c-ad2d62883460", "value": "T1F695125397A07C84E9768AF2DE1EE5E8760DF6409F4AB77602189F1F30F1272D623A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911239, "uuid": "05aaf7c0-ffbd-4900-90f3-c34b48d50ce0", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911239, "uuid": "5dab0572-6767-4e04-9064-d30da7abf131", "value": "49152:oWcM5IOjqMA0BAGl2orBzT4UuGaJSwoFQXe:olM6OjeDGrBoJJKQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675911239, "uuid": "49ec2329-1b3f-4cc2-afd1-c4c7c57f55df", "value": 1992704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675911239, "uuid": "3d9f5183-56dc-4119-bc1c-0029142c2c7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675911239, "uuid": "46f52ad3-7b98-4287-86b8-3b3fd1c2df41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea820ce-a84e-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675929006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929006, "uuid": "130dc13b-d4bd-410c-8cf1-68f4d562ca56", "comment": "Malware payload (SnakeKeylogger)", "value": "d44e4b52dc293baf625c83d5143aa742", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929006, "uuid": "d1ff650b-c80a-4517-9561-0a19a8ba6b19", "comment": "Malware payload (SnakeKeylogger)", "value": "c840afa53559025209f0913bdb648d0fcac5edf21bca6cfee9da4d8a5286edb3", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929006, "uuid": "fe85ca1e-0898-47f3-9fc2-202d7a843b4e", "comment": "Malware payload (SnakeKeylogger)", "value": "ac1d69265809236f8bf25bd7bc6e00b90626ed43", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675929006, "uuid": "4504d5d2-c4ce-4929-9d99-574cea2c67c8", "comment": "Malware payload (SnakeKeylogger)", "value": "b2eaaef2bee6278b03a104aead61c5f81f12c7e7b49c6472a4b419799d3900e9338852c6bfb021676b0c9ff5207bcbc7", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929006, "uuid": "cbc866ac-e6ae-4ba9-b852-8dacb178fef7", "value": "T194054C243AFE5019F1B3EF796EE47596CE6FBA733606945D2060038A0723E41DDD1A3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929006, "uuid": "6311b2a6-3108-420a-b2e0-d1252b0a9ff5", "value": "12288:qKIUgr0oFGV/nMA1uSxiq0WhBw8rYddwT9Lkcr3ZIFY4PA5qhtmQQzQzM6Wgimk7:qKIwfTF049KPmTK6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675929006, "uuid": "938028b7-d194-4270-9179-9ec59b5f27a0", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675929006, "uuid": "6e506b8c-1674-4862-a195-b8113d7ed149", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675929006, "uuid": "ab6622f2-fe38-4fc2-943d-7b9b6916a736", "value": "Statement of Account SOA002920_xls.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50ee1aa-a8ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675984154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675984154, "uuid": "26d60673-6562-4433-b82d-57b8c1d2fa28", "comment": "Malware payload (Loki)", "value": "939f19f8a84348d2434e9b40f8fa9f0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675984154, "uuid": "a76b22bd-c3da-4c21-a98b-f3749bedd5ce", "comment": "Malware payload (Loki)", "value": "c903f1d44afebc18b33850ab48bc16ae6ab1c615c791b013dea143822c839207", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675984154, "uuid": "3c237b66-1af0-4d62-80bb-957f13ecb49f", "comment": "Malware payload (Loki)", "value": "f9246285542d9ae865a5f52046c97ddde090e907", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675984154, "uuid": "cb2171b3-f450-4eba-ab39-f41dabc6e119", "comment": "Malware payload (Loki)", "value": "daeb7d17cc5d5229653467f61af80ca9b27ea08e85ec94a96d1ebd141da024938f7753f61db177e741486a5c4016a34c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675984154, "uuid": "2e7c2e31-101f-45c5-9658-8418830e2841", "value": "T120F4221902598720ECEA86B2F0A5476113FA7B28F165D91DEE9410FDBF13F29CB82747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675984154, "uuid": "e78facd7-af59-4d56-824c-c6baafc3ccaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675984154, "uuid": "26d9af32-ce30-43b5-a7e9-044285208542", "value": "12288:XbnPA3+HHUx69LZehNAXmLV/9OmR9ILQAc53NkvOrx7p58lCrd4gyQapWMso:7A3+HHm6mhuXmp91iLlch6mrxN5IC545", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675984154, "uuid": "b3f290e8-b865-42d6-bdb8-477420389826", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675984154, "uuid": "1e12e602-7c0c-464f-815b-c5b5f351a3a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675984154, "uuid": "0ec5646d-85fb-4e35-9bcf-3ab8614dc6c8", "value": "CTM REQUEST_USD22,000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376f7b50-a893-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675958576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958576, "uuid": "b510d9b3-581a-4e85-a142-2ab52b7da263", "comment": "Malware payload (Tofsee)", "value": "828364f3bafcd843bc8199eb9d3abaea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958576, "uuid": "835ed5ee-1f4a-405b-b76a-91532f46f7e1", "comment": "Malware payload (Tofsee)", "value": "c959fbe4d4693a1d2b862e8e907fd6e41296d26b02d49346d2ff9ff454990987", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958576, "uuid": "d4538860-2f59-45c8-875c-72d86a37ea01", "comment": "Malware payload (Tofsee)", "value": "aff601d5f00072a9675cc16319acbdd82aece1d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675958576, "uuid": "be4a0124-b013-49b4-b43b-73f08f0aeb9d", "comment": "Malware payload (Tofsee)", "value": "0bba21a1f2ce464bfaff922752922a0cac224d2df4bc7730487274462c30fc6a9f49b57a734c9beeb69135ee627d6fb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958576, "uuid": "9b989727-ef16-47ad-b32a-a3101353e0ea", "value": "T15F04CF2333D0E871D036B6389C26C6F5667EF8104F786A9B3B58263F4EB02D19676355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958576, "uuid": "bc0230d4-716d-4b07-81cb-4a362a43f306", "value": "910163c173a5611f34260e641a94d790", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958576, "uuid": "f2a5be9f-5ce8-45aa-a519-3c049b181bc4", "value": "3072:Wz0+s/m2SY6o4VyWep+FWDFxxcA2htQrnJ/FBAOz:WzGdD4YWexFxxcAb/FBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675958576, "uuid": "af19bf93-ed2e-4927-a6d2-9b14f4055860", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675958576, "uuid": "c4e66423-e815-4e33-81c6-ad81f447c2d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675958576, "uuid": "e10e302a-3adb-49ed-b1a0-ac5adeba3797", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73080325-a8b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675972420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972420, "uuid": "afdccbb6-ed1a-4cdd-8e89-500af9aaee2b", "comment": "Malware payload (Formbook)", "value": "7d8cdf3c58c00c596080b3f50f090ab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972420, "uuid": "e51a0819-3d27-4e19-b9e9-4d0d787ee389", "comment": "Malware payload (Formbook)", "value": "c9caca736c11e851b592f24322879f830096ef056283ab000c73fea48642278b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972420, "uuid": "e47526a6-77bc-4656-923f-757d2218d7ff", "comment": "Malware payload (Formbook)", "value": "558c0dd0071f4875d7f74a19106ff06774ac30b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675972420, "uuid": "d23f4bbd-cc33-478f-ab22-647a1bf6b6d0", "comment": "Malware payload (Formbook)", "value": "1fb79cae7784aac8243f01012bbd9972fbdfd0026568393f8cb48291bf7e654ffec131448db35f0ff4d325c940d9838e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972420, "uuid": "1d481c38-275a-4def-a34d-61c393a4a33e", "value": "T14D15F15C3CB49355C0ADC2BE86A39534E7BF7E83B48AE61A0D8171C60E75BE3105D89B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972420, "uuid": "4e3dbb8e-af3f-4996-bae8-c2a9e022406c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972420, "uuid": "b9bb2ebb-7826-4b2c-b612-d9bb5b920800", "value": "24576:MHCtn9BoO/NtSQlQXDAlfSX6wnj+V9ClyTS666jDgs1b5/:z9KEpwzG8Lz6vgsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675972420, "uuid": "169bdff6-b272-4887-af06-13fedd257636", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675972420, "uuid": "de30d828-5c2f-4016-be7d-bde5559e1763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675972420, "uuid": "cc12e1dd-4ee4-449f-9223-647cf168e37e", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bc8149-a83c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675921282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675921282, "uuid": "4fe6beb8-6201-4414-9a47-6355ec7c2a05", "comment": "Malware payload (Smoke Loader)", "value": "72acb68a94a3b5dfbc720e67e1215aab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675921282, "uuid": "ead9173c-7e85-4444-8df3-77dfb638bb49", "comment": "Malware payload (Smoke Loader)", "value": "c9f9fc7cde01abdb6a47d6bb89c70a66e63ee5a0b0eb319dd397adac4eefe274", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675921282, "uuid": "2b2022fb-e535-46d6-ad65-04b28e0c23a9", "comment": "Malware payload (Smoke Loader)", "value": "61c4bf705b66ad7ddf948095e967ca707d6b8b77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675921282, "uuid": "7e5a9398-9ad5-44b2-8f5d-dc04f81dc9bd", "comment": "Malware payload (Smoke Loader)", "value": "d0c84357359a4d48da24ac3ae4fdb25157ff1d27e8b7566edd6454a3400d2e0892652713b17423dc64837c98bf8e5b03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675921282, "uuid": "53b33344-3900-44ed-b3e4-46a9101ca6bc", "value": "T1FB14D0B236C0C072C16A1473C864DEB57BBEB8305675DA4777A42BAE5F312D05A3A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675921282, "uuid": "0ed6eff0-bc97-4a30-983b-c3c643e674f4", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675921282, "uuid": "9064715f-5134-4e3c-84e7-9ef1d2a10756", "value": "3072:+GsO7cZUS5qUw1LmblWuzd5eY3qLHbedqDVGaZrurRem3Wms/beQQrWZ7:+Gs7hoL2l9aLHiYDVGUqPsbeQQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675921282, "uuid": "19424e61-3227-4efe-8e8b-89e35113006b", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675921282, "uuid": "4808a3b1-3f21-4403-89dc-b9fc3ad91b51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675921282, "uuid": "b74285de-f757-4e00-a3c9-8ee17fa69c8b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2ceff7-a810-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675902457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902457, "uuid": "8138de1e-e697-4df9-ab49-34e77fdab546", "comment": "Malware payload (Gafgyt)", "value": "eeb1adc528377f5bff1cec16337c67b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902457, "uuid": "cffa1e8a-37ff-40bc-9528-6bd22fcd0248", "comment": "Malware payload (Gafgyt)", "value": "ca62444b2b43be39e95c02e543704a69c49baed01b71398085851c52eae83a59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902457, "uuid": "7a79ec9a-a756-4490-a77c-a4e838eb03d5", "comment": "Malware payload (Gafgyt)", "value": "7f2138e8037eb9e4b61929aba5f1d8a88cfecb87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675902457, "uuid": "6675c0cf-f563-46f0-87aa-3c864e36a05b", "comment": "Malware payload (Gafgyt)", "value": "37618c24501d3a2883695c75de5aedca80356fff869d741a819ee02b33444d098f74ba22633b9b587bf7a84d72e0a92a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902457, "uuid": "ec088864-8efc-413b-98da-e1aacce182ae", "value": "T113833A82B781CAB3D48316B506DB9B110932F9FA1B0AEE16F36D2DF48E150C47A52F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902457, "uuid": "4719bf04-b6c6-4ae8-aeef-b9adbbca5482", "value": "1536:7Hs4Qzg1Zr5hcIAx8QgBNzQZ8Stx0KXd/vUammd+bVYz+UEcf/31:7HPignr5hRAxLg5etxTtYmMbVYz+Pcft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675902457, "uuid": "a165d70c-f83b-4bb1-a880-b37d3f8eba8b", "value": 82407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675902457, "uuid": "ac8f6013-15b2-419a-8721-88881a75c7e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675902457, "uuid": "d1151fd1-8eae-4e2c-a5db-fa085509bfa3", "value": "eeb1adc528377f5bff1cec16337c67b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981afb6c-a85a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675934257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934257, "uuid": "7c227282-a7b5-4c5f-a759-c65d8710763d", "comment": "Malware payload (GCleaner)", "value": "1699ee1cf953b64841f077b2462006ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934257, "uuid": "96fc6c77-a86d-4ae8-949d-62e3b97dfed9", "comment": "Malware payload (GCleaner)", "value": "ca8f3cc6e2f4ef1b62bd4e1c2940ac9009d315e8aa5bc79cf25270012f7c4c23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934257, "uuid": "7c041545-9a1d-426f-a7e5-df694a56dd7a", "comment": "Malware payload (GCleaner)", "value": "5d62fe16421833b9f066c1e01820bf14fc79b609", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934257, "uuid": "db1612cf-d526-433e-9e5d-366cba2e3a78", "comment": "Malware payload (GCleaner)", "value": "7779834c12014f02a58bc3c7cd9e9f351f7de1ea387eff6f1dfeef82119218556f107440993cc39fc88e1dd0251b68e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934257, "uuid": "56430bba-2e92-4452-9037-0b1db1180a7c", "value": "T159C5127C7251C85DC280BEB88C3A98E75CDB6DE3E9A4A46270DD7F3F5279284970A113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934257, "uuid": "ec66a889-e775-43ef-8e40-e63b74a8092e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934257, "uuid": "8f7935a4-0bb9-4a82-bd7d-7ae455388970", "value": "49152:rdHgLZvTy/Ia9Byix7sv4qWt2nEjHKwQhyplG+BzU43GOcTl42LCgv2MR:JHg1vTywUBy27sgNcEjqw2ypPzUgcxvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675934257, "uuid": "7f3c215c-d822-4579-8316-85ae48c5ed14", "value": 2679283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675934257, "uuid": "831afac2-4093-4070-a3f6-a85e89df14e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934257, "uuid": "c6b09be1-54cf-4ec2-a4da-3b3dbdbd3601", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689a4f9d-a846-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675925587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925587, "uuid": "0d78b0ce-0861-4bef-b677-b6a4ed2908b6", "comment": "Malware payload (Amadey)", "value": "1e31f179a5fa8eab8661686ccc7bf206", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925587, "uuid": "a357f3ba-eaa7-45c9-9596-d50ecf9f0be3", "comment": "Malware payload (Amadey)", "value": "cac51ba553fe90013a100bdd9733d92a4ed2ded72513369b54fa9e7791637c16", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925587, "uuid": "e71891aa-52f7-41fe-8668-baf0bad61a96", "comment": "Malware payload (Amadey)", "value": "5d2d763631733e0a49e39ea70aabb66c6ce5bc32", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675925587, "uuid": "3433e70d-d2fc-4db9-9902-4a5ef56e01bf", "comment": "Malware payload (Amadey)", "value": "51de1b6deb8d42dff9e9748aa3226e5f2862ab536653aa816ce7bb1d13b459edefde0185ffc7c23a04c9097ebe10839b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925587, "uuid": "3799f30f-83e7-47a3-b2f3-f614ae7fd392", "value": "T142B40217F7ECC036D8B8577029F603C71A327E945B38435B274E6D0A18B32A4A675B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925587, "uuid": "252e593a-8ec4-4b82-9512-a4334c0f30a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925587, "uuid": "ffde4752-e115-406e-ad1b-90d745c189df", "value": "12288:xMrYy90K4ht6USOwK+ektSrN67tLZQtB4WKfzJa:Ry5yCk+vteUWsJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675925587, "uuid": "2f42551a-e12c-41e0-bb03-83e709a69b17", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675925587, "uuid": "02824fc6-6235-4c68-9517-8dd1a189eee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675925587, "uuid": "3b6b7511-c80c-4b57-a4f4-b7c09c96fc5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f6a3f6-a847-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675926198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926198, "uuid": "c4fb0165-e9f4-43d5-9e14-72df4499fb3d", "comment": "Malware payload", "value": "91f139a1bece17ca357d2e8fd6f780ac", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926198, "uuid": "ccacb601-b0de-4f41-ae99-64c20f28520e", "comment": "Malware payload", "value": "cb0f982fc2d96123225527b79c44c85a630722284abb2a74c35c44fe2b8343bc", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926198, "uuid": "ed4b8b48-805d-425e-9b80-d2f2ddc67e66", "comment": "Malware payload", "value": "c4c1fb391ea7bc3590dbe46bada1ea2cbf41a3f9", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675926198, "uuid": "9aef7dbf-0fd9-4a6f-b196-a2d323302f20", "comment": "Malware payload", "value": "251ee739592e2568bbe5de9b06b04fa05501b79c42f8245e9c881a0d33575591528fcb2b90b6447c400b253352159de5", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926198, "uuid": "29dcf2dd-1f00-49d5-873e-9a3e0402aaa9", "value": "T1B0C3DF0272E856DEE2F86D3204FA3B575362BD52A82E4B3F6BD1254D6EB4A40CC0174F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926198, "uuid": "d60373c8-5176-4c4f-90c3-5e663ab3a484", "value": "1536:6IOjciqwpusMOnrRKWDehU6BpAnof78a4T4Awcao+:6IOgiJcsR9hyhU6Uof78a48v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675926198, "uuid": "6132a0ee-cf16-401a-bd49-88ad4c5ce9e0", "value": 126211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675926198, "uuid": "37514cb8-e384-41df-b347-a9ab21188218", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675926198, "uuid": "abc7f4c5-f4d0-430a-aff5-e995accde640", "value": "unk2.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82eb3a4d-a878-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675947106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947106, "uuid": "48fc605d-1d32-4868-b4d4-72bdafb77898", "comment": "Malware payload (RedLineStealer)", "value": "3dd273b9cffcdc76aa7bf7b475fb6427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947106, "uuid": "d7ee87e8-410a-4e4c-a0a8-39124f122828", "comment": "Malware payload (RedLineStealer)", "value": "cb1e2020a205b06e428f1323e090c7a62fc2b95ce51c3974b5644eceec1b2731", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947106, "uuid": "d16c879f-e85e-4236-aa54-a66050e0e57f", "comment": "Malware payload (RedLineStealer)", "value": "6305ed30587d1d3b9b916350c030ed6c0a1b24cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675947106, "uuid": "4320604b-6e83-4d3d-8cd2-9674ec793390", "comment": "Malware payload (RedLineStealer)", "value": "174b922e111e745a91aa7686c0d06974e010b4c7c50ddae34c6a425d9d9f46434ba00a9eafa51c00ebb67f2ae77acf60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947106, "uuid": "3f41700e-0499-4e78-b80b-366e0d4048d8", "value": "T1F5B4020BFBE85175E860177048F206C30636BEA19B7883DA574F6D5E0872674A6327BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947106, "uuid": "2cee3b90-876a-4eb8-a891-b7ac00485874", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947106, "uuid": "40185b09-c26c-4758-9d72-91ae4d48de78", "value": "12288:4Mrdy90RAWUZT3OQHajxLvkLbFACkBQrg:1yyyEYaLAbFACY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675947106, "uuid": "92c8272a-7ddd-4da7-96ee-00e0b755364f", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675947106, "uuid": "c6da781f-694c-40ee-9e84-85c24f0e2600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675947106, "uuid": "17a8c525-a978-4119-a448-734922ee7784", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef71983e-a89a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675961891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961891, "uuid": "6144197f-0ef5-405f-8da1-b278ef3449e1", "comment": "Malware payload (Quakbot)", "value": "43d25377aa21d8cbab3a32c02ee765c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama239", "colour": "#896E20", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961891, "uuid": "bc465021-3653-4137-890c-63bd15493d19", "comment": "Malware payload (Quakbot)", "value": "cb1f3849fd8c7ed11de44087378ef7fb4a4f060ed7d5222d044a12d07c1c4fff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama239", "colour": "#896E20", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961891, "uuid": "55746914-560a-47f1-a55c-5662e28fd167", "comment": "Malware payload (Quakbot)", "value": "80fbb9754fafb19e15bf271be86955f465829121", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama239", "colour": "#896E20", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961891, "uuid": "89b8781e-d76b-4d9f-bcf9-83330e2aa0ef", "comment": "Malware payload (Quakbot)", "value": "0b210c49fd05d5e7074f3dcd9e9f33018c53a994ae907fd01642f5c7b9b81059b753646699ad74566ab61482ef0b6042", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama239", "colour": "#896E20", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961891, "uuid": "56be793e-bc12-4afd-a946-6b99d815dc48", "value": "T1D4F43A2AFA0191F9ED1200F2950FFBFB54342B394C65CCDBE2441EADBBB5D60511AB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961891, "uuid": "d8ccdd8d-1f5c-4dc4-83f7-fb008d41311b", "value": "e62ccf1e5c561da53ca2f798bfd5b608", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961891, "uuid": "45e1d702-64e6-446d-b49e-9868ccbdb464", "value": "24576:/H81smt4vyVjXe1ikZdtjMsc7MscXMscktkTNd8uB:kefBtkf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675961891, "uuid": "4db5a1a2-86ef-42ef-9a68-955f7ff06d0c", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675961891, "uuid": "72776abd-3f61-49e7-ae4a-010043c4a6de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961891, "uuid": "41ce762c-4824-4598-be23-b151aea28c22", "value": "187737.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d862720-a818-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675905731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905731, "uuid": "013231ba-a4ef-4993-9bb3-9047ded486e5", "comment": "Malware payload (Mirai)", "value": "8572483d2308b3e4aea0d11c30eef98e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905731, "uuid": "52dd36e7-48b0-4d1e-ac13-fc68f0dbf037", "comment": "Malware payload (Mirai)", "value": "cb325af96f75202858bca6289f877fd3680ec4d47071573d0503299246c0562b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905731, "uuid": "c5bc5049-cc57-4806-9dbd-cdd56e702818", "comment": "Malware payload (Mirai)", "value": "4f98ddd6ec6415f45a9d7ed8bf4eaa59a3276564", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675905731, "uuid": "1c95983d-0c96-4401-8099-fe84068eebcc", "comment": "Malware payload (Mirai)", "value": "ccd33739f529292ebebd63da9ecbaa5da2ae5374ba2e953a539e6ea80a9761c17ec52febb1e3e872dddad0aeb25e88cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905731, "uuid": "e444349c-73a7-40f1-8af6-466e526c4782", "value": "T19AC30817FF210EB7C82FDE3712590A0638CD529722E57BBA7674C924F64690B0AD3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905731, "uuid": "be90854e-9f3e-4cf5-87d6-6ddda99615d2", "value": "3072:BdZll/9e5GM8ZnVKRtKvJ3vkmBzNxW8SJIL:BdXS8ZnVKRtKvJ3vkmBzDDSiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675905731, "uuid": "0d606b68-4605-4cd4-9b6d-6486ddf3f681", "value": 120276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675905731, "uuid": "d5cd2e9f-2212-4927-9c77-780cb9405d74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675905731, "uuid": "2c8216d6-174e-48a4-b28a-4cf3212c5709", "value": "8572483d2308b3e4aea0d11c30eef98e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dcf22ff-a86e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675942722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942722, "uuid": "cb4fa3f7-b42d-4c27-a442-58b23267366a", "comment": "Malware payload", "value": "3ed883591a6361ee7098ecbcd5714cbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942722, "uuid": "2d113729-ea52-4504-8753-1c5c7963df22", "comment": "Malware payload", "value": "cb7c74a616942d885bd998e8255b99cb1373fd80fb26554e5021f625bc7773d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942722, "uuid": "bdb24c49-4671-4e1d-8842-e3e7d8612813", "comment": "Malware payload", "value": "ec07dfb20a092b3198663e7fcf90760cb2f0ac00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675942722, "uuid": "9a89c292-f17a-4c70-81d4-4464c68fab31", "comment": "Malware payload", "value": "b6d932f635f1e31ca622d64789ddf1dfa26eaa45667e11b3202cb08a5410f2488a23d5b6bc88bddcb30ca4e315df9560", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942722, "uuid": "99961c3e-97d4-4ad3-8f26-23a9901a64dd", "value": "T19B7633113DF641FEEE722D72D93A3EE1F07BD2641A70D8AB235D915C4A2AF58942023D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942722, "uuid": "a33c3ccd-0e00-4e56-bcac-f9379c0ee64a", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942722, "uuid": "a9bdc9f2-22a8-4a0a-a12b-d00d2db11388", "value": "196608:91OH4c+XFS+gvnu3ZN960YDIXTfPYjnR1X:3OY73gvu3r9lYMsLvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675942722, "uuid": "29a59fd2-6712-4f4d-bb7e-ed51a74f694f", "value": 7622659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675942722, "uuid": "060bf2ec-118a-4647-9347-76fed6014d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675942722, "uuid": "8fc2eb1e-7c32-462c-aceb-e845f27f87ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e99966-a85b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675934731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934731, "uuid": "af49a4a7-db48-4bf0-8de8-c741e017dd70", "comment": "Malware payload (AgentTesla)", "value": "41e2cca1c5ee0ed9ca3257e9e85c46c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934731, "uuid": "c1adb458-5835-4035-8a10-ad7874d578a8", "comment": "Malware payload (AgentTesla)", "value": "cc0f338358d7729fa8f4827bf1dd12546f5886c4c636419451a7a10292d2f9e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934731, "uuid": "d20af92e-5756-44d9-b9d1-5471ef96bf4d", "comment": "Malware payload (AgentTesla)", "value": "5528884a212cd79d1f5f3a9e1fa99cd648686e57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675934731, "uuid": "bd174381-d6e9-4b67-8ba0-54076a7ead65", "comment": "Malware payload (AgentTesla)", "value": "ee1e8775defc578f064e435e411516452becd2e729cfc284c4f605d60e80ec6bee522534e7b464ff27ce82b22e68db25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934731, "uuid": "4c8b4520-c3ec-4b16-b997-6ae9867d7ff1", "value": "T162D4F168FF00E80BC6560B780D95D6695960BE403C64C563B6E37FAF3F792C3B92518A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934731, "uuid": "00f913d4-931e-407b-b15d-1fba9be15b5c", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934731, "uuid": "84b175f7-0de6-4818-841b-bfb95e51f666", "value": "12288:obif/mHZzu6uhuQgRN6Zuj90Z2upnDp02nzzoRzBqaegoA6wGuTTyUwtR:qif/mHZzutuQgHt90TnDpBfaTg5SToR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675934731, "uuid": "8e9d21f4-53b4-4b94-a04a-86bba29a84df", "value": 637200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675934731, "uuid": "d8147846-e38c-49bf-ac4d-bc49e1cd5449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675934731, "uuid": "54539d94-b3de-4c6a-be22-8de6109674ab", "value": "DOW\u00d3D PRZELEWU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e0fd4b-a84d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675928745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928745, "uuid": "e284bd40-8e92-404b-b29d-04d0df16852b", "comment": "Malware payload (Smoke Loader)", "value": "a1b5d80ebdae2bb494f4a8ba3adb6189", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928745, "uuid": "9ffaf8e0-f81d-4914-9f77-2ef239824c77", "comment": "Malware payload (Smoke Loader)", "value": "cc85a91e20d7f85d9f52a2267914ae22ae99b4e69817f07ccd225f1b4d73e165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928745, "uuid": "9b6fac60-43c3-4d9b-9a5d-ad3206abf7c0", "comment": "Malware payload (Smoke Loader)", "value": "143226384b5130c002a98f2ee0b2a5e47a010f5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675928745, "uuid": "207b7eea-9bc5-4d67-a374-27e3f1028d63", "comment": "Malware payload (Smoke Loader)", "value": "6a11400cd8348c5400ee43342b756376745f53d32b7634d93eaba63573ce101858df30dcea0c1142c303d71c1481a6e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928745, "uuid": "25540073-75a5-44f8-809a-c833922febd2", "value": "T10014D03236D0CC72C56B10305864EBE66BBEB83046798A5B77643BAE4F397C0567634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928745, "uuid": "571566a0-2173-4551-a794-6211cef89bbf", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928745, "uuid": "0708bb10-7fde-4e73-8e27-90aa9237f6b5", "value": "3072:mVqMOSnT4gQIi/TLn64A1Wmd573oEt4mGu7rQWWXqhGYlHqSe6CXDTXQ4y:UqM2L7LnW1ltIu75lHZedXHvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675928745, "uuid": "f027922d-a90c-41c1-9505-c0b8cfc5c7bb", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675928745, "uuid": "c75e0a31-f807-4e87-90e3-0bd16850838b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675928745, "uuid": "3a83a6e4-343f-4e66-9daf-06e545c0bf3a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea7c4690-a89a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675961883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961883, "uuid": "caf3a92b-9406-41d0-a66c-cf13cfc9b038", "comment": "Malware payload (Quakbot)", "value": "09776a770e5631e5bb66bc73f55ff6d9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "obama239", "colour": "#896E20", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961883, "uuid": "be2d7d52-658d-4d13-9c07-b38dbf310c05", "comment": "Malware payload (Quakbot)", "value": "cc97293401b033700c6ca626147931a8955262cf4203c0ecfa80a9d7d4b572d6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "obama239", "colour": "#896E20", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961883, "uuid": "d19a80a7-9020-4fdb-85eb-c11b24e7f98a", "comment": "Malware payload (Quakbot)", "value": "56f0b64b40ab08216e9fe0c8d59ec64b23aaffbd", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "obama239", "colour": "#896E20", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675961883, "uuid": "649af595-5c8e-4712-981b-48d1e45131ae", "comment": "Malware payload (Quakbot)", "value": "6944f2a0e9e85299ad0ec754c4563791649a6869e67ef6c93cf384da7aa152194883c20c6a4cb95303075bff78582bd4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "obama239", "colour": "#896E20", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961883, "uuid": "2315ffcb-d432-4346-b038-290f81063637", "value": "T17301492C443114CDC033B78C8A7824C4E7B516961FADCD231A1D346B558EC28E935843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961883, "uuid": "5ea7dc53-e56d-4e30-8eca-715595815c99", "value": "12:IGQJsKIAiOkVFvnzyLbPQ1pFgcLJ7VjtLQfPVjtLQgtvxqDgf7DUe:SJNmDl+LjIpOcLJ5SfdSaMaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675961883, "uuid": "b3a8195e-22d3-4026-b5f4-a24024d0a8d2", "value": 679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675961883, "uuid": "5d2ea167-e058-4353-96e8-ff13a797eb2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675961883, "uuid": "9b1fda0a-b067-4359-9842-704e50ae0d6e", "value": "Open.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8497102-a8cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675983676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983676, "uuid": "69a99751-047a-4511-915f-0e8462ff0809", "comment": "Malware payload (AgentTesla)", "value": "290dccc229806b4e3a3779d62680c46e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983676, "uuid": "b0d29a48-efaa-4ee1-aa96-b5cb0a0747a1", "comment": "Malware payload (AgentTesla)", "value": "ccbf7048298b2e51bd232a83b7edf84bba906b20086647359722b3694db14fd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983676, "uuid": "0e2449ad-fa57-4c21-8d0e-19baa49a3110", "comment": "Malware payload (AgentTesla)", "value": "9c8a56d9dfb0e4b69fb2c06cd41f0238a30d2ff7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675983676, "uuid": "e2aec132-305d-494a-ad09-171b7513b7e6", "comment": "Malware payload (AgentTesla)", "value": "d219bdd9406e62d837b1ea49684ba34e1f24d1c1b53d99cf8af350a4f129670161f009a6e4b500bb93a110111d623952", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983676, "uuid": "eca18327-b8f3-4587-9a65-f815637e06f1", "value": "T126D4C43E297B56E2C578F93986E18420B5AD83933307C958EDDA2BC0CF026897DCE55D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983676, "uuid": "44acd16a-6a90-473a-bb08-a24d83c55a49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983676, "uuid": "0c48448c-5ff2-44a3-8e92-fe465d298a28", "value": "12288:UOos0ZDne7f4WYMTyPdLX2tuCAe/ZXhWh5btG6E1aCsUZ0JXtB9e:ULt7MTyPdLX2tuCAe/ZXMh/G6E1Yt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675983676, "uuid": "b620ff18-2d4e-4c44-8835-5a3c42d5c01f", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675983676, "uuid": "dab05f57-ad8c-4fd4-b50f-c0c52b42116c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675983676, "uuid": "b4a1ac11-b864-4518-b5e3-db5db9c8645a", "value": "Shipping Doc..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634d680e-a86b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675941469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675941469, "uuid": "1eb24076-1c2c-46b8-9a3e-4a73510a868f", "comment": "Malware payload (Tofsee)", "value": "ed40e0ea81dad3f053eb52a8d5e336fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675941469, "uuid": "a3207e6c-fc80-4644-a945-d6ec97485996", "comment": "Malware payload (Tofsee)", "value": "ccd87871de3d647c705cab12c95db83e7ed74e665cacf671b612512b48d87382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675941469, "uuid": "c38217ab-80e1-42d0-a0e3-b55828f3a356", "comment": "Malware payload (Tofsee)", "value": "c2b6f9d8c729f9206f5bc1898eec519179669dce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675941469, "uuid": "0d0d4f0c-b6cd-4c60-8b0f-ed8a8012fa6d", "comment": "Malware payload (Tofsee)", "value": "c1d6be600889b87999afcbe6465e1c27e2c330b43542545afc43ac7abab14799da8f3d137fd0d4df550fe0087ba0c52a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675941469, "uuid": "522d3b92-fc1c-41b3-9f36-c04666e2e627", "value": "T1BB14D03275D0C0B2C46A14345874DAB57BBEB870437CCA4777981BAE5F333D1A63A26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675941469, "uuid": "e845b29f-f02a-4049-95ea-0c46a5a5a88d", "value": "83d1b8095e33f74e23ddae505b88bb37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675941469, "uuid": "1db2b906-7bc9-420d-933e-8fd99fc44c75", "value": "3072:mhZOSYMwLCsLL62KW0h5UEmkmNT09rsLFlGdfBwsRzo:mhZ8LLL3K8Eh9rsRgdfBwsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675941469, "uuid": "3b0a8e6c-cd44-417c-b733-aa931109b3d3", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675941469, "uuid": "91f64558-383d-49f9-8163-86c555a02d07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675941469, "uuid": "4ee094c4-ce3a-40ab-939f-0296eeb84244", "value": "file", "object_relation": "filename" } ],