{ "Event": { "published": true, "date": "2023-05-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-05-02", "timestamp": 1683072182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "64d518a4-f72a-4cb2-b5b5-f07628b9ab0d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add43aed-e8ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683042034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683042034, "uuid": "25a21cef-10f4-4a4f-adac-74eb767f06a6", "comment": "Malware payload (Formbook)", "value": "accc0f01ddef889541b6dd8ba26983d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683042034, "uuid": "ac490c4d-91ae-4856-b9a4-68f699dd18e3", "comment": "Malware payload (Formbook)", "value": "00cfe203d12d732e66ba6f2bfbd6b7dff900b2c7b90cba95a435f9f78adafeca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683042034, "uuid": "85478129-cb1a-4abd-abda-4c487e057228", "comment": "Malware payload (Formbook)", "value": "11e06be084a9cacc3b2efd6dccfe2150157efd54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683042034, "uuid": "822168e2-c2be-43b9-be44-e338dc7c37de", "comment": "Malware payload (Formbook)", "value": "9e23b980bad4d7f1fd6850fdad37349f99cfeb2525076d963de6b45dcdbec95e2117c4b3f46c714b5a2d6024b847721f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683042034, "uuid": "1ab5db95-ad76-4cf5-9481-7c51a1f024a0", "value": "T15645DF606269172AD13A1BF0045CF93103B27DF6B4EAD6281DE3BCC7B6B7B43096195B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683042034, "uuid": "b984ea75-62c8-42c0-b283-8380e57b7f5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683042034, "uuid": "bf0a9520-f866-4684-9a98-581273764a53", "value": "12288:LPvQHdIkQYvRQHTWsH5TGKhUe+qbeDfiUZtvH0eDsVOrLVZwAXz:jvQ6kQWQjUAUnD3J0R+VH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683042034, "uuid": "db8602a2-d9fe-42b7-80fc-d305efc99996", "value": 1165824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683042034, "uuid": "9584fa5c-2462-47f8-8c37-58b527b76bba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683042034, "uuid": "585a35fb-ed0b-4301-b095-0eeea3a96292", "value": "Vollst\u00e4ndiges Dokument.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc448f24-e8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683020611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020611, "uuid": "eb93e130-6fab-48e8-b028-062e31f36a5d", "comment": "Malware payload (RedLineStealer)", "value": "d9a993dcf5d555bfe78229b2eebfb38a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020611, "uuid": "67537f06-261a-4619-a91d-3d227cc39835", "comment": "Malware payload (RedLineStealer)", "value": "01706ac5d5d5c63e3bc48ad705dec9377acf50268aea0ea080e9e7daa3bc60f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020611, "uuid": "e44e660b-feda-448c-acc9-09dd6a366810", "comment": "Malware payload (RedLineStealer)", "value": "2bd83e967b4be9d4eeb603391fc2bd803b9d7dbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020611, "uuid": "3293534f-6e40-45cb-8fda-879f32b2fd00", "comment": "Malware payload (RedLineStealer)", "value": "697b1b91938559eb455bad2c5d1a69e0a6f51e31e1e100e5eab1cf684f94dfe87394044cbfe8f662aa6f1a3cf3dcf1f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020611, "uuid": "045a2b8c-cb8d-475f-be0f-ebf8c25184f8", "value": "T1DDD1A614E3E8473BEBB20A7BD873A3914374F72996678F9F0845811FBC192C94A21F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020611, "uuid": "ce16b3d9-a123-4ca9-a752-54b08aaa8a15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020611, "uuid": "0e5d5cc1-0720-4df5-9786-c519ed52aabe", "value": "96:w4qJQqSUQ1i+sbeofgowp4N6DWkqyUF7Q0takKxwr0ffs9ghT/bFnU:5qJSUQklfvwD+v7Q/kKVffsm1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683020611, "uuid": "c09fcaca-2b6c-40f2-beef-9f99de5bc834", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683020611, "uuid": "b5d63781-0ed6-462b-89a2-b42581e2525e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020611, "uuid": "6340cc28-5f85-478f-a89d-e4db96e97b7c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce317e66-e8dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683027056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027056, "uuid": "776c2bdb-1ac3-48a1-b4f4-d4931518bdbc", "comment": "Malware payload (AgentTesla)", "value": "9b97c94ca5dfdfc77b75477e4eebe867", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027056, "uuid": "00633460-2dcd-4b2c-b60f-b48c58e4fb3b", "comment": "Malware payload (AgentTesla)", "value": "0494623f46dee59028737fd272af2a35b144c38bd2a0a5f8ebcb131a45aaf71c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027056, "uuid": "636e1360-b872-46be-9278-2b4a0e99387d", "comment": "Malware payload (AgentTesla)", "value": "af95d435b3cd20e787e3aa0f50ff6437dc68ced9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027056, "uuid": "4dcf064c-c690-403f-a679-04fab08c4776", "comment": "Malware payload (AgentTesla)", "value": "d1be3f5a50e7f14a2166a2f1e22b7bc5f6b487ba7a4ce03ee670b73bdf32d170ce6e514e79447332ba9766623fa72f04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027056, "uuid": "69ee373b-b41f-4fd9-a3b1-e5d906267b09", "value": "T180C4D00A6165CF1BFD798BF08474FF8463F0B1B764E4D1242EBA21C6EA96F011E4895B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027056, "uuid": "e9470de3-91f4-44fb-ac0d-afd941174264", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027056, "uuid": "b4b663af-c57f-4eef-aae1-addeb4e7883c", "value": "12288:HxMHFzrA/lsELhbTmbwBspjGP+P4MrEyTQ+K/4mIB9Y6PL:qrA/+ELha0/mPfDQ+KgmITY6PL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027056, "uuid": "87f8160c-8806-4496-82f1-6b3fa36aa3ee", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027056, "uuid": "d2243449-b381-40b1-8648-7cd03d4ea752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027056, "uuid": "dbcbd98d-c146-4acd-9c1c-159946a22ac2", "value": "#order 02390021.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610b00ff-e8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683020431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020431, "uuid": "0494c478-ed17-4e9e-bc55-f6d9278b732d", "comment": "Malware payload (Vidar)", "value": "724490ebfbe1972a23d40e025e53965d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020431, "uuid": "c1136322-a8ac-49fd-918d-5cf51f1feaf3", "comment": "Malware payload (Vidar)", "value": "04e61761f74029f6ba456910866ad2011b9780cbf036a1dd7b050605f98ff7ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020431, "uuid": "2937de8a-c26b-4b13-9973-a2254c824f89", "comment": "Malware payload (Vidar)", "value": "e9d4d000d1962c3a614115bfdc69c1806d296ef3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020431, "uuid": "b2b0b15a-1563-4bd2-8d58-8c4fb3032f83", "comment": "Malware payload (Vidar)", "value": "b677513c0ff81b8c4cd4b4c30776f0238bf9467669c4b03f82896934915e1acfdc6c634813452edb9e8394cf6de84748", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020431, "uuid": "610884a2-669a-4c27-ab49-a2f195d68be3", "value": "T1B074BE1363E26C70EE224B324E2AC7E46E1EF951BF157BDB1B54AA1F09701E2D572702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020431, "uuid": "f0c4651d-3332-444a-8b0f-75e1329da18b", "value": "d80920b1ebbbf0bc36acf978031f88be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020431, "uuid": "7a62e760-fe26-4a21-aa9a-0ebc15873bac", "value": "6144:qKE5Vvpc6wNfQJY7yfRYNicBhkuGox8BYkB0NjceT3sS7QQ:xE5Vpc6rY06LTkuT82kB0NLlQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683020431, "uuid": "c3af6766-ed36-4630-8bcb-9f8b7489b2d7", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683020431, "uuid": "0b349c9c-2a98-40d9-8d45-12e806c1d4c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020431, "uuid": "6f8f20ef-d60b-4cb8-9069-896fd573442e", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b5c67e-e8ca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019340, "uuid": "f633132e-716f-4edd-9008-7d603d0b80fe", "comment": "Malware payload (SnakeKeylogger)", "value": "e80eeba3f3f250de2759818b6ca2b030", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019340, "uuid": "2d589c36-47d4-43de-9b83-65a61e3ad39c", "comment": "Malware payload (SnakeKeylogger)", "value": "050ff72362dbca4fcf4aab3117d7215c3f66f6c271f0f03955e75e3083fb6bb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019340, "uuid": "1509303b-750b-4e54-a948-99761510af8b", "comment": "Malware payload (SnakeKeylogger)", "value": "a4b7821fd9b2e51ef22032e51643b907d08c8bd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019340, "uuid": "0b79d1dd-678e-4177-84d9-b5485f7e941e", "comment": "Malware payload (SnakeKeylogger)", "value": "a0cfbff5b72dda17207b110fa3abe88735d13f41f20a597e2736a0f24c58b26341f6038b0937ff10bfac6ca67bf54391", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019340, "uuid": "6e774470-7fac-4980-9e0d-449d91d692d7", "value": "T1FFC4DF1A5064CF1AFD7ACBF18474FF8463F0B07765E4D1292F6A61CAD9A6F010A4CA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019340, "uuid": "2dc70cf7-5322-499b-a2b4-caf3380702a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019340, "uuid": "bfe2b2b2-3532-4176-920a-d9e1f0b7aa8f", "value": "6144:N4455J7Fs5eH+8o9nWVgCC0z1u1TijTAfdnaLig/oT4u19kLjryE68xrXGxqntAO:hRO7io1KAln09/oB9WjrL1bvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019340, "uuid": "c00e1191-b6a9-4f4a-a6a2-16c70a7b6f21", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019340, "uuid": "bfd7b67c-23dd-4bd5-9084-e8a2eb241a14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019340, "uuid": "fe55f50e-c62c-4928-9a67-6bea98b09751", "value": "Hesap \u00d6zeti.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc4f2be-e8e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683028958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028958, "uuid": "acb3f767-0b3c-4418-9ef3-2d6d05785641", "comment": "Malware payload", "value": "d80bd72ab79a8c8593a5fdf7fac250ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028958, "uuid": "9e157140-c64b-4d0c-bf26-5dbe091d6314", "comment": "Malware payload", "value": "05294be59bb6937d4fea241fe05412c9ae36fbf7e98911b321a9dca834cbd1a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028958, "uuid": "2359c6bb-c5d2-4dec-879d-59997235cbb0", "comment": "Malware payload", "value": "55fb6d0fca4506e55dfccf19e207e5a906b50bc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028958, "uuid": "0312d68c-c897-4422-a675-db082448f351", "comment": "Malware payload", "value": "4ffbfaf9385e43b3a898484eaebdf8fac89bfc0994cfbe05ef4c67466873de8ba9257cdfa3929b59fdd8c1425966408d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028958, "uuid": "9069c503-ab8b-40aa-ab2e-a280e07594e2", "value": "T189463388ED1DD045E504637AC062F77BA12CBCAD1C46FBF1A4DD2C88A35BAA1F50C6A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028958, "uuid": "48610e82-0386-4a9d-bab3-abe5a5ec2827", "value": "63d926bab4649641f492888f61234125", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028958, "uuid": "374cbbbc-d308-449e-9064-5fb76a9eb0c5", "value": "98304:AFehg/MMbKe+xZ0t6TiamCe2VhmmtPTf1rxDxwq7kuFNoCEiX+ji69T69eIKnX:OCgJX+8PC7VEm1DzhAuFNoCXOicG9eIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683028958, "uuid": "21da5907-74a0-4556-a7d6-8a58a758d405", "value": 5807634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683028958, "uuid": "cbfe69af-463c-4d66-be77-7b8769b0866a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028958, "uuid": "f842e268-ee00-439f-af46-d4f51e01a35f", "value": "d80bd72ab79a8c8593a5fdf7fac250ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ef94d3-e925-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683058280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058280, "uuid": "61bfae3b-d7ca-4583-9364-c0cc3169b1d3", "comment": "Malware payload (AsyncRAT)", "value": "d22b55caf7b6c060949e4175bdcee3c2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058280, "uuid": "bfd747d8-e3fb-4656-ad70-f22598b57cac", "comment": "Malware payload (AsyncRAT)", "value": "0680248817a8116f7241a6d12f5354c8b8bf4f651d092d370989011ce0878d5c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058280, "uuid": "a05adc89-0f33-40b4-92a5-4f3dbbe3aeb0", "comment": "Malware payload (AsyncRAT)", "value": "87f294ef9e0834258b83b6813ee69d75b4665f3a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058280, "uuid": "f05455b3-586c-4aaf-94f6-f3fb47c8e592", "comment": "Malware payload (AsyncRAT)", "value": "fe6430a0ff62b6b0a0747fd913d27dba16bc697c8920ff5dfb4e7545afd115a652178a3f4b4334df1b6e3255f3964f0e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058280, "uuid": "17162747-f3b1-43d5-a700-f13c8ca4fc5a", "value": "T1012533CBDB725B149043C6D2B2EA2AC837EA909C3B0CF49BCD9E5571503F9A6805FC16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058280, "uuid": "2f932b11-d485-4497-9545-674f4ef25c54", "value": "24576:Mgfy9u3eEsreYnbWYSeAfrphva0gQhzrZhak:/BuEsBTS3va0VR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683058280, "uuid": "2788d59c-c29a-4a9b-a4fe-bbe016b4c3b1", "value": 1037798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683058280, "uuid": "dab97c3c-c77f-4ebe-bc5f-64031fab22f6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058280, "uuid": "c208b300-e382-44e5-811c-a129954a2ee7", "value": "FATURA_1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa45f897-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683013386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013386, "uuid": "785b8b26-cacd-4b43-ba45-504ed3955982", "comment": "Malware payload (AgentTesla)", "value": "78ff188393e68ed6911e4df88a8d3822", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013386, "uuid": "1b53f4ea-a762-4dc7-b782-d23120a51799", "comment": "Malware payload (AgentTesla)", "value": "06ff6406d8466d250b94b2954469fc140cfdd746e05f4fc3320791900efeff27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013386, "uuid": "9488bf83-0769-46fb-8bf1-463c1b449d89", "comment": "Malware payload (AgentTesla)", "value": "84fea5a9ca308155411fd996f119290ff7bac56b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013386, "uuid": "1f58f7c8-a371-43f5-85e4-146a96dd3341", "comment": "Malware payload (AgentTesla)", "value": "fcdb524a6850da18d236b6de2199d15349bb71ad7bc3d45142bdb62e3d9b3d511269ad82e9a13d0cba81885e0bb002a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013386, "uuid": "6d5ce983-c461-4417-be21-9a4c5fd563e5", "value": "T1F0E4383829BD2727C179D7E58FD08427F664A86B3021EE2598D767E6431AF1225C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013386, "uuid": "01b427a3-a89f-4164-8f02-ea777804007e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013386, "uuid": "42375f3d-c758-4e27-8d0d-9ebd4eeda3e1", "value": "12288:SbSJgvmsoik/ljp3Xn4Oz0jyZg190L1aFccz9eaJV5vkFYQTLR4:SbSJgvmsoiklpHnXfZg28p5MFYS14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013386, "uuid": "621851a9-8ec5-4796-bd82-4f1a1d5ba96a", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013386, "uuid": "491783e6-350f-4691-b8d9-92e027d66a97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013386, "uuid": "40b92f0c-d34a-47f0-8342-45ba043683a5", "value": "Fatura_20230425_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afaadfc1-e8c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683017127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683017127, "uuid": "ea3ec419-2cd8-441c-b2bf-d04d7e9cfde2", "comment": "Malware payload (Formbook)", "value": "a4a7cb6d604cbb96e5fe55684b203ac3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683017127, "uuid": "bb9cf51c-84f4-4a1d-8a1b-454528525a64", "comment": "Malware payload (Formbook)", "value": "07c9128dda695d5de3c5a85928c8b0f1ef1f679ff0ecb65e209c19b9e78b363e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683017127, "uuid": "1e242fcd-fc00-45fe-b79e-6509a81ed7e6", "comment": "Malware payload (Formbook)", "value": "450609abc5ce910d461503633756f3b8346d9e3a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683017127, "uuid": "ca1ab86b-2f67-42a6-9636-b51f3c6609df", "comment": "Malware payload (Formbook)", "value": "29de9f5e7545d4a40d5d29ff8c1a4b9c87605854f83f5c8583e1276b57b422bd4cd2258e4b2c8d89b2854ab3b49e8151", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683017127, "uuid": "1c0081eb-b828-4e10-96ba-6f3d15f57fe2", "value": "T17D45DF062168CF4BFD7A87F15474FB8423F0B47761E0E2282FAE61C6DAA6F110E5951B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683017127, "uuid": "e647ac67-2d47-406c-b850-ef136c7f63e5", "value": "12288:CDkFlBM30HzaNZ/eFlBT6FRC+ryGYkMqZdcT:JE30TaNZ/k+FR7rIIPcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683017127, "uuid": "b0c4f229-18c9-4f6a-97d2-706582b3f226", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683017127, "uuid": "b4c90bc9-8223-4fec-8885-6f5ad266a15d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683017127, "uuid": "e99e272e-650c-4056-a0be-2559fca63c9f", "value": "Payment on Hold.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b3bdbf-e8be-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683014137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014137, "uuid": "e5b2625a-0124-46e6-9ab9-4c7fd62a1d9f", "comment": "Malware payload (Formbook)", "value": "22eb449816a6cf009bee1f99ee35d61d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014137, "uuid": "1951b27a-cc8b-4005-86ac-dbe83f4ce782", "comment": "Malware payload (Formbook)", "value": "094c828c0c8664c48ead4edf0b338db6cf39b0e759a1b284a171f5c32fb68402", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014137, "uuid": "49cb8c15-b45d-46aa-9998-822ca4846e6b", "comment": "Malware payload (Formbook)", "value": "ebe3daac5871fd9b02c13d49cb2dd428b9d1d57c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014137, "uuid": "0019daf4-312f-44b2-aac7-d30870a0c34f", "comment": "Malware payload (Formbook)", "value": "f0e7970a0adfa1ab699a106d4294765bef84e982c9b50175d8e028666554441ec7f3d60aba398022d3045fba1052d220", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014137, "uuid": "160852c6-61c9-4089-8c9b-dd4ceb1f671b", "value": "T100D423C7D3A5B794C0662AEDCB9E35A6E0D989174EB41FB785064393EE2C8C31427CE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014137, "uuid": "39131270-35df-46fe-94c8-d2d5b84e8eb2", "value": "12288:9OtbtoQOqqVH9JQgyP22QgfVdHn2kxpeDa+E2wzgLFOzw1:ItbknDlg992kMa+EyLFOzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683014137, "uuid": "22c630c8-03f3-4801-a973-17e2f33bf0f6", "value": 602475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683014137, "uuid": "c2322ff1-1a8a-4c3f-813e-8b813eb7299e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014137, "uuid": "32dd0dd3-0925-41b8-b28f-7bf81b3f3551", "value": "URGENT REGUEST.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05c4d37-e8d9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Ebury)", "timestamp": 1683025718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025718, "uuid": "03d848ff-d527-477d-88f1-74ea4a73714b", "comment": "Malware payload (Ebury)", "value": "fe7822e713e068c4c22fd1591242ca5f", "object_relation": "md5", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025718, "uuid": "84f1feea-9d1a-4851-b31f-39f2224ad46d", "comment": "Malware payload (Ebury)", "value": "0a4d7321a74e7c86ad017f99d62899cebbf66752955a64cb36e6b19191d6c09c", "object_relation": "sha256", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025718, "uuid": "155d37f0-3e2a-4c80-9d64-50cef9336575", "comment": "Malware payload (Ebury)", "value": "91a185e0666305f5c42d084c6db577bc36518384", "object_relation": "sha1", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025718, "uuid": "eefa92e6-abef-4dac-87c8-a25da1d51447", "comment": "Malware payload (Ebury)", "value": "fd5b2c29f9f89d6000966b40f402a694a5e3624519ccfd726800dab2fe317f666c8c93b8a6cc75f480df010f2c6a04a3", "object_relation": "sha3-384", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025718, "uuid": "e89e3938-7af7-4d9c-9569-1c77356130f5", "value": "T1F1033B67BD98917ED546C3308EEFC2374AB27C446A3132CF1A846AA13F65B294B1F714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025718, "uuid": "2636a705-7ad1-4a26-83f2-1dc60ae85ea6", "value": "768:xrc/Q7ET8k5ScWUQKbzA1XS4p5scd1YQdvAs4/:x9gTr5ScAKo5SY2cRvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683025718, "uuid": "efb05875-9fc2-4710-bf47-1bb503f7ecce", "value": 39536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683025718, "uuid": "1e76e87f-92fd-4c9a-a48b-45c23e3d992c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025718, "uuid": "e9876163-ed9c-4603-bcbc-cac4fabd5e93", "value": "0a4d7321a74e7c86ad017f99d62899cebbf66752955a64cb36e6b19191d6c09c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d4f697-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683013381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013381, "uuid": "635c1e28-3427-498e-ad46-961437c304f5", "comment": "Malware payload", "value": "c75c41bbbd82ea5a44d68fbba5de6b2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013381, "uuid": "155af7d8-8266-418f-94fa-a293f2534db8", "comment": "Malware payload", "value": "0a844270bff0529cdeb039fcfa251771168478c751c9d90ffdfe961079b6999e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013381, "uuid": "43c5bcf4-68e7-4c3c-924b-6246cd6c94f4", "comment": "Malware payload", "value": "6bb6ce62c235beab31e356fe8956a476f336b17e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013381, "uuid": "d5e9e517-5b4f-47f6-a51f-9e748a9bc635", "comment": "Malware payload", "value": "d36e186d733b7fede12bd2a9058a6efc3d5ef273acdea714f71b6ce60fcae24647872cca44deba491392c815d0db08ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013381, "uuid": "fcfffdc2-b648-4199-af87-3494e731c620", "value": "T15A443B6E51AB9047FDE6CC30BFF96654872B97EBAE4BD6F006986270741005AD8C343B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013381, "uuid": "1f7c6e24-e430-4233-9398-e03e2fe4f45e", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013381, "uuid": "8a57b11d-2188-4f63-b137-26da13c67c30", "value": "6144:MVr6xfsOp965hqulmvWLx/Vu31oIXLvYXXA:vLvmhjQvUxVKqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013381, "uuid": "cbd3498d-7024-49c6-b8f2-16ef3e4d91e9", "value": 269664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013381, "uuid": "01996a5a-842f-489a-9dd9-43ba05a080d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013381, "uuid": "58aed097-ee38-4eb6-89b8-6ab5881dd5ba", "value": "FACTURA_ARIZALA.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a14698-e8da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Ebury)", "timestamp": 1683025968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025968, "uuid": "57b90175-b5f0-42c3-8715-98acd0e3dc07", "comment": "Malware payload (Ebury)", "value": "bde5c35978002d2ca05a6e722f9a4bfa", "object_relation": "md5", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025968, "uuid": "ab241905-b50b-4e9a-9182-11b85625e765", "comment": "Malware payload (Ebury)", "value": "0b21282d684704055e91626f486a7306d01328050e65249b54f209f3f8a25f74", "object_relation": "sha256", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025968, "uuid": "bc7e268b-1b1a-4aa6-8f53-b4d18e12e14f", "comment": "Malware payload (Ebury)", "value": "757f410960e13ef12c86c928a80fee4862967e15", "object_relation": "sha1", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025968, "uuid": "163cfac6-b569-4e26-bdf4-c91baecadb67", "comment": "Malware payload (Ebury)", "value": "83f4829a757f9acce2230a33ec0e40dbd2a5c1408531a4a2dce6bc03e39d13564c9359bfa3153d8628666c6be747db64", "object_relation": "sha3-384", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025968, "uuid": "ad3c7462-43d4-41c2-a67d-776696ccb1ca", "value": "T197034B67B5D4443ED54EC7708EDFC6330AF6B9896A3232CF29C46AB13F21A190B1E615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025968, "uuid": "68e6b2f2-713a-4df6-92fa-bf058cb07a7d", "value": "768:t15Tlua8JhxR/bVGE78h5vGkrdVus4BrEVCAE:tvluhD3/bVGN5+k2s5Cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683025968, "uuid": "45f6e2b2-887f-4909-8bc1-6ad8756d58fe", "value": 40224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683025968, "uuid": "de2aac0b-105f-40e1-b3b0-79ff18c6cdb5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025968, "uuid": "5df4b69a-62b9-40f7-aa06-cd6ff01ff0fd", "value": "0b21282d684704055e91626f486a7306d01328050e65249b54f209f3f8a25f74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ec6f5b-e8bf-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683014421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014421, "uuid": "7f000ea1-884a-4816-a53a-53a5acc49e5d", "comment": "Malware payload", "value": "92dd851295c827b31e761d60a43c2a9f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014421, "uuid": "ebb6fe37-4831-42c1-ac7b-c4431b0e3c72", "comment": "Malware payload", "value": "0b55f5a9c187881834e870766379fdf5ae11dce3bcd10386d3230ef0ec95f07c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014421, "uuid": "6507c897-7a98-4893-9a0c-d4d9f9e3ce2e", "comment": "Malware payload", "value": "44f0cbf794f76b13cad0cec14d60030797dd80ce", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014421, "uuid": "a95f049e-39be-4ea8-bba3-a63574ef3958", "comment": "Malware payload", "value": "2766982e42f32d8299c62a8a18e172e957f3ab0073113ed4e9597357ece2b1f9919aca0903fe4647f6b830c64477338d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014421, "uuid": "95867c87-2a25-45cd-a3df-61c79f1920c0", "value": "T1CF67339681B9FB1FE223F372927A0E87EE98176D18C1FE5D1F39419C0CA3C05D9A6458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014421, "uuid": "11be4b29-9c91-4a43-becd-0c87674308d1", "value": "786432:VjLYng168+82D6fz2MrdoU88D2DxdH7ZHWiWOq1Z:tLYg168+82D6fdd8zBWCq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683014421, "uuid": "c9940443-4503-4937-81f1-b833f40f8658", "value": 30073133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683014421, "uuid": "9d740309-2b16-46fa-8559-3eaf68052927", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014421, "uuid": "b70de931-c614-4923-a819-6eff4fd30d14", "value": "MetaMask630.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdd720f-e8ca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019328, "uuid": "4abb5000-3616-4ede-8377-996959274078", "comment": "Malware payload (SnakeKeylogger)", "value": "c4666b037f3fc1f7682bbb525477ec57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019328, "uuid": "bcf3b0a1-e236-402b-9180-0838ee1babee", "comment": "Malware payload (SnakeKeylogger)", "value": "0e28edd49df1a28f394bd5929bf06d04418c9365980bdd56a68d058ee56f52a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019328, "uuid": "1872088d-a944-4100-86c6-d00fa5f30b68", "comment": "Malware payload (SnakeKeylogger)", "value": "94258a03c3ebfa3c62621c2cfa2275ea493e908a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019328, "uuid": "15469f6e-4137-4f69-9f5a-25e80e19f8f7", "comment": "Malware payload (SnakeKeylogger)", "value": "1b7a401a64a02e91b53a8ebfaea7a855459cc78834af6340f75ff2ecb9f8149f7d7e530a8c7c219d05d5de8ce28b6a91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019328, "uuid": "66826475-0fe4-43cc-ac9e-f520a3b6dc60", "value": "T12CC4DF0A5064CB1BFD7A87F19474FF8067F0B07354E4E2252FBA60CADAA6F011E5961B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019328, "uuid": "d1d89536-e457-4ac2-a725-d99fec8c38c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019328, "uuid": "72b2a949-ba30-4af6-a8d5-7b01b087a634", "value": "12288:cDEj8OogHnvxKMIhyEk62TQyouF/JUKio3:18lqvx9QlJNW6Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019328, "uuid": "f171e5c6-07ed-43bf-b895-e249ee390fd9", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019328, "uuid": "54c1c276-1569-4439-8aa1-6f9a51739933", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019328, "uuid": "20d88708-9bb1-4195-87ad-0ef9e7668959", "value": "MV GOLDEN SCHULTE Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28b4fcc-e8e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683028728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028728, "uuid": "2b2fcbca-f391-4345-9bb3-e60bf15486da", "comment": "Malware payload", "value": "df64a47f5499b59e1fd948e4f5af4e4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028728, "uuid": "3cf13f91-f2f6-440b-99cd-d641e08e2d4c", "comment": "Malware payload", "value": "0f8b465b7525c177b4c9e7c9dda97f75356753fa097f86be395a2b6de08770e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028728, "uuid": "6c433b75-f91b-4a4e-a9a7-b988bf383718", "comment": "Malware payload", "value": "dca13f8bf00b167bf5679561eec9b34fd92a90fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028728, "uuid": "651f83bd-e0e5-40cd-90e7-c3d71181d918", "comment": "Malware payload", "value": "9afdb56d1ae36bb2e7a954c2c4431d1e9627272d00aa870d443c83126cefc595e444849260c10a1a36e5cc70ba12bdb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028728, "uuid": "bfd84da0-27de-4377-bd2d-28e1f4feaa71", "value": "T1F206D700D601561ADDBB24E54AAD313EB14CDFE0131864D782C86AFEDBBA6F13E3459B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028728, "uuid": "76c722ac-1472-4b29-84da-fe800b9bcf37", "value": "49152:HLz6va++B6xN2+V+tfG2VcruFG2KALO9D3pMDuDhEDL4xqU9uBv:rzC+CqfG2VcruFG2KAyVEDLvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683028728, "uuid": "4256ce9f-86bf-4fe7-b66a-2030371d7154", "value": 3854345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683028728, "uuid": "82413e25-d2ad-4251-b7a5-dd89180db5d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028728, "uuid": "ea205a65-371a-4e55-a5e8-5c9fe58ef7a3", "value": "df64a47f5499b59e1fd948e4f5af4e4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ef57b7-e8da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Ebury)", "timestamp": 1683025975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025975, "uuid": "918c8489-b2c1-4f0e-b3f1-cc39dca1512e", "comment": "Malware payload (Ebury)", "value": "6b72f413baf8a5a95097eb9bc41ddaae", "object_relation": "md5", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025975, "uuid": "b806c969-ef7f-4386-8e02-233f0adc9f8a", "comment": "Malware payload (Ebury)", "value": "0ff67422b735f31ad37010ad686fab23874c595dd6ff8f3d7e5620cbd7dbcb22", "object_relation": "sha256", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025975, "uuid": "0d28b960-ddf3-4709-a3f9-ffb7db407398", "comment": "Malware payload (Ebury)", "value": "36d27d4dd368a3bf9d3fc93139d99ad5d9817ac4", "object_relation": "sha1", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025975, "uuid": "1117e7d1-ae7b-4612-b6ed-cd31d8f04902", "comment": "Malware payload (Ebury)", "value": "6a4a674ad11ce3442ff797a89c286ee5d637df92516a88fb8fbf7679c082fe1951d2e357fbf4402e129f9b31b30e047b", "object_relation": "sha3-384", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025975, "uuid": "3c61cedf-9d78-466a-ab0e-2d79762399d7", "value": "T1C5033B67B5D4443ED54EC7708EDFC6330AF6B9896A3232CF29C46AB13F21A190B1E615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025975, "uuid": "69ac5c59-8f76-4b94-9665-e03d5d84a6a7", "value": "768:B15Tlua8JhxR/bVGE78h5vGkrdVus4BrEVCAE:BvluhD3/bVGN5+k2s5Cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683025975, "uuid": "8b7641c4-599d-4ea2-b439-54efd66a6d9b", "value": 40224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683025975, "uuid": "8cf853ee-91d9-40cd-b15b-d966f1c812b1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025975, "uuid": "ba006090-f85e-4ff0-99ea-c6bbee429a00", "value": "0ff67422b735f31ad37010ad686fab23874c595dd6ff8f3d7e5620cbd7dbcb22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f61198f-e8dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683027327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027327, "uuid": "71cbb54f-40e5-43df-aaed-a18791ea735e", "comment": "Malware payload (AgentTesla)", "value": "73e8af8237a50fd508e2ea20f321c2ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027327, "uuid": "7cfca56b-b349-4153-9d02-fd8b3a7da46e", "comment": "Malware payload (AgentTesla)", "value": "1025ea55a0dc2b783a15f4c8d980b63d16a89a1e0fdfce39931de521d76f9f3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027327, "uuid": "143a2ce6-b9c0-4a19-a5d8-49632053b0c8", "comment": "Malware payload (AgentTesla)", "value": "1bc8ac9310038f78cf4e7ab74763b80a6af95163", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027327, "uuid": "80f7b5ad-048c-4e65-92a2-9d7d084869d6", "comment": "Malware payload (AgentTesla)", "value": "8bb4340228fdf683628d5877853e14a287e7734d19fe1d124c5edac80d4296e203ea5b7d3ed4fc659314c89e6289a6b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027327, "uuid": "a8a6ea3e-5970-46d1-8e52-12603a15e714", "value": "T136C4D01A61A4CB5BFD7A8BF09474FF8463F0B07764E5D2242FBA20C6DA96F001E4951B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027327, "uuid": "ea67f4d6-bd14-4204-9d5c-e4fae570f863", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027327, "uuid": "d3624815-08e2-498f-ac40-12604ce8bedb", "value": "12288:DEQ4bmVSISBI955ag4YrBSasjPaca67zPEH+ml:dke9zX4Ykeca67O+ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027327, "uuid": "a7ed42be-42c5-4cf7-b65d-4460432f1d29", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027327, "uuid": "c6502bb9-0cd8-45e2-8d25-b7d244f87cd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027327, "uuid": "798e943c-cb88-4a1e-a4ab-a43b6950d1e6", "value": "Dhl.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7310f57d-e93b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683067706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067706, "uuid": "24696ee8-fc84-45c8-8213-9828347f528d", "comment": "Malware payload", "value": "99836f4f236daff04b190f0bd6359ff7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067706, "uuid": "73cdd4e6-6499-45ec-ae53-662cf2935aa6", "comment": "Malware payload", "value": "104a969604a948f31314155205803b2446c620f6f5dd5b438e26e189febf57b9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067706, "uuid": "c3969363-ed07-4b0c-8957-f70ab1b33a0c", "comment": "Malware payload", "value": "ec550a41c011568c6f6fdaa0b3f1e9735b5d289c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067706, "uuid": "1ae16f1b-d26a-4070-99d9-5cf9e3598f8e", "comment": "Malware payload", "value": "4ba54f66370016076014eaf874a1c092ef587123b79b12c282e1705cd1b11d56f0a0dc044ed433659b1da726f5edfc3d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683067706, "uuid": "08f5e659-65a3-4c31-98cf-0abb3a049e64", "value": "T11E03295B9381133A56220264660F5BD1F7B498386A62D7A0F49FC26C3381D78D6FBDEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683067706, "uuid": "33d95c56-7d99-42c4-936c-e66369e29830", "value": "768:P+UdUbjIwgTC1CkQiUzV3JIm3DfTx4SFPC7JA2mHXD8tGb+hWX1ZOWOK:PN0jId+1xQiUbT3DbuBAVp1ZOVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683067706, "uuid": "54712c16-cbbd-4057-a442-d5963259925b", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683067706, "uuid": "01b26a8a-63fe-4e61-b0aa-24a300d97428", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683067706, "uuid": "b62c4e39-2dce-4a06-b8e1-9ea29995ed6a", "value": "A401.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b10045-e8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019450, "uuid": "9a1cc102-5b0d-4d1a-895f-3c896ce36916", "comment": "Malware payload (SnakeKeylogger)", "value": "2df356f15f9e13cc8ebb0eda3f9e73aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019450, "uuid": "1f988fad-49d0-4324-a1ea-4dcf68c95b14", "comment": "Malware payload (SnakeKeylogger)", "value": "1148d4c103198f09735c2882ae5eb20e4fec6b5aa0b51c8fb83cfaf3a2b52875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019450, "uuid": "1216e60f-fc98-4245-9885-b1953ebaf586", "comment": "Malware payload (SnakeKeylogger)", "value": "375ad0006d92d7373bd3d00e5a300ca4fd173998", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019450, "uuid": "6c80fa40-5e26-43aa-a479-a7508ee19b57", "comment": "Malware payload (SnakeKeylogger)", "value": "4aab55dcba3c513c709aef3601f0d5f61f99a48b1f0fe9e36197052a8367b8f5793878dc5389b91d854f7ba1bb494b8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019450, "uuid": "7bc99507-3057-421e-bad0-a1581737097f", "value": "T10F153CD1A050CC9AFD5B46B1EC2AF5B020A7BD9DD4E4410E56A97F16B6F3342209FE0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019450, "uuid": "2d4cad95-86fc-4fac-9a44-34ee62c95ca5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019450, "uuid": "9b4982ce-dc18-4e0b-a54f-a2f14d9b561f", "value": "12288:Oldiuj8Q1TlMmHgwXVcAEXK/tSZmoBaeYXJwxHFlswTSy:MBj8QZlhjVlEXKFSZ3BaeY5mFlTTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019450, "uuid": "69443181-651e-4e18-86d0-9eb696941d25", "value": 916992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019450, "uuid": "bace5b87-bd4b-4778-a19c-ff2216909bcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019450, "uuid": "25c3dec7-def8-4a66-9a94-621d50b51f16", "value": "PO202305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2111c8a-e8dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683027036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027036, "uuid": "0800c43c-a4bb-420e-9df4-22ba7c9cc28a", "comment": "Malware payload (AgentTesla)", "value": "a88d4ca6c585533d1eb2b574c3ba3183", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027036, "uuid": "4d37f9d0-237f-4e83-b697-b61f088ae32b", "comment": "Malware payload (AgentTesla)", "value": "1170e879b605319f3c4cec1d0a5a28746fc98f1131bbc73b596f3ac67cb2caeb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027036, "uuid": "f41ecc48-4a3b-4e9e-bb64-f9a0eba7b208", "comment": "Malware payload (AgentTesla)", "value": "61f5c84f50a49cc5c8e3e4a643e67b60a6ab83fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027036, "uuid": "8f6912f8-9134-4b11-9775-6b4eaf120b8b", "comment": "Malware payload (AgentTesla)", "value": "f201c5420e2ebe494bd0d2ba0dfc507344fb617ead26eb8767cba5662a66e2c9edbc33acbfa6f75adb4862358aea8b50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027036, "uuid": "7fd6c35a-5416-4551-8bb4-6d381dd48821", "value": "T1D7E47B3C2B6B1FA2DC78EBB7D6645516B3E4F55BB21DCE293CD611850A0280371B32AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027036, "uuid": "f97dbca0-f78b-4ea6-abe8-1221360e6749", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027036, "uuid": "b4c6f6ac-bd5f-47d9-a31d-b25077e3ae6a", "value": "12288:56gWC6YN1Pc+70pKXQlIj5g15rK7shNYW9348L0DHz8u3CqVvwb17F/dgVT4/muA:Z5g1rTB48LaAvqVYb1weu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027036, "uuid": "8a0c42ad-988b-41c9-89c9-81b19ae65f58", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027036, "uuid": "d0d10da9-fe7a-4157-9828-3e16ff6cdbab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027036, "uuid": "38e80f2d-c091-443e-947a-b8ae27b5dd75", "value": "Yeni siparis listesi ektedir.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4971c10c-e8ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683005788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005788, "uuid": "fbfd18b0-9d1f-4a69-9e55-96da07efc473", "comment": "Malware payload", "value": "6ada3fcf24ecc9e5a9e3fab7b77b8ed9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005788, "uuid": "aaee08aa-d5e8-4406-a8b5-02b73e5db0b8", "comment": "Malware payload", "value": "11c09291e70a558964dc467f22068a4c0218e78648753dc0d3d0e3a3cbd41d3f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005788, "uuid": "fb456907-f1dd-490b-a175-2cefe56507a5", "comment": "Malware payload", "value": "c4be3fdd1a81a796884fed1fd70bc45bcabae6fa", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005788, "uuid": "d836770a-2abf-4b0c-82d2-42edb7757410", "comment": "Malware payload", "value": "10eb9a6b33957bc2055ca67a7d700b2552a918557a841543952c6c1852413de04c7b1789e0a86a21aacc4a7b94179fd8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005788, "uuid": "c8936337-8bb7-4c06-8e71-6fde0593c9ae", "value": "T139E07D2F721C3605C27C94E0DCD863C5B422D54EAE8A7DC122CA26361E0B3AC51C7C2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005788, "uuid": "9e50dc71-33c0-4cab-b758-6387cb9a0b0a", "value": "6:Q0eoLftLYVJ2/CxVDGGIOyYn7G8GSLh8uWfBNuKiN18fQ98GLg+XSc7w9:QwZYVJ22Vyk7G8pGuYBNVIAQ98QF37u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683005788, "uuid": "4fade283-e54b-468f-8737-8d7447e83efc", "value": 325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683005788, "uuid": "de39df50-5b2b-4856-a489-7b6f201ee49e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005788, "uuid": "5b6265f9-0303-4f9e-bb8e-d71c1176ec49", "value": "Revised_order_085671.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b1cbe5-e8dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1683027394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027394, "uuid": "ee0e86ab-95f6-435c-9fb8-d3d870c7cb8a", "comment": "Malware payload (DarkCloud)", "value": "da4b64c9b99a099fc8f1e776a51c89fb", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027394, "uuid": "67623a26-eb68-49ed-b389-bf436e22eeeb", "comment": "Malware payload (DarkCloud)", "value": "122c811019fc78d9c872d90ee4b7d21d923a6539980bc30f9d246b0b66003642", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027394, "uuid": "3d22be16-dd06-450a-91f0-dce343d28328", "comment": "Malware payload (DarkCloud)", "value": "f978f04c41cd2a4595a162217f32f86700715428", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027394, "uuid": "dfdfd255-a14e-456c-9a5b-963d1ddda9cc", "comment": "Malware payload (DarkCloud)", "value": "f5b20e38beaa71ec1dd7ba54daba01b95bcdeb261d75693f88e9d6be83102013aa797331a9ba1d22571d91db7f6156c5", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027394, "uuid": "d3a5634f-7fea-499b-b83a-755993976821", "value": "T15F15F1022170CF6AFE39CBF44468FB4027F1F57750D9E2680EB6A0DAD5A5F011E64A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027394, "uuid": "b390c208-8a89-4fcb-830f-ec526c458b97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027394, "uuid": "be154c5e-8cff-4ccd-a518-530a50800293", "value": "24576:yS1t1zQwT6Qrja6XIgwXL5xpvtkOsHzdkVs4GH:1ZzQk6QrjAlXrAz2Vs4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027394, "uuid": "2648645a-ee60-466c-91b2-6f1c1eff1db4", "value": 958464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027394, "uuid": "e77080cd-159d-422d-93ea-e335dcc66990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027394, "uuid": "631329d2-9dfd-4bf1-86ab-82d54efe0aad", "value": "DHL Shipping AWB Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b102a1-e8d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683023366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023366, "uuid": "910fdbde-ad61-4324-9a11-926612cbd5ae", "comment": "Malware payload (Loki)", "value": "160639d92965700ab0ce89e423f2f8c6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023366, "uuid": "12960e51-da39-46ae-8a09-3e06f8ce2b3f", "comment": "Malware payload (Loki)", "value": "12c2949284d040d7637698f4ccd25f1c1e988744574ba1686deeb4bb7e927c05", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023366, "uuid": "2eeb2c4d-ae6a-4afc-a641-39aaae94a874", "comment": "Malware payload (Loki)", "value": "4e2808edfa3a08a211769de3b39ec8c68952caa0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023366, "uuid": "4cf49d2c-5f29-4666-8066-48374646beff", "comment": "Malware payload (Loki)", "value": "6903fffccd1490ebd2a47863be0422ee4b6d70b429965b6dd1ade697cfd259cdc19cf4b9e284b51764be62998998fd47", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023366, "uuid": "7de98d85-0058-4618-9b59-002294d6cfac", "value": "T13D45E017F2408DABE49587717F1399DA122A7D623E86F8873082731F7A32F529D23749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023366, "uuid": "5763f03f-2e34-4216-97f8-6699bf58c8d2", "value": "24576:KLKJDI0Zu9VlSu9VTu9V2yu9VgbqB1nqEGbERjgjvTDbTKAS1Z:KLKPuUu7uJuWqB1nqXgxg7TDvLmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683023366, "uuid": "c050292a-4de2-49aa-9a1a-78afb3d4d5ac", "value": 1231872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683023366, "uuid": "a7839b36-f03f-47bc-9fdd-ea3555c8e6cf", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023366, "uuid": "f079fc04-b4b4-4b8a-902e-b8f5aa5b82d7", "value": "Mv Green Maveric.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4439714-e8dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683027067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027067, "uuid": "19a83fab-bb69-44a8-bb95-a804b0cd1388", "comment": "Malware payload (RemcosRAT)", "value": "6af657451e98b407d2be1b69e6136316", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027067, "uuid": "6ac84079-9048-41c5-b5a2-ab8b2fff18b1", "comment": "Malware payload (RemcosRAT)", "value": "135282c62cdf77aa847e014f9f43bf95fcde7164f6c320e53a7c65d4ab346eb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027067, "uuid": "4c6b7e43-832e-49d3-b8cf-2d46da12b14f", "comment": "Malware payload (RemcosRAT)", "value": "7080debbca5f7bd80bbe6421a56505e4a3d10f2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027067, "uuid": "a3d82df0-2ce5-4417-8ad0-3ee8bc2c1c83", "comment": "Malware payload (RemcosRAT)", "value": "e7194c50dfe29d8c31a0e08686d2d2d1e1ffe27a689caf4be0b1520841b58959bfe388dd6c30ac99e3f5793b1fc92839", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027067, "uuid": "eb1d34ee-5d02-4456-af64-b2d857a6cf1b", "value": "T1B594F1493E86E863C7014D718977E664C961B5C43C384B2BABC5B79FBAB07C22D0D09B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027067, "uuid": "ce81cfb9-4d70-4280-b025-6baf70d86d2b", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027067, "uuid": "1add91ab-936c-4f7c-85ce-e0ff4e7aeaff", "value": "6144:mx/MfixG5aLIzGuceS2BY8zu7tJHh0FNq5y2cDXBHOUd4R4zFo/xTt/DQlC:aKeGy8R368z6PiFM5Au0ZF6Zbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027067, "uuid": "77a136b3-6778-4e51-ba84-47f3ac20f07b", "value": 425472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027067, "uuid": "0ee719f1-583e-4b98-ae0f-f679ff7075e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027067, "uuid": "eaaaf086-f19a-4df8-9117-2a66225a848c", "value": "BOQ.00987578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a67e42-e933-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683064323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683064323, "uuid": "6ca39a45-785c-4448-bc39-2689ee8f8f42", "comment": "Malware payload", "value": "bec3f3db13acd680343a936fa2b987de", "object_relation": "md5", "Tag": [ { "name": "SharPyShell", "colour": "#FE75F0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683064323, "uuid": "29d67b04-691c-44ce-84d5-14b40d16cbfe", "comment": "Malware payload", "value": "13e4355af52816c7cdbf460741099bd8d4241d59d943b05761882ae034882237", "object_relation": "sha256", "Tag": [ { "name": "SharPyShell", "colour": "#FE75F0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683064323, "uuid": "e20a908b-cff7-47f6-bbc6-29463327db0e", "comment": "Malware payload", "value": "1f737ab1382a38cb2a144af5224dab76a5732e75", "object_relation": "sha1", "Tag": [ { "name": "SharPyShell", "colour": "#FE75F0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683064323, "uuid": "c7474730-aee3-4c2a-b128-b11e1acc735a", "comment": "Malware payload", "value": "1f4be123165055363f70a1dded94a66caf5055d30a5db00a8ccab1d68944ef7bdbe041249301ed9980908c45b1d13522", "object_relation": "sha3-384", "Tag": [ { "name": "SharPyShell", "colour": "#FE75F0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683064323, "uuid": "b6a90f3c-2e15-4be2-ad42-27928df71c45", "value": "T174A2A1A3705FF10F0095177A345817E264FAE64986CE858DFBCD9DADB0CE8CB2A582C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683064323, "uuid": "e71acc60-add8-4e8c-bf45-8daf9772a02e", "value": "384:kPgIGSHFueB/XRHoneea9A5eDCrrl3OVAQe8qsgiI8888P8888888/D5:kCeY4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683064323, "uuid": "b9737869-a0a5-4be4-a4ca-849f00bf6efe", "value": 23361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683064323, "uuid": "82da4de3-3b77-4794-b5e8-14a39964dc82", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683064323, "uuid": "d5dcdbba-205f-4914-bbab-9e11df183153", "value": "1A5Fq2eK.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d363656-e91d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683054784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054784, "uuid": "9dfc03b5-b5ae-4620-b2f8-84ee463fa29b", "comment": "Malware payload (AgentTesla)", "value": "4393535fed10a33abcc36ff20415e247", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054784, "uuid": "8e237691-64cb-49dc-b6e7-be6a33657f33", "comment": "Malware payload (AgentTesla)", "value": "155fa3eff933da14490907ff309ccff921001ec0f875f3c23d7a6cf744c8614f", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054784, "uuid": "806ef9ce-b550-4143-801a-c6bf9195e091", "comment": "Malware payload (AgentTesla)", "value": "0d958ffb16a33c89c541aa5c84ad76cd79a50cee", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054784, "uuid": "957a68cd-c2b1-413e-86b8-8aee954e7702", "comment": "Malware payload (AgentTesla)", "value": "dc29138f1fef52198afa960401900facccc22e0b92e82f76a7d58ca20c92d0ad8dd085ced69eddb36285c06e30328ee5", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054784, "uuid": "98f96772-2d24-4e57-a41b-c170c6c5866d", "value": "T1FCC423BE84799EB476B78348C5AFDB66FAFCB160106FAC38174BF10455E97622C32600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054784, "uuid": "c63a5b62-06ca-465b-9455-a01b93670be7", "value": "12288:aSDYs6kWP7X/l/RK9q2cwbJ5m1RWGuYDrCB4XL:vYpPFRK9q29bARUYfCB4XL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683054784, "uuid": "096be6f6-bd77-49a8-96fe-b94704fceca3", "value": 549056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683054784, "uuid": "68806869-f4d7-4dac-89e7-a4805ca2d42d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054784, "uuid": "171909cf-d751-4c96-83c2-c929401e3be0", "value": "Mc6oZL4Bnwh83BX.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5654986-e8c1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683015526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015526, "uuid": "2d073441-7029-4177-a7c5-e16b193e6157", "comment": "Malware payload (AgentTesla)", "value": "ee7723842b0ebcc96b8cc5b0d9340122", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015526, "uuid": "bde5403e-e0b7-487c-be6f-a95cfdc598ef", "comment": "Malware payload (AgentTesla)", "value": "16e67e79d382c4480603832ba0b3073208224e0e5078e3dd1e108a7b98a0f690", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015526, "uuid": "29f1304f-832f-4f38-baa8-e16376a175a0", "comment": "Malware payload (AgentTesla)", "value": "4a690923714bf807aa2a33de64ed36b10d24edcd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015526, "uuid": "de64aad3-bc19-45ab-824f-3bb5a4a444b4", "comment": "Malware payload (AgentTesla)", "value": "6efad71aeceba9909af8136ea2013f9b3d3cbeaa82b17da100e6bc0d250d433bb6b91191f8b2af28249743f05c95e86d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015526, "uuid": "3e1d71d0-a2eb-4eb1-9e3e-34e9dc539622", "value": "T187E4DF0A21A5CB0AFD768BF05474FF4463F1BD7368E0E1252FA670C6DAB6F000A5965B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015526, "uuid": "bf3610ce-0c35-45f0-94de-cfca6a024c24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015526, "uuid": "4cc5fd05-104c-46c3-8e66-311bfad7298d", "value": "12288:bdWFV8qoA45O9M1P5v+psSRZOvlSYofJsdkIcTLueQU7:Mr8rBiIB+uSLuwxDueZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683015526, "uuid": "b42761fa-1476-41bf-b12e-2b6fbc014390", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683015526, "uuid": "f45fb6a4-06bc-428c-a6f1-f014dfef259f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015526, "uuid": "ad88ac94-1ed1-4c13-9f15-a1a91a2ebb6f", "value": "INQUIRY LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2a5e58-e8ae-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683007268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683007268, "uuid": "0a9b7622-16fe-460e-ba73-888102395967", "comment": "Malware payload (Formbook)", "value": "2069a3b8bb9b313a39e1d9316d7efde3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683007268, "uuid": "ce1198e4-2ee4-426e-8b4c-c40e693481fe", "comment": "Malware payload (Formbook)", "value": "17281ec1c170da545a4081ce632bd8ce9d9567fcea6691bfde9d935c1ca8d050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683007268, "uuid": "bfe36468-ccf2-45f5-9dd0-c7b88a18ef83", "comment": "Malware payload (Formbook)", "value": "e9ad0d46bb83c4d345cd51f078086943d876b093", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683007268, "uuid": "c053f6dc-ed37-4b84-b2ed-740aed16d83a", "comment": "Malware payload (Formbook)", "value": "d9863e768e1987838caac6f88bab39abbb272f236096f7d9606b4163552f0a56df322b2dbeb9a6c02abf5fb0c2c8d6f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683007268, "uuid": "11e587c1-ada9-422e-a0a2-a75bd76c7e5c", "value": "T1D7441220B1E4C5FBE4F346706FB20B9EDED6E407A8608B0B4744A6DE7D62211E81E753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683007268, "uuid": "6c60775c-2d5f-4d9d-ace5-638af3315b97", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683007268, "uuid": "e2c336c5-a4fe-47a8-8dc0-4871333f0b87", "value": "6144:PYa6ng/2fzDJvq85cHZyWNWxCGdCGSFWUsbLVf9FCsvj:PYVgoil5t2eZsbLPFLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683007268, "uuid": "2fd0c781-4266-4d41-bdc5-694974bc4d3e", "value": 260335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683007268, "uuid": "6e780e12-61b9-4419-b27a-aefc7dfe7889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683007268, "uuid": "e3282010-8a15-4821-8275-cc115c5ca1e5", "value": "EKSTRE 04.23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81823131-e8c3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683016190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016190, "uuid": "17dc6244-1bf6-439e-8fe1-cd43f498338b", "comment": "Malware payload (SnakeKeylogger)", "value": "dc099d277df5f7e348581bbbf4cd5f15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016190, "uuid": "3c026e89-f09f-49bf-a49f-5d9305ae3291", "comment": "Malware payload (SnakeKeylogger)", "value": "1755a6d6a60e68fa8767edbc6071d2353ef42ca59b0908c0ad55b6b5d8c1289e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016190, "uuid": "d7dc4363-919b-4078-87e9-ba048bd2a27b", "comment": "Malware payload (SnakeKeylogger)", "value": "f6ced6129c14b17d2620c5254d1d668a33bcb4e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016190, "uuid": "3359bd5d-fdcf-460f-9d6d-70341c6f72ab", "comment": "Malware payload (SnakeKeylogger)", "value": "7398cfe29fd21d74e3bc5c557ca3b374f6b7a76107aa3ec5ec73eb2e1d56651495f9fe356b3fd0c3653308e5a24bfc47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016190, "uuid": "9f0df619-0454-41fb-b312-f22a0415f4ea", "value": "T150052CD1A150CD9AFD6B47F1AC2AF93010E3BDAD54E4810C1AAD7756A6B3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016190, "uuid": "2d3665f4-6a95-40b6-ba55-9816e7b3e37b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016190, "uuid": "47213110-b507-4833-8d71-6032e9db3039", "value": "12288:wa6VYqIYz1CjK2rMN80LJB8DN61RR6z1A2OwAH8:gz1CjKaMNlLJqY1RIePwAH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683016190, "uuid": "e506f5e6-6a53-4de0-999e-7d7cc2b4da93", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683016190, "uuid": "224ed130-7b6a-43fc-9a20-9b3ff220c4cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016190, "uuid": "1bdc159e-8fd7-4c52-842f-c8379a55d1dd", "value": "BUG\u00dcN\u00dcN \u0130\u015eLEM DETAYLARI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e159311-e8b7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683010923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010923, "uuid": "70e217d2-b12c-485a-aeb1-fcde3f586827", "comment": "Malware payload (Loki)", "value": "5550e00a141b6eb534931205b410df10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010923, "uuid": "c74c1bc4-3f16-4cdd-b3f3-5748f5a09acb", "comment": "Malware payload (Loki)", "value": "179fdc446f839b4ba88decc73c011758fba7e0852271ec211530f6334776be27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010923, "uuid": "306e7fa5-164d-4bfd-8e33-1293e05907be", "comment": "Malware payload (Loki)", "value": "6e394b0a1759b0b3af4e4ae400079dbccc31e3fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010923, "uuid": "3c387dd5-24c4-40e1-96b4-562f0bb8508c", "comment": "Malware payload (Loki)", "value": "2b09b8b9606cb3aba7a814379a69ce89a5a6ea8d38fb1d311c3a66f781d1407effd571596ef7626fa1ed2740cbefd6e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683010923, "uuid": "9b9f3efc-0dfb-4ace-8735-a5ff7253b029", "value": "T137B4CF1A61A5CB5BFD3A9BF19474FF8063F0B07354E0E1292F7920C5DAAAF110E5891B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683010923, "uuid": "7172575c-92b1-4486-97c6-8b05d1d3c8d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683010923, "uuid": "1ce0ff8f-8614-41b3-871f-031719af439f", "value": "6144:e445EEAUVUBzNoLm1s27XhQRl1sTgAoTcUdnCz2iLJn4RcQ2S0OIGRHmbSdrFntr:TBphoqK2rhQRiQTVRCzvC9xjZRHmMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683010923, "uuid": "333a88e7-8599-4f70-843a-bb9dc35e2fb3", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683010923, "uuid": "17070919-8ded-40fc-9ec6-14dfc9b4eff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683010923, "uuid": "d5755518-375e-47ad-870f-3142d77316dd", "value": "PO_#2001867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e31b67-e8e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683031156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683031156, "uuid": "9b1d0692-84bb-4568-9961-e6c81f684fd5", "comment": "Malware payload", "value": "f0efd3f5998273f4ace84f39d30a440c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683031156, "uuid": "19f642b8-8ac5-4c14-8c47-a54eba93d34a", "comment": "Malware payload", "value": "1a2565caf2807afaef835935e94d1e41628c254558f60b47d24b96b357675c11", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683031156, "uuid": "0d2bd60e-d4e4-420b-846b-352fb5edee36", "comment": "Malware payload", "value": "d70ad94c3e9e4ed8de265552433d01332b34ee36", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683031156, "uuid": "cb446d5c-dc99-4a74-9bff-4a24057b472e", "comment": "Malware payload", "value": "7ac4f565e05f99f3d1ff8bd46c2baec0526cfa8a507f9df21163cd8d161055a5d031e4da6534fb80e6c80ba443332984", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683031156, "uuid": "3951440f-03eb-4092-bff8-0c1ef79e8477", "value": "T1F182D71D294060350336C3AE845E82F8BF3DEDAE535351652B79BB24498777B7BF8482", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683031156, "uuid": "0ea5fca5-ead0-47c6-811a-4d30b566cba9", "value": "384:6MI6CilSRfwe0SvxqXle/8i4SwAafjnlVcdthsRa+g/U/:hDCilSFr0AEs+Ssj/YthHL/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683031156, "uuid": "2961cb29-2a1e-46cd-b505-5edde208f0a6", "value": 18800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683031156, "uuid": "2685880b-a725-487e-9020-c2cea470a2a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683031156, "uuid": "89a08de7-330f-4fb0-90ad-7b480766b1df", "value": "Solicitud urgente de cotizaci\u00f3n para pedido N\u00ba 1135 05022023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2750e78-e936-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NetWire)", "timestamp": 1683065718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683065718, "uuid": "3ba41cf8-9c19-42cb-b493-295fcfc1db98", "comment": "Malware payload (NetWire)", "value": "9c6d1aca02db373a52401485c376d87e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683065718, "uuid": "36658adb-47fc-4dfb-821f-00fa2d367ff3", "comment": "Malware payload (NetWire)", "value": "1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683065718, "uuid": "003df83c-9dee-429e-86d7-0ee8a1c6f96d", "comment": "Malware payload (NetWire)", "value": "9cc4435729a11d7c524d761b67de508b4474b206", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683065718, "uuid": "927d3b2e-1864-4971-9fd4-4ece3d66ff6c", "comment": "Malware payload (NetWire)", "value": "5af0dd5ee499279b7c41b48b01590b8bb98d0334beb0073abab0cbd48ec02a8e579a3136cbdb326c52ac1bb57fcd7d6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683065718, "uuid": "959dfa73-f16c-4d5f-a3fa-987020971643", "value": "T1EE45BE62A3DDC3A1CA265173BE2977426F7F78710630B45B2F981D7CAE61171122CBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683065718, "uuid": "d50f2f12-5339-4586-b944-cdd4fab8e2c9", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683065718, "uuid": "0ad28fe8-88c1-473a-9828-72a5b6ecf3ff", "value": "24576:iCdxte/80jYLT3U1jfsWa/69ryeoEuGfYsoRzDQ:zw80cTsjkWa/FR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683065718, "uuid": "195a0842-af1c-4f32-bc30-0fb067826175", "value": 1203712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683065718, "uuid": "3d3dac73-99d2-4c7b-b79d-6e7d9d72d58f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683065718, "uuid": "dfed16ab-ccdf-49c8-a399-d66204079a12", "value": "1A2C28A7682C26DDB97885FC056DC72B2C2DF437C5FA3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ed62b1-e8b7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683011208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011208, "uuid": "91bd9ab8-44cd-4515-9577-b7951f38c087", "comment": "Malware payload (Loki)", "value": "04c4e5f6780a3cb02d7552c4eef6afdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011208, "uuid": "9a2e1ff7-7951-4f31-80ad-bab5e6ff9564", "comment": "Malware payload (Loki)", "value": "1a9ae4ba38387ca32e34d86e30811e1cb336ee23400936268f52cf570e623747", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011208, "uuid": "c4e90834-1bf8-4427-bb91-a99d9f6b2f91", "comment": "Malware payload (Loki)", "value": "e1a14a0ea53bee97a881f4e1be345e6a88c16a4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011208, "uuid": "0ce30890-c255-4fea-8941-95fbff1ba7b1", "comment": "Malware payload (Loki)", "value": "4ce15e225d60c432a641e0392e9c5d09afa5dde81d9baba1cd58f4e123446f021ac59c7b4d5f4d21e4b98acd0c614465", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011208, "uuid": "b7bb7501-a888-49db-9839-deeaec21926c", "value": "T194B4CF0A51A4CF5AFD7A87F09478FF8063F0F07765E4D6341FAA60C6DAA6F110A4861B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011208, "uuid": "b421cebd-7f72-4c23-9d15-793937527e78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011208, "uuid": "694ad94c-8782-46df-8377-e71223bfc381", "value": "6144:0445VQTOGtzUFVII1k1u3QSjueihMnOjqk0h5jgzx+x9xa0ntAz/C:IiFV6ICk1u3b5ihcOu/4w9xB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683011208, "uuid": "9808b3d1-67df-4f53-a65a-258b95ec22b5", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683011208, "uuid": "b78a862c-5dcb-4cdf-9884-8217d6073f19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011208, "uuid": "ccdb9693-51d2-4b82-9708-88030d7e5c73", "value": "DHL Express Shipment Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9a1c16-e8ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DiceLoader)", "timestamp": 1683034357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683034357, "uuid": "937fbc2a-7a30-4e1f-9c11-0e9d0025a08b", "comment": "Malware payload (DiceLoader)", "value": "23918b1f2c19defdcadd52121b4fd18b", "object_relation": "md5", "Tag": [ { "name": "diceloader", "colour": "#0F68A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683034357, "uuid": "e9ec56cd-f2fc-47f6-a32d-e76ec66bf9d5", "comment": "Malware payload (DiceLoader)", "value": "1c441d7d8abb43824a77a15c539e46eafb8f098c5e0efcc57f8b688a12af18dd", "object_relation": "sha256", "Tag": [ { "name": "diceloader", "colour": "#0F68A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683034357, "uuid": "43f972f1-d13e-465e-b519-3b1be53fb7bb", "comment": "Malware payload (DiceLoader)", "value": "3f07408a0beb184b30fb6affdf2c57ccc6f99e4d", "object_relation": "sha1", "Tag": [ { "name": "diceloader", "colour": "#0F68A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683034357, "uuid": "a4960a0b-0c04-4170-bcde-2012f5ebf0d8", "comment": "Malware payload (DiceLoader)", "value": "d2fb703f74dff3110c0eec4eeafd8e4718fa5caa95706face0b48cdace2abcab36ed66ca480c7b553f788aeb2821b0f9", "object_relation": "sha3-384", "Tag": [ { "name": "diceloader", "colour": "#0F68A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683034357, "uuid": "9595c704-9858-4709-b1d0-8399dd8ea379", "value": "T1FB826C2AFA4501F9D57F887ADDFA1A45C3B275372272622F87A680405FB3366220D716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683034357, "uuid": "81c2441d-1f28-42b9-98b1-b71fd07a00d2", "value": "37af5cd8fc35f39f0815827f7b80b304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683034357, "uuid": "360c2cee-e846-4e40-a1d1-a8bd23a2d0b0", "value": "384:fbL37fBKnm8Cb2PLAXbmUO1mvNp5Mimca/:fbnBKCxmKNXYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683034357, "uuid": "22dfd341-4a22-450b-8950-3e6ebeb09d36", "value": 18383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683034357, "uuid": "d1d19217-102a-4b9e-a588-7dfc8bcb2b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683034357, "uuid": "d52707e7-57ed-4fb0-a7c1-d2de98328337", "value": "out.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a9fabd-e8ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683006564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006564, "uuid": "8609e790-b6ca-455f-aa57-3e26cb9a79fb", "comment": "Malware payload (SnakeKeylogger)", "value": "e7d5521661269d516a82ba053d04ee86", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006564, "uuid": "9b96a35c-dddd-4c3c-bf03-1ce0e85e7e49", "comment": "Malware payload (SnakeKeylogger)", "value": "1c9f12c685446e46fbc6ba44bc84f75636e669669c2af6a2299588b2407a5628", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006564, "uuid": "eb641424-c607-4edb-9c1b-536b87a04ab8", "comment": "Malware payload (SnakeKeylogger)", "value": "582b5a2a0ffcdf9cd1e00147560de532cac79e56", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006564, "uuid": "edd1175e-2b9c-40a0-a727-104f664169d3", "comment": "Malware payload (SnakeKeylogger)", "value": "a23fd02985431918c29f2f36838871824c6342d915a576af0c21048a3fd62e9124f820722f0a8c54b32f9e1c5e1ad201", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006564, "uuid": "7b7d8109-fbf4-4c2a-a3cb-d7f4e92240ba", "value": "T17894239BB8CC10B662E6677F277AE8133277D891FC1530B81BE95716D193C6E3270488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006564, "uuid": "384606ab-e2cf-46bc-953c-a5310f594f1e", "value": "12288:LeJ4YwwDLraIe2ErQgASDsFC+PGKXflaD:yJTHraIgQnp9PFvl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683006564, "uuid": "396d05d0-1ecf-4631-bf45-64102bc40e3d", "value": 440393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683006564, "uuid": "2e9841cd-eec2-4488-8b3d-3e4cd8fe7474", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006564, "uuid": "96a70bc6-521e-46a2-b6e5-08ce98ec9178", "value": "017VIBJMR0082023.CAB", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5480da-e8d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683023703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023703, "uuid": "2612d023-c42b-4f4a-8108-b0de50a03831", "comment": "Malware payload (Amadey)", "value": "c80864ec4f40c15a4589d19a1e6cd3ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023703, "uuid": "52dae8e5-6987-498b-8360-656e73916dd9", "comment": "Malware payload (Amadey)", "value": "1d0853e75493b553ef3bb9c05b1b87036e07a8a29a812df6334c4c150444ddfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023703, "uuid": "e12bd1fd-694d-412a-ae66-d51b8e79254e", "comment": "Malware payload (Amadey)", "value": "60179fed90422c2db1cefa9e05762965fa0e4283", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023703, "uuid": "da815dcc-45f1-42e9-8be4-5fe944192c5c", "comment": "Malware payload (Amadey)", "value": "99d598243e8b4e674984ad17093d08cdaf16c1eec0b087ffa8f95723ad29e0585eb94aa14f4c1eced58ca81a5ab06ab1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023703, "uuid": "2c0129bb-be5c-4f59-bfe2-8942f983493a", "value": "T16C74C0782FEC9862CACD53BD9085036D56F2AD127603D797B04579F62E02BE29C0B35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023703, "uuid": "6d2a40df-9a5b-4234-b318-a60da6698035", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023703, "uuid": "06cd22fe-a528-4e70-a388-b72e2880ccf5", "value": "6144:iru3Ja8xyrlTd03PzFcJeOwgTq9HBjf0Pc/zx9Eg5D:GGchs7l3bzx6gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683023703, "uuid": "72e429b2-4d5b-41fc-be58-710119086b4a", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683023703, "uuid": "ad669685-e02f-4a82-a9f7-a6418761494f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023703, "uuid": "2302891c-e9c1-4cc8-a3d7-b4303613fb69", "value": "c80864ec4f40c15a4589d19a1e6cd3ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b035e4-e8dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683027305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027305, "uuid": "de7ef062-03c8-4c5a-870e-d1f9034ef539", "comment": "Malware payload (AgentTesla)", "value": "b9af2c2ded8d2511cb5bd4975e932436", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027305, "uuid": "a812a26c-e065-4e72-b8bd-e49527c6e6d1", "comment": "Malware payload (AgentTesla)", "value": "1e0970459d115bde0c455a543f92bac5f17bdbcaa716791704792c78be82f299", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027305, "uuid": "facc99a4-6ae9-4677-8808-98bfe23c3089", "comment": "Malware payload (AgentTesla)", "value": "f52d4ea88b0ff0dcf0724238fae17038d581936a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027305, "uuid": "85873c09-d876-47d5-b51f-88f3f0a6edee", "comment": "Malware payload (AgentTesla)", "value": "072141226fa408c301799d54ed0ba1592f27a8c72d7f0c59cdb521f2eca0f6325c18a9a1e8f004307778262c69acc05c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027305, "uuid": "c612a10e-16d0-4cde-a46d-4c78cc53dd63", "value": "T1FAC4DF1A20A9CF1AFD3A8BF45474FF8467F1F07350E5E1242EBA60C5DAA6F110E5861B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027305, "uuid": "4eadf2af-dee0-402a-a22a-c123f795eafe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027305, "uuid": "f222597d-c127-4e2b-899e-eb9f2f2e0a78", "value": "12288:HA/Hc4BYvA8BEScDpkwU0/cIxx/MZrrb9Y+:Y9H8YWINxW9bW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027305, "uuid": "f97ae9ec-680e-448f-bb87-b38d54b123eb", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027305, "uuid": "97dfc25b-4049-419e-8bc9-2182667882c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027305, "uuid": "e57c1e21-6d9c-4949-b2cf-821732e875fe", "value": "DHL PK 160612561677.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa547713-e8fb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1683040445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683040445, "uuid": "de13279f-dab9-4274-836c-605e209a21c8", "comment": "Malware payload (Quakbot)", "value": "a38c775ea2895b5e73f0e9b603e4f45e", "object_relation": "md5", "Tag": [ { "name": "1683023161", "colour": "#2C91A1", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683040445, "uuid": "39f47998-e6c0-4cc6-a56b-37d5682d88de", "comment": "Malware payload (Quakbot)", "value": "1e9e97f45143f1135c52fa930ea2836a6eed8093c4db45906e4ce9178c03b312", "object_relation": "sha256", "Tag": [ { "name": "1683023161", "colour": "#2C91A1", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683040445, "uuid": "c0a34721-5e97-449e-af8a-309c5b2e8bec", "comment": "Malware payload (Quakbot)", "value": "10bc2fc803d1888ce9ae910e6a5882b296220716", "object_relation": "sha1", "Tag": [ { "name": "1683023161", "colour": "#2C91A1", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683040445, "uuid": "92bff2cc-96f4-4717-b356-8acea4584943", "comment": "Malware payload (Quakbot)", "value": "0cd094d06cbff2e07ca2fc0b9a525a41cf62554b5b691177d35294d83814afc59235a547c0dc33285c21fb7655985a15", "object_relation": "sha3-384", "Tag": [ { "name": "1683023161", "colour": "#2C91A1", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683040445, "uuid": "e07f4095-ed47-452b-ae7a-fdbcd69924a6", "value": "T184647D333DC6C43AE22713719828ED1642F9B110AE359617627C1B3E1FB524BE63676E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683040445, "uuid": "32ed3c08-a9a9-4730-95dc-d85a253ae4ff", "value": "0e961007ecf13f4d4c3749550baeada5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683040445, "uuid": "bb9c1a70-2386-4da4-9d8d-3b1173d15eae", "value": "6144:IynKe1U6ybW6cShRZuWYteU/0luNwOGJptI+hLb4LGSKoJ/5PvV:ICjOi6DuRltOEGLELGSXzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683040445, "uuid": "995f7e5c-3c0a-4eb3-a176-04fb15c86e09", "value": 324840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683040445, "uuid": "9050b766-020a-414c-987a-2d6c60811d38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683040445, "uuid": "469a6876-1f20-4e2f-92e0-016a96386e00", "value": "acogJqAR8nFYC7d.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b89f6e-e8ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683006151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006151, "uuid": "0a036bfd-c37a-4782-b3ab-b57f6293c723", "comment": "Malware payload (Loki)", "value": "ac45a574aeeaa5bfef5cc1ceada9876b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006151, "uuid": "e1a5a4c5-cb11-4f51-8775-122af6da00df", "comment": "Malware payload (Loki)", "value": "1f47fd5fd29e245b6ec3f3e178890bd987903f558a220e9d9451417c75e7d831", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006151, "uuid": "bd765eaa-aac3-4b95-a176-d8214afbbc09", "comment": "Malware payload (Loki)", "value": "7d0a230786b2e2dd47ab411040ebf4923459b3d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006151, "uuid": "d0d45cc8-cc27-4da7-8a42-b18db7ffb468", "comment": "Malware payload (Loki)", "value": "0200666f7bd396da44d9d1fdb54515e459aec08d941bf0caa4c83e6bed2ed91dd505fe652d0dc88ae5cbd086f5132d49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006151, "uuid": "3c1b9bf6-a410-4afd-9527-65f9d30148da", "value": "T1ABD4DF072019C98AFE1DDB34D474FBF422B4BCF3E4E195272A763D89F9B6B51090825A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006151, "uuid": "d888103c-a1d6-43df-a094-be495bd7c9d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006151, "uuid": "c1719100-847b-464a-b84f-c88d7afe535b", "value": "12288:U9d59j8Sb0nVFxjbxVdS3OqJj6EPJctIY2SZZp5D:CPj8SSVFxxVdsOA6Eetx95D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683006151, "uuid": "9b632930-2687-4358-8320-38923b089a31", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683006151, "uuid": "22a5778f-9531-49d0-8580-ca3d10d4665d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006151, "uuid": "7f5a2619-2ea6-4afd-b35b-9c7830c9a018", "value": "DHL Receipt_AWB8114704847708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e85813c-e8da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Ebury)", "timestamp": 1683025983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025983, "uuid": "5128ac84-4cac-4a6f-b0a3-140300f23594", "comment": "Malware payload (Ebury)", "value": "f14f5ae90ba205ac05fe8333f18c97ad", "object_relation": "md5", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025983, "uuid": "e61164bb-96eb-4b52-8864-fb16d2ef8cbf", "comment": "Malware payload (Ebury)", "value": "1f7559bbc5b9ac16bc6ee8155fc580dc0a8ac608d9d9c7f95407119f10f68d78", "object_relation": "sha256", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025983, "uuid": "4bd7964e-f01a-4526-92f8-2ea5a99528d6", "comment": "Malware payload (Ebury)", "value": "6be3f7895e674692e74313d7fafb45a1fcd92003", "object_relation": "sha1", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025983, "uuid": "3f68d455-89ce-4079-b24b-6135297c158c", "comment": "Malware payload (Ebury)", "value": "b9a1a2eef4339bdc97a32401e7d7855936623a8598781f55c322079207e150f2007ed883a7cb9317d366d83572ad9017", "object_relation": "sha3-384", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025983, "uuid": "dbad18a9-5ae7-4c0a-93db-534ac2fae4da", "value": "T11E033B67B5D4443ED54EC7708EDFC6330AF6B9896A3232CF29C46AB13F21A190B1E615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025983, "uuid": "04c105cd-2bcf-4a11-80b5-a609a97e475b", "value": "768:m15Tlua8JhxR/bVGE78h5vGkrdVus4BrEVCAE:mvluhD3/bVGN5+k2s5Cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683025983, "uuid": "1da39e0e-3726-4953-9b68-08890667a27e", "value": 40224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683025983, "uuid": "14f3cb80-7645-4912-a256-61778fb9201a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025983, "uuid": "ce4a6e87-e4a9-406d-8b70-90df616353cc", "value": "1f7559bbc5b9ac16bc6ee8155fc580dc0a8ac608d9d9c7f95407119f10f68d78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b725f1af-e927-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683059230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683059230, "uuid": "a42b6637-de50-42df-9112-4ca2b0c57696", "comment": "Malware payload", "value": "d42cd95f4bc95f02825a48054c2bc1d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683059230, "uuid": "27a95e51-c250-4084-8b21-ec4a699d4e94", "comment": "Malware payload", "value": "1fc2c7b3f3a14a3000e0987519317194f397340352ce23b12e7ae1bcfbb75c51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683059230, "uuid": "9fe88761-2c5e-4961-af77-2f44aeca5c6d", "comment": "Malware payload", "value": "edf9a330fe6a0ab953097a573e171ea9a40fe40d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683059230, "uuid": "b79c8b9e-dcee-4efb-a308-64cd6c473e5f", "comment": "Malware payload", "value": "ab428439d06553a55eef1c541dfb7f60e1e7707a940e547328ff2b2384061f7f26f6370e013b274878e87c5903c27d83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683059230, "uuid": "6f5b5573-50c5-4644-955d-13af35666f16", "value": "T10905F1066065CB4BFD3A8BF15478FF80A3F0F0B395E4D1242FBA60C6C9A6F154A5895B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683059230, "uuid": "98874a43-cb2f-40b0-b210-a7e082ee8ebd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683059230, "uuid": "00f16c37-f7d9-4cf8-8e55-2d6c567561b6", "value": "12288:eH4XxAtOc6iyk7k27IB9mxzMefPXgq1fQu+78rjuLdvWhgzigSLwkVy5A5I4h:j6Uc6i9IKcpeXRdQD0j65egSLlyO5IK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683059230, "uuid": "be4dc3c9-0ba4-4da6-8251-9db80fcd62f9", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683059230, "uuid": "8841b539-c426-4303-bb09-d60ace22b178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683059230, "uuid": "66523a46-410f-4921-b5f8-a782001629f4", "value": "technical data sheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ca79b0-e90e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683048280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683048280, "uuid": "1184a6de-d8ad-4ea5-a332-0e375a4853ab", "comment": "Malware payload", "value": "81bf7194541beae3d3878600b63e5753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683048280, "uuid": "c93fbc81-3c5c-4c1f-9973-6cc6c7cd93ab", "comment": "Malware payload", "value": "201a70eaa336c001f0573d3a2915e2c372df418bbf27c8729b30e4b08da2e8c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683048280, "uuid": "2d0c0adc-4579-456a-8f3f-dc1f298aa68e", "comment": "Malware payload", "value": "67ce7c1ace75ee46b8ce83feedaef37c1f0a59a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683048280, "uuid": "cb55533a-5e4b-46de-8ec5-f5497076a0cd", "comment": "Malware payload", "value": "a13532fc61538c13208094c6e7bdcc809a61279ab52bd69ded4d4f4068d9f0bce29d35004f7b7e8fe6f4f251ea384fd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683048280, "uuid": "d1a4b865-87b1-4c23-9aff-a711eeb78f3a", "value": "T1B3D46C38167B9A27D175C379CAD19023E2B0DC5BB011ED9AA9D203E20753B977DC326E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683048280, "uuid": "e697866f-0163-446b-971e-02b82706ede2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683048280, "uuid": "93c34522-6a8b-4585-94da-8794ea337b68", "value": "6144:LMZIXrvWfZJpKtHrnI9Dw17I+Ic5T1LxHE8CZV8m+oNRJOO2jRq2E71lOWMqp7t/:e+nIm7I+TRVCEm+oX52RIxlH7tUFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683048280, "uuid": "629920dc-eac0-4484-a916-2b46b0fa5270", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683048280, "uuid": "ca7a439e-716c-43f1-a993-a130cb14c4de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683048280, "uuid": "c88fcf3b-078d-4b17-ba4d-9e81c1fd07cc", "value": "DHL Bill of Lading PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e49cde3-e8fc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683040666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683040666, "uuid": "9ab0c37b-d199-4fd2-97a4-778b17ba7ee9", "comment": "Malware payload (Loki)", "value": "8a63b3788cbaa7acf5135736701e3490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683040666, "uuid": "1d07e3e2-7faa-456c-b9c7-6b6185bb7078", "comment": "Malware payload (Loki)", "value": "2071a487cad8b16b69b9951410d61564b4cfcc0bcf7c45108d10135bee256337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683040666, "uuid": "6b5482c2-eac6-44fc-9731-07582421fb3a", "comment": "Malware payload (Loki)", "value": "dd52be3d01eb04a91293d5fed4910ebeeb6247b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683040666, "uuid": "564afc95-ad8e-4e8c-8ec2-5b42afb1a797", "comment": "Malware payload (Loki)", "value": "857c59c66cfad56f1fde8de7f6a413e63ed3e97ce259585c0825175fffcdd7b15fb1dc226b0822ab60b9db90ee0ace8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683040666, "uuid": "b175a810-2f15-4396-b810-7b2b45b4bdd4", "value": "T1BEB4CE5261A9CF5AFD3ADBF054A4FF4057F1B5B354E0D2212EF615C9DAA6B000F08A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683040666, "uuid": "23fbb898-b1f0-4ae1-a842-ed2aef19e359", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683040666, "uuid": "b27166da-5861-48df-ad3a-b01f3367d66e", "value": "12288:KzmvPEnIrIgrpIqLJWYRjk98g2xQnFTESOHW4e/v:gmvPEIr/IqFWMA9JnZESUxe/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683040666, "uuid": "7993db2a-c656-48bd-b447-5f64a90d55b3", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683040666, "uuid": "b236d036-2463-4921-afc3-016908b3e168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683040666, "uuid": "ed290f18-368a-4f08-9ac6-7a378717c0ef", "value": "Payment_Plan_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1325026b-e8de-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683027601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027601, "uuid": "09085e63-cb55-4076-ba9d-12dfe195886f", "comment": "Malware payload (AsyncRAT)", "value": "71ed086c46daa011815b48555e8be4cb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027601, "uuid": "8fe66e7b-8c02-4ba9-9233-8765353c92cf", "comment": "Malware payload (AsyncRAT)", "value": "20da67346d8b10d739cf19f55c72cf6609656d19de4e6a3c65a9314013b8d6e7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027601, "uuid": "9e14ce4e-24d9-4a0f-a6ed-aef7d220fa4e", "comment": "Malware payload (AsyncRAT)", "value": "22dca8d66cb3725a74023827b0e8514ad432059e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027601, "uuid": "798fa2b8-0193-4694-abe6-87e9e8f8935b", "comment": "Malware payload (AsyncRAT)", "value": "1f398c3843e9799b051c55a147b3d6912ec07201fe99810a753e47ae537ec3fd0ffda6dd7a7aaa2a01d3570403564250", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027601, "uuid": "43a78c68-8c4b-40f1-b189-92b9e7e610f7", "value": "T185351241BAD284F2D5771E324D35AB14647DBD201E38CA6FA3D43EAD8932681A135FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027601, "uuid": "44bffa58-43c6-4476-b7f4-ae9e15caeee5", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027601, "uuid": "6afa71ad-64d3-4fd6-a1a1-5bec037fe35b", "value": "24576:wNA3R5drXINCDN18Iu0Qzxo5ngVXz4INs78XIjs4jNlBum2BtfQhQpkR:p51Y0J004YNjAPBtfQhQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027601, "uuid": "07923bcb-c2f8-4d77-9909-4d8e9f9209ef", "value": 1160992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027601, "uuid": "effbc06a-cce5-401e-8af6-0d5cec731c47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027601, "uuid": "0ec407c1-f035-47d5-bdac-54ed0255438e", "value": "ODEME.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e748ee44-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683013355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013355, "uuid": "3cc37847-ec72-4b9c-afb5-b5cb916cf836", "comment": "Malware payload (Formbook)", "value": "f38d97c4e62ef60e262141cc886c0030", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013355, "uuid": "aecededc-0590-4ac3-be05-983be3e4276b", "comment": "Malware payload (Formbook)", "value": "215326ac9ee45a18a50049f0d2b7ff84c381a0b9e8a916fab5b084f594f5f2e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013355, "uuid": "268d40f7-bff8-4c21-9b97-6054f2ee3376", "comment": "Malware payload (Formbook)", "value": "da387324d802f27468a20a6e2837dbdb2487cb58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013355, "uuid": "b808c0d0-9bc4-4c1d-9e5c-fee7f94f9168", "comment": "Malware payload (Formbook)", "value": "a8e308f7e3a98be9ad0202697917784f9e7f4f631a98c5c91be034287ab6852637c3e8effdb5e34c574fd9646025362c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013355, "uuid": "21f45cda-bc36-4a94-8076-a6c2989f195a", "value": "T19E04AE32D602C071E2B251B5B6BD1B7B883E0E357295A0E5E3E116E16FE09A5F13931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013355, "uuid": "5a52ad34-19e1-4413-8e77-5200183b73f2", "value": "3072:rGSfhE5u+KYx33/yvm2CjiwaH0QU8ouHZoCkiXidG/UQMEVrmS:1yZH/YH2aH0QU8oMuCfXR/UQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013355, "uuid": "af901e76-72bc-4441-b166-ca6545f5d786", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013355, "uuid": "c6bb3177-db60-4b70-894b-5bb06dbb7fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013355, "uuid": "8e7ee13e-10d8-4c27-a6ff-e8dbf9665111", "value": "215326ac9ee45a18a50049f0d2b7ff84c381a0b9e8a916fab5b084f594f5f2e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1419f677-e8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019443, "uuid": "a7aecd32-7beb-47ee-b8ee-15e71a49c41b", "comment": "Malware payload (SnakeKeylogger)", "value": "55d42af6d5b02466923f878e405397dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019443, "uuid": "6f265de6-862b-4307-85b8-acb740c054b6", "comment": "Malware payload (SnakeKeylogger)", "value": "218d95665e10dbec36ee3e78f9a401aeae8cae4107078e0bc9728665a0ee7492", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019443, "uuid": "52c31b91-b723-4a17-aaa9-1edd9dfd10b1", "comment": "Malware payload (SnakeKeylogger)", "value": "b4a77ea9fc4fbaecca82f14bf2a48042e5b29a79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019443, "uuid": "de13b29c-7053-417b-8334-17a9025f2f11", "comment": "Malware payload (SnakeKeylogger)", "value": "7d4255f06fa650d99974678673409e7444511d75634fbf24f50611d57dc76220f0a11fd0f84bdf09262117fdd1ee038c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019443, "uuid": "eb3beea7-845d-47af-9e4b-9f9106ca6119", "value": "T102A4F10837AF5B26FAB94FFE5AB6A0041372BB161423DB4D4DC038EE2B63F458541A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019443, "uuid": "a749dd52-7b88-4596-82e9-83a70fded51f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019443, "uuid": "45f8fc06-6151-4079-bf5a-03e9312c49ce", "value": "6144:ft22HjHHFVWBHywBdeprtWPaxmhkdMP3DCHpOiau5y+JHcsL+TWAQNZ1DFFWH8X3:FZo/arWBv6pOw5itQN5FBcS2QxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019443, "uuid": "1099fb83-31d5-4d6e-acc8-21028633878f", "value": 463872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019443, "uuid": "677f9862-694a-4d26-b568-c8cada3f9fc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019443, "uuid": "0608a8a6-b293-49d0-88eb-e6eacbfd23a7", "value": "Swift 103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f377f525-e8e2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683029696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029696, "uuid": "404dfa70-5916-40d5-8a78-38c7b9e13825", "comment": "Malware payload (AgentTesla)", "value": "407a4475933399d86b822c4ed5a6393b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029696, "uuid": "4f046c5b-55b3-46b0-bdb9-476ef48b41fa", "comment": "Malware payload (AgentTesla)", "value": "21da6251b60bdd9a0fcc9c1728d7f63885afeb53185ccef2a96103f3dad144d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029696, "uuid": "e6d2c970-071c-4384-add2-6c4147914735", "comment": "Malware payload (AgentTesla)", "value": "cd060492426d7e749bdfef67b9e75d5d02b6e0ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029696, "uuid": "5fa3b3f7-2ef4-4e56-bf3c-4bdb132d720b", "comment": "Malware payload (AgentTesla)", "value": "7335d725dbc3839acf4eab46af528d93edf7b92ce788266d2cc2573fd9bccad2d966c23857daaa09cc4b7779459c9c78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029696, "uuid": "508663e9-4e87-495c-ae61-6a6d21529064", "value": "T196D4D01A61A4CB1BFD798BF05474FF8463F1B0B354E0E1282EBA60C9DAA6F011E4D55B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029696, "uuid": "83e3b50c-eff8-4182-a671-23d6ac4c268a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029696, "uuid": "d6db5f1d-50e2-4e49-b357-193a132efb34", "value": "12288:LAwe5SgUJm2XTRRypuQ+WzbkBmP0WhBXz/byKT9x:+5SgcmyQkBcpljb5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683029696, "uuid": "1e4b3bdc-e0c1-4243-83c3-56caac4ce717", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683029696, "uuid": "b0680c2c-17ce-417e-af87-fc2982510e9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029696, "uuid": "f059b1ee-f4e6-40e7-a8c8-f55cd69759fc", "value": "407a4475933399d86b822c4ed5a6393b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8065c17f-e8d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683022631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022631, "uuid": "9eba33ff-939d-4045-9ed0-b70f2366ce84", "comment": "Malware payload (Formbook)", "value": "7c12f6fec9bc7980dd057bff668edfee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022631, "uuid": "87c89729-c466-457b-8ef8-1247be4e5fbb", "comment": "Malware payload (Formbook)", "value": "2219e96c7736e6edc02fe0ff151ee8e0116b8b0dbcf38d7ee91ab246b4fed0a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022631, "uuid": "3312c3bb-9a4b-48b5-a0ae-b1f018418fe3", "comment": "Malware payload (Formbook)", "value": "09581aea5c7737e401181a4c1af42898cb5c363e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022631, "uuid": "f87ad77a-d027-4557-8b89-8e7b4d7d6fac", "comment": "Malware payload (Formbook)", "value": "923d409b172bd688a5b862480d2e617bcf8e448ad13e00270ac7dbbd8abaead2528613fc0769b5a5959273bdca8ff830", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022631, "uuid": "0894d954-16ab-4a1a-b187-b1c6a2d2ad82", "value": "T197E4CF0222B4CF26FD398BF00065FA4023F5BC7B54E5E5681EBA70D9D9B6F010E65A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022631, "uuid": "90208759-c0f0-4973-9cfe-8f563dd22d4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022631, "uuid": "4c7a38fa-b2bd-4c59-abff-db7bde73fc91", "value": "12288:PZZ2iNvj2vIUMgaw+UzS/soUHBaqLcKc8V5:n1tjCTa8S/2HkqL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683022631, "uuid": "165b97c8-c8fe-47c7-a45a-0fa98e3ee8eb", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683022631, "uuid": "fc01f54f-9846-4ba4-88c9-3b4d14971275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022631, "uuid": "44ee0375-0142-46d8-8007-d918a7c2b14a", "value": "DBS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831e84f9-e912-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683050123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683050123, "uuid": "711e0316-c89a-4805-a573-bbb69c5790b2", "comment": "Malware payload", "value": "a1c8a65d2881044ef14ff6035d67e414", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683050123, "uuid": "857b671c-f6e1-4de6-92b6-daaeab2a1f26", "comment": "Malware payload", "value": "22a68d65fe7eb44c802e25f74bb9f753fa935d962324644249edb690befbcd2c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683050123, "uuid": "121fcbb6-0205-472e-82ba-5bdf466daa37", "comment": "Malware payload", "value": "74903495db161f02c79a4996ee055b98b94d65e7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683050123, "uuid": "b8dbfc02-5cdb-4760-bbcc-c60ec37c2210", "comment": "Malware payload", "value": "aa48d9adf83e232b221c7a80ed098c0e0c6bda58dc42f6d8b9bfa644649107db74bdc40c3a57f450e34c5b6b6a85c5d7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683050123, "uuid": "b12a6ef4-82f2-43aa-b4fb-35b2852dda75", "value": "T1F511B51EB3500B72189B17605679ACC5F23BB25F7A5F2A84146EF345233A0ACC5FF840", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683050123, "uuid": "2336cc01-4291-4f84-b12f-6a09a2b3030d", "value": "24:COrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:TaJHlxE3dQHOs5exm3ogFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683050123, "uuid": "ce2d4669-9bc6-436b-b40c-d996415ec5e6", "value": 1071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683050123, "uuid": "38eeed46-be36-4c44-b281-6352e33a620c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683050123, "uuid": "3137254b-7d9b-4eaf-98b3-05cd1b3998a2", "value": "LICENSE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8334e30d-e8e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683030796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683030796, "uuid": "8df6430a-75f3-4a79-8470-b5143acde401", "comment": "Malware payload", "value": "a0c3b6214427f428fc2eaf4096e92a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683030796, "uuid": "ccff12a8-e496-46ff-896e-fc5eb62b4c8d", "comment": "Malware payload", "value": "22b09a785047c9774eaaca9033785feff2fce1323b51196d1aea5657745adb22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683030796, "uuid": "3ff3e4f1-d5ac-4006-b7c3-06c7599d619b", "comment": "Malware payload", "value": "be602fea1d84a8acf54f2bc8d9e6e7c4371a934e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683030796, "uuid": "2ebf1023-59c7-41a5-99b9-3ff6bc33afa8", "comment": "Malware payload", "value": "11e390e83c23a423ad1281611f2ad4411f85ca38157173f6f97db186a68b54fe6770a248b81eb5737082afa67f883acd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683030796, "uuid": "85eab04b-fafc-4412-aaa5-f54e484080df", "value": "T177357B4BBCA010B9D0A9D23189B651917B31B8591B3227D73F50B2B93FB2BD85F39364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683030796, "uuid": "fd18d04b-f0d7-4493-8f5d-56a1b37e5dd1", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683030796, "uuid": "a0580cfc-0e06-4084-b39a-1c44a21a15da", "value": "12288:m2Sq/PmCqdQWUFcChXzuG8Dv4alfZqby13caYgd2DbFyQ4sbxd0L0looUG/Dj3Ag:m2SSP/qdQlcOuG8T4gcaYgd29qOV/n5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683030796, "uuid": "80f0ac8a-201f-4120-ad86-a8ef49cca195", "value": 1136128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683030796, "uuid": "bad38ef1-85a6-4553-87fb-710c5d9043e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683030796, "uuid": "47986a32-9046-4216-8321-d4b8d3acc8f7", "value": "bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca6a4556-e8ca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019319, "uuid": "ae71be84-8e48-4e30-890e-f0c86f1b2285", "comment": "Malware payload (SnakeKeylogger)", "value": "764acf7bd23649efdb25086f62d69ce5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019319, "uuid": "888ebd80-655a-4dda-9d3d-cb4f695c20e0", "comment": "Malware payload (SnakeKeylogger)", "value": "23032bc9472a424d68f6423a31bf3e9cf0fa5ded87ab630d1a8234091758f4de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019319, "uuid": "6187c5fe-945c-45b6-a102-3d1e1d4299a2", "comment": "Malware payload (SnakeKeylogger)", "value": "b4560eef798766d6737b33708ffc720c773e5a7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019319, "uuid": "4c21c30b-9122-481f-89a4-9f61455dccc1", "comment": "Malware payload (SnakeKeylogger)", "value": "0203d62087b501fa04347c372749afcc26a1d1100a3cc64c6bd4eadf58059f058a2ab4d3e7f7fc55041340ea90611e1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019319, "uuid": "3fc70433-3542-47e2-9f7b-b632a49ffcd2", "value": "T17BC4CF166164CF0BFD7A87F18474FF8463F1B17364E4E1242EBA60CAD6A6F110E58A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019319, "uuid": "26878b3f-a762-40c3-a204-f30276b19c57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019319, "uuid": "584d4f32-4e48-4cf3-9393-b94629ac75a1", "value": "6144:t445seHtUlG/GdH7Vya9DPyI9Ww7B8rNYd3P8l4JpBB4EDNX67iMUHtDq40zaHeE:kAsOEVyaNv9W/I3P8lupBB7W8440rJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019319, "uuid": "2e401d8d-1bff-43a9-966c-2990ce2a9d35", "value": 555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019319, "uuid": "b3d1aa6c-eb27-47fe-bb71-a021078eb412", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019319, "uuid": "fd5d4775-56ba-4c1f-ada5-8d7fb5450621", "value": "MV GOLDEN SCHULTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf8d323-e8f7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683038678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683038678, "uuid": "e0157895-9c8d-48fb-84e5-5fe07531055a", "comment": "Malware payload", "value": "3b14053a7d354c23be15c780b0a9e980", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683038678, "uuid": "6c4e38b6-ffa1-4527-bbdc-046a34829a4b", "comment": "Malware payload", "value": "242e4bcab6b65e5df2001f0b291af015c0bf83431e71c72872792b057e6acce4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683038678, "uuid": "8a881854-f754-45b6-896a-a82eed6c82f8", "comment": "Malware payload", "value": "19202cca74378045d1f79ca2882338b29ce4feff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683038678, "uuid": "b2ddb9dc-1680-4f2c-853f-b5b4f593731f", "comment": "Malware payload", "value": "d0641fdedd394f587df67b163d9b0ded442ad3666c3f8d5c2d7d4a899ed47af28e14fbdcf370128c3cc059e2f1de4053", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683038678, "uuid": "087c1bed-a411-47f6-a078-029f588083d7", "value": "T1301163C1E42232EF757050B1009DF3016DC4DAEA12EB14CF2EA380849014F05BDB226A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683038678, "uuid": "df2aa1c3-ca03-46a6-b072-27ac71a7ae3c", "value": "24:XqiMLKjaPxvqulASDfeq5uU1TTtGp1jdBOmm3RB5J:XqiML3xyuldeqMU1vopO5RR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683038678, "uuid": "d00065d7-7bf8-4305-a4e9-69ee0579daaa", "value": 880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683038678, "uuid": "4a36e77a-c182-433f-95b5-7e40d212c150", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683038678, "uuid": "4a26e578-05a7-40e3-b332-76b20f4c91e5", "value": "gotoCheckout-reply2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0869996-e8aa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683005639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005639, "uuid": "ea0c5bd2-e037-4513-a880-ba2fe1397e75", "comment": "Malware payload (SnakeKeylogger)", "value": "8905e52e205f687eb511b330e1b5c762", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005639, "uuid": "16efa127-db5c-4cd0-9c0f-04f0b1f47dc5", "comment": "Malware payload (SnakeKeylogger)", "value": "26309e8127d86579dd6ae130c52298039f110548d77182833c261f0b0f43a340", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005639, "uuid": "da821b78-2d56-495d-9e3d-f85b67cd90ae", "comment": "Malware payload (SnakeKeylogger)", "value": "44edd39613def9e8384b30b13fe1511bf3c2280b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005639, "uuid": "e1311c8d-1399-4eee-adaa-f3d70b87a75b", "comment": "Malware payload (SnakeKeylogger)", "value": "d40554efafe5e209ca541b66074465f5ca98eecb2617e049ac303e5eb03b7aafa33021e30190378b807a85e63444e864", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005639, "uuid": "9f036b44-869e-4c2c-a7b9-5ae9812baa8d", "value": "T174E4CF4736868658DEB957FAA217800423A6EEBFD515D30D6FC432DB1FE2F52082271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005639, "uuid": "f2509237-03d9-4931-8fa4-fedff11386c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005639, "uuid": "0c6408e3-5291-40e3-a726-05ad6826d68b", "value": "12288:uZo/arWBv6pOw5w+XBlwCu0eDQ+o5v6nnjqKoe:LarWN6pOgdXBlwCzIop6nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683005639, "uuid": "92a3c647-15eb-4540-a370-b461f907d1c6", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683005639, "uuid": "99cb550e-6c89-4aa7-8793-7252cec39303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005639, "uuid": "c0bb251d-244e-4b84-a172-6cb2a36cd62d", "value": "ORDER SCHEDULING.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12e172a-e8dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683027491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027491, "uuid": "148e7889-2fd9-4bcb-8731-17634f1b0bff", "comment": "Malware payload", "value": "24e5e77ee44a1d25667bb392ab0bda0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027491, "uuid": "5874b996-3953-4e71-8ea1-ac4cc9b4a53d", "comment": "Malware payload", "value": "2639bde16b73d65d6df000b6df618598a4bd3f8bb410b626cdbd193093dcfdfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027491, "uuid": "9de22e18-a431-4572-b0dd-64edfe957d72", "comment": "Malware payload", "value": "6b0c12e40d421c958adbc3fbebb8eab250b70e91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027491, "uuid": "d61c0baf-66c1-48a3-933f-08c188c49dc0", "comment": "Malware payload", "value": "93185bd46f6f41de22add5c7ad1e70f77340199b8bdd1ec5d34cbf45907604e4817f1f184e7cfafebc43a88f72960396", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027491, "uuid": "882cd324-1510-418e-8487-f2079dba22c3", "value": "T18DF4F102BAC195B2D4631D335A35AB20A93DBE201F76CEDBA3D02A5DDD315C0E7357A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027491, "uuid": "b482c875-910e-4dbf-ba24-1c6d29324e5d", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027491, "uuid": "b5d80981-2799-421d-b29d-9ee8eca75452", "value": "12288:2ToPWBv/cpGrU3yVtX+t4VAyBJUuRReL2n9MI4xG1h3/CyfTd9fe8arnELL:2TbBv5rUyXVfBbReangxG36qTd9fXabW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027491, "uuid": "915ced1c-9793-4c11-8b67-45719beb5d61", "value": 746871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027491, "uuid": "58c72caa-2b9d-4244-b28a-060339ec57bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027491, "uuid": "f0249e75-485a-4987-a443-30ab254b0a1d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165fdb07-e8f0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683035338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683035338, "uuid": "268133a9-a17e-47e8-a489-a3acd8e170e8", "comment": "Malware payload (Mirai)", "value": "0e52ae75206988db4623d7e085189dd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683035338, "uuid": "0b89f973-c630-4ff8-9b6c-e0f6ed77cc5a", "comment": "Malware payload (Mirai)", "value": "27046c7ca44bdca40f47ced937ecfbac8b3847b6c070f40eaaf3d927fe487b7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683035338, "uuid": "68dd81b1-f75c-4d8e-ae30-5a45b0e07095", "comment": "Malware payload (Mirai)", "value": "89edeffff21ad08b5f0087019298ee9cd552a08a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683035338, "uuid": "7ef9a283-b5bc-448e-b148-575ae1a264c8", "comment": "Malware payload (Mirai)", "value": "63bdc3fc0d5203f53320630dc9db9281fe29a68a7f66f54f6d26ff95ce497e95017637c58e88699a5a4755503f41f985", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683035338, "uuid": "c10c3592-cf3a-4a5c-acce-2d505981dc8d", "value": "T113A2E0F464521457C41E7AF773AE0BAA11D87CC04B6E43C22EF326C974AB0798E2957C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683035338, "uuid": "9598209b-abc6-4592-806a-9ef13788855b", "value": "384:M9iuOsQ/Tmf2PYFcFx49QG0yk1QC9vQSysRbNrYiv70WhOM77Xi+v1R8y:huZQ7m+PYFI0avPyoNrYivoWz77N8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683035338, "uuid": "0a631d0b-3160-4abc-9a4f-f4bbda155531", "value": 22240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683035338, "uuid": "29639c25-81b8-48b1-8bda-34f1252ba8d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683035338, "uuid": "f810248a-eeb8-4e9a-983a-a0dcb287175c", "value": "0e52ae75206988db4623d7e085189dd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594afe95-e8b7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1683010969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010969, "uuid": "9fb28737-c538-4454-bdd0-b3589da71bb6", "comment": "Malware payload (NanoCore)", "value": "6391047eda9aaa6a0e83c153a6b5d711", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010969, "uuid": "e18af604-9ce0-4d6d-9f59-ed81b18494ef", "comment": "Malware payload (NanoCore)", "value": "27ec98afe8ece1ca5895c72cb758e934919518e794cb14335dfe40005c69ce52", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010969, "uuid": "ba8063ca-6bf4-4df8-96e3-f4d7e5f1d127", "comment": "Malware payload (NanoCore)", "value": "14604fd58cc224d6f1ff72c168637c045cdaadbc", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010969, "uuid": "cd93e520-b0a7-4839-9e2d-5851fc0ddb46", "comment": "Malware payload (NanoCore)", "value": "d97c8c82ceececb5318b5e7fbdb3ec3917302e4100788ff228f63dabd06113af5341dd3cc89d80d16229d5c7d70dcbd8", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683010969, "uuid": "616ffbea-b19b-41cb-ae1e-45f043a2742f", "value": "T16C6423B5A1F212BA6508D9BCB749D3E423CF017528311E86EB1B642F513AF870D85FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683010969, "uuid": "a9405400-ed41-4bd2-b450-52f89a83b4bb", "value": "6144:UA2F+ZBF3mEmc924YHLx6TqlPFIJhtJR2AU4j0Nz42g7OzRIiTA65d:32F+Zf3rmn4mt6Tq1aLn5fI4t7OzRIiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683010969, "uuid": "ec899f4c-7483-4fa5-b84c-44a3ed0f87d7", "value": 329235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683010969, "uuid": "e501c437-9fec-497e-847f-fdcd89cda9c3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683010969, "uuid": "fd3313a2-78a0-4c95-bb8e-4eee76dc50f5", "value": "Signed Proposal.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089f0051-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683013410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013410, "uuid": "d7eb6d86-6e88-4dea-9087-5b5c18f945ac", "comment": "Malware payload (Formbook)", "value": "106711a5c03e6bb7c03ff889b1c2c213", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013410, "uuid": "34797913-1b0e-4211-b363-b2e71a2dfef2", "comment": "Malware payload (Formbook)", "value": "28000eba88463ba310006a12861b48fc9335d93053b91e71e537d36daa09f6e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013410, "uuid": "7877dadb-623c-4d52-b0fb-3b7b6102e6b0", "comment": "Malware payload (Formbook)", "value": "59a0b6c3f17d8c68bbf249dac4e606ecef4b249e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013410, "uuid": "3db9f0a5-a176-4b19-bb8f-ae37a26b87a5", "comment": "Malware payload (Formbook)", "value": "eb01500ce5559683c1dc9dd911bb3a0a32461ee1fb0355004544bc892ca43c337779be96ed159ae2aa0d048b0f3ba309", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013410, "uuid": "5c6525b8-485a-462e-ae96-592b68c9fe8e", "value": "T18874F113B3D75A71D1996638C1B3540003B6E7477A73DA283E8907891E43BFFE992B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013410, "uuid": "95a7396d-b022-4d20-80aa-88ab18e54d20", "value": "6144:NpWQN9rSwaEj28RLURnZpd4wipbpdhws4rcDJvaQLhKK/qPONI:XWcLF28RLknZpdViRp3vOckQLPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013410, "uuid": "33913993-94e9-4ab7-901c-ba6458dbc9f4", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013410, "uuid": "e2adb966-3d2b-4479-bf28-54b2ae290934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013410, "uuid": "15166e1e-0833-401a-b854-42a687e7c6c3", "value": "Purchase order ST023Z499740 & Company profile_pdf1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5fd498-e8dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683027426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027426, "uuid": "1a09e5a5-abd7-4588-94da-c408326faef2", "comment": "Malware payload (AgentTesla)", "value": "fa73a1b86dea63f18ee279c4b532cac1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027426, "uuid": "6f1ede7a-2418-41d4-8447-9ae3fdeea0f6", "comment": "Malware payload (AgentTesla)", "value": "298db0af01ea181df17df8ddf0a1f7b042a51794b14c32f3c7e32e168e9aa68b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027426, "uuid": "ed6d4827-b55b-4d8c-95cb-3e429258242f", "comment": "Malware payload (AgentTesla)", "value": "e77f0db50d58aaa832c39b771d2fb9c8c5f80139", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027426, "uuid": "8f290655-a8cd-44e2-974c-be7acc4bffd6", "comment": "Malware payload (AgentTesla)", "value": "8c6392ffa80378f286ac730e9093fe7b6774e0d27594fea8fb2c2c7450dd3d59c81c31c7f8647e6a969303a4c5ac21d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027426, "uuid": "d8002b52-42f6-41f7-98bb-a80f1bd294dc", "value": "T1899163489ED094921BD71FF7321BB1EAF66E6CDF2C45AA1BD012BED02E05085C5D5A33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027426, "uuid": "8dd47869-7ea5-4d23-b2a8-2e8f12dfb1c2", "value": "96:5TYJvmAhwg32coqDtaKXMC73kYJZJqzT9U5fOsXwCfVWwtMJ:5kJVR34YwKf37JZJgT6ZOmjfVJmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027426, "uuid": "55bf162e-0e6a-4f0a-8ed7-150f3e47b98d", "value": 4501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027426, "uuid": "e376f12e-9a30-405c-accb-747b1175fbe1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027426, "uuid": "4fdc1c67-4781-49c0-8015-161de2ed12a7", "value": "Form A.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800909c6-e925-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1683058278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058278, "uuid": "9c91fcbe-3570-43a6-8d78-79507e065ab9", "comment": "Malware payload (AZORult)", "value": "4d0179c2f10866df4f2df9b102096859", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058278, "uuid": "1fd5c4bd-4a86-4e24-8251-3d45bd4bacfa", "comment": "Malware payload (AZORult)", "value": "29ef762fd2115e70a9983833788d592be9b846e52e79066341849281067cd57b", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058278, "uuid": "8ba17e54-3c0a-4112-b141-b1a8a07d4d8e", "comment": "Malware payload (AZORult)", "value": "5766ad8aeaa52c0c2b6f3e30233ab27a7ba450c7", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058278, "uuid": "9c7d9d9e-9755-4a71-b43e-129216af6a11", "comment": "Malware payload (AZORult)", "value": "7bb7f03f8c7de1c89116cc69e883b39997b3d1726f9ce29186f03ad5f8fbb83c699653598cfa527c0ec6c31ad75adf45", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058278, "uuid": "19b8faac-ae8d-4aab-afe1-486366486722", "value": "T1386412573B8584ABD089077E5C76FBFD97B33E1C962A56070B687F5E3831281AF18281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058278, "uuid": "5e5a7b59-1326-403f-b37b-f5a84fc8cf22", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058278, "uuid": "681523c1-5ef1-4598-8706-0d00907aafa7", "value": "6144:R4SUjhth5p3HaNjiD0OhEOuoGn5/v1hZmLm56zsoI+vL9sEInDpv:q/lVEOYH1XmLG6g+S/9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683058278, "uuid": "efad200b-7124-4d46-8221-ca12d196a1a0", "value": 334841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683058278, "uuid": "bffaf4ab-a294-40a8-a88f-5334ee973b56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058278, "uuid": "4ddf4e2c-dba9-4859-ac0c-ccf512476e88", "value": "Bengnaveriers.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85af27e7-e8d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683022640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022640, "uuid": "2f2710b0-9490-4466-a7a8-403a54c93772", "comment": "Malware payload (SnakeKeylogger)", "value": "5c3db5ef7f63e9c279669216707fb9a8", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022640, "uuid": "d842a761-b492-4303-921f-d98524279625", "comment": "Malware payload (SnakeKeylogger)", "value": "2ba004b6efeff55a066db441bba450821db12621087194916c50bd52b4094fdf", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022640, "uuid": "377e5a3a-a1f5-4891-9d7c-36a03d559bfb", "comment": "Malware payload (SnakeKeylogger)", "value": "75ee5e6f54224e0c7fd25c1ecebb14d33a15b2a3", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022640, "uuid": "86d6f3c0-9ead-4e20-a446-d02be6896890", "comment": "Malware payload (SnakeKeylogger)", "value": "aadf386df3f93eb2cdc779f1fc43ab06d6fbce35b4e9355d5be4cc4f7cc6d1526406e8b6a4ddd6fb538f48d86ad066d7", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022640, "uuid": "9c057151-aa40-43e2-aac8-4a0c6759196e", "value": "T1B1842330858A2B090440495D2C4BB9A5E6D57E1F88E4333F69EEF5D538CAD08CAFF9D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022640, "uuid": "6d2f51cc-7937-45b2-b7be-cfee94ea7427", "value": "12288:vQe4N0fxn+A6ZtwwBlPpHUtBdFZh+ybWYhWI2Tjbs:cuwZ7BhpHQLFZhcYhbijbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683022640, "uuid": "41d3b22c-a57e-4470-8db0-b6d61ee16f8a", "value": 403543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683022640, "uuid": "5f547849-ee38-4154-9198-c0c859ee8ed7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022640, "uuid": "7f56d54c-0887-46c8-9a8b-b97c877fa212", "value": "Payment Details PDF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b6b8a4-e91f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683055654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055654, "uuid": "1c847e14-3901-42a1-8bfa-d338468e1442", "comment": "Malware payload", "value": "c447c561925b77d52242def762ee394b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055654, "uuid": "648de951-7beb-427d-85ed-7e2a3443f85e", "comment": "Malware payload", "value": "2bd44c7eb0536845a0fa4ec54eaf49c47120c154d5d29ff167c312adc94a60b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055654, "uuid": "2a100907-e53f-4590-91ea-094b6c8ebf2b", "comment": "Malware payload", "value": "ed080f397aacf655e9beb0583646f019e069f91d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055654, "uuid": "7cea6311-d793-4c6d-8103-4a97ba48004a", "comment": "Malware payload", "value": "0a61ceab0c9addedea7c2df046f1ec10c92220564f198cd5199b714d9a05aa365cb16e331a06958e7c6e28fddc277596", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055654, "uuid": "8f13e948-a35e-461f-aece-8150ec40729b", "value": "T1DA656B2439EA501AF173EFBA9BE479DADA5FBB333B02641D1051038A4723A41DED153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055654, "uuid": "71179d95-865c-4b1d-827f-979a2d9de380", "value": "24576:45TTngb0u1iILnraOqHz9Yen5f6CDruxp6/:+g+I3+pZ5SCDrCp6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683055654, "uuid": "7ed2efb0-a9b3-4024-a211-256856190fd8", "value": 1415168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683055654, "uuid": "37f49add-69bf-42a2-8669-f19f815aeae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055654, "uuid": "ad4a3362-cfb8-4888-830b-128c550de732", "value": "New Order PO 208472747_IT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d464461a-e8b7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683011175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011175, "uuid": "3cd8af1f-ad21-4397-8d4c-703d4d7decd4", "comment": "Malware payload (SnakeKeylogger)", "value": "afe8b3a4bd40202208456b26df8b72e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011175, "uuid": "4ce943d5-296c-4f67-91e3-60aac9e6204f", "comment": "Malware payload (SnakeKeylogger)", "value": "2ca8429adde8868be7eefa5bd9787849700fc642210fe87ee3c72d6ee50c324d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011175, "uuid": "bffc9360-988a-431e-8c89-30617602edec", "comment": "Malware payload (SnakeKeylogger)", "value": "d9f634442a476491dd11de815561275dc20a9951", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011175, "uuid": "3996667c-27aa-4ba1-a236-105e444363f6", "comment": "Malware payload (SnakeKeylogger)", "value": "6466383a71ae2615f1085e98065f1fe257ba7867e79dcb1cc056a0bb650cc08b27fc085a58c2afb39bef4d98d0425779", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011175, "uuid": "e32024f5-1c5c-4096-a790-a9f126cb3a30", "value": "T13CC4D00A5168CF1AFD768BF19460FF8463F0B07764E1D1242FBA60CACAA6F111E5C95B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011175, "uuid": "7f5b0d24-eaae-4fdf-bc82-b56314d20a13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011175, "uuid": "39e35cc3-d211-492d-9430-1d0620bba2d9", "value": "6144:O445np6BOBU2+tA9eWkOU5my2xuxBf49LcfRv1TJjMvJhX55iJaOdrsatkI5PwAU:sMHqoWRamy2xUBfEcJvDoeJh1skaUDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683011175, "uuid": "9bcb6e17-4e53-4f87-ad27-c2f7c8dd65be", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683011175, "uuid": "1ac3b1fb-550d-4ee8-a50f-746265e20c3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011175, "uuid": "20834ddd-a1a2-4165-a5a1-54a85f30e217", "value": "SWIFT mesaji_7582353645856740000.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d980405c-e8ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683006889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006889, "uuid": "3d60a626-8dad-4051-ac66-7eaedcabad57", "comment": "Malware payload (AgentTesla)", "value": "2280400b1d2d6e1d8d4c938fffe1dd6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006889, "uuid": "944d8ec7-b72e-4461-b780-449c76321fa6", "comment": "Malware payload (AgentTesla)", "value": "2da3d79bba4f17be04c88c5dcd8d48df5098b261a226e641bb7274d887e91d55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006889, "uuid": "5b28814f-a4ef-47d9-969b-df6758663474", "comment": "Malware payload (AgentTesla)", "value": "dbb6f7e114bc9539ac730caa22fd0ab334033ae8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006889, "uuid": "a1a06312-13f4-4ab4-b1dc-c06943c7caef", "comment": "Malware payload (AgentTesla)", "value": "20cea8d2cd2a213bb0d29e025d247e2cb916ccfe9aa1f82c2f34868b2e4cb68a7f16feef35873c5508503437ce12f8e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006889, "uuid": "229fd796-4e0a-47ca-a114-28094f447b62", "value": "T125B283A9D74B02A58F525377831B4688467CF12EF35611B234AC937833EEC2D81766BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006889, "uuid": "730235b4-0475-4707-8fc9-db74137c7f58", "value": "384:29QCu4/y2sk6DopjyQCo0tdRERgWirwDNw+oVWs+ii49jbtbtxx/NRxxHjv2gS7o:26Cu4/y27jyQ4IDDwVoiiqjbj/NRLr2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683006889, "uuid": "6125266a-9328-4c86-8dbb-a00a1db99f25", "value": 24465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683006889, "uuid": "9a1db462-eb6d-4376-8012-5439d635b7b1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006889, "uuid": "98a29357-2f9a-49c5-ae94-a2906b175373", "value": "POXPO20232504.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d738361-e91f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683055590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055590, "uuid": "93f9ac37-c062-4e11-9b29-72c6fd77a849", "comment": "Malware payload (AgentTesla)", "value": "7d32b7ad4ecec265829f68309739ed8b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055590, "uuid": "242cf715-62c5-44dc-8b9e-4360507ec16d", "comment": "Malware payload (AgentTesla)", "value": "2f354140d72d961648ead51079c2a47646897346f62174d8bcb8fa1ad3a5637b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055590, "uuid": "c6adb684-8e99-4833-bfbc-7dbb7a430369", "comment": "Malware payload (AgentTesla)", "value": "937bd43164a6e43eb44e2796f2f1240885d21a13", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055590, "uuid": "b1cd528f-c5c4-4aa5-b13d-d6a0f0b0ccb2", "comment": "Malware payload (AgentTesla)", "value": "8eae63a8a1fe7eb9b74ddc7cab53f00132fce4a3e991895630a9cc03a02e35715ffe48e8218d9aa084761617138e31fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055590, "uuid": "590467bf-af2d-44b1-89d1-085ea3c36f7d", "value": "T148B423B06EA7B5AFE57C96D26FB94D1BC72A8D10616E37CE0053721C8237063E259C87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055590, "uuid": "540fd745-4134-4dab-8dbc-3bec74242a61", "value": "12288:SFI/4vzWOgvl8+ltBC2nJERen6xNNMHJ+2geoGscWcndNe9lu0gRP:k7Svl5jJE06/NMp+2iGshZu0g1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683055590, "uuid": "3029076a-e99f-4ef1-835b-e516d8d8b221", "value": 514310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683055590, "uuid": "f2f6da99-4478-43d9-b880-f77534d5c4e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055590, "uuid": "392f4ac6-e717-4e51-a630-972bb127bacd", "value": "Payment Slip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff05ccb-e8fb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683040427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683040427, "uuid": "b01ff0db-ab6c-457d-88dc-bf3ea74050e5", "comment": "Malware payload", "value": "1e0d3efa1494049c07b56db8994f0682", "object_relation": "md5", "Tag": [ { "name": "1683023161", "colour": "#2C91A1", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683040427, "uuid": "7f35467d-ba34-40ae-b18b-8e05b16e1a19", "comment": "Malware payload", "value": "2f5fa112a3851103950f2aac5c58fe715e2e55277ed1e17edf556d00148dec06", "object_relation": "sha256", "Tag": [ { "name": "1683023161", "colour": "#2C91A1", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683040427, "uuid": "16b2fd28-42fe-4d87-8c4c-bb96e6b70fc3", "comment": "Malware payload", "value": "9145f291baac4e9542d19177186e338727780f17", "object_relation": "sha1", "Tag": [ { "name": "1683023161", "colour": "#2C91A1", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683040427, "uuid": "b923a851-44f7-4d8f-a49d-3dfdbff3370f", "comment": "Malware payload", "value": "a92657b12cc21752baa968f2f619f8e07165ff16071ec3160c66a360c544932b259eb5f475839dbf3e0e92639b90257b", "object_relation": "sha3-384", "Tag": [ { "name": "1683023161", "colour": "#2C91A1", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683040427, "uuid": "658f80db-63d2-4425-afa2-20335410f529", "value": "T1D6F2085BE341133866310235564E5AE0EBA108387A62DFB4B84EC6AE3311D79D6FE5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683040427, "uuid": "b97679f2-4cfb-46bd-a296-ca334ffc0969", "value": "768:LWp6iDX1ZOWeyrTbojkpRUj7BzU6QxIoohuTtwjA+p:W6W1ZOqb8iRUjFw66f8Zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683040427, "uuid": "650f4b9b-3023-4fcf-bc09-9b64e55642eb", "value": 37626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683040427, "uuid": "92e4183b-7fe5-4e61-9c3b-6a386fc6cf48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683040427, "uuid": "78774f88-69a2-4cae-8c38-54b310deda15", "value": "A104.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f61deed-e8dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Ebury)", "timestamp": 1683026978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026978, "uuid": "986c0bda-0810-4911-be11-ecc3213609f1", "comment": "Malware payload (Ebury)", "value": "a6e6306a5e351a34465073fb947cce58", "object_relation": "md5", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026978, "uuid": "4a009fba-045f-4bf7-91df-09095a395631", "comment": "Malware payload (Ebury)", "value": "2f69a3193b3e6797ed171bdeffc8b2fc77f4e8f58962370de1aa31c702ccb169", "object_relation": "sha256", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026978, "uuid": "9eb79502-96a7-4822-85b7-2d1bf2a6bee0", "comment": "Malware payload (Ebury)", "value": "4bed9ce221a6f62409cee52759bae9fcb116123b", "object_relation": "sha1", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026978, "uuid": "ddc0cb7c-2361-45dd-a228-821154abbb12", "comment": "Malware payload (Ebury)", "value": "992e25811e74cebb5098c8b762e372243251be3c02e3391394551467645839053960643b3ab43e54c56a12579eea23c5", "object_relation": "sha3-384", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026978, "uuid": "2711238b-51c1-4c90-bf7e-e257f84777f2", "value": "T132435953B9D040BEC99A87700FDBC72B4FB2B8486932B2DF6DC52A713E51A540B1F616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026978, "uuid": "4e27d35e-12c0-493c-8503-4c92a4cdf1f1", "value": "768:KB5T6ONclmB8nakL+dDGIbqvBS96alhjBxLK9yJTZAmj0rAZMAdFm/U0t:Q5TmlmK+DGIbQnarLK9YABimME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683026978, "uuid": "5ce37ec2-6f60-4ebc-b5fd-cce4a1761dcd", "value": 57808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683026978, "uuid": "50424cfe-154c-40cc-950e-9e1e6f84005f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026978, "uuid": "9ffe5670-a37a-42a5-9376-3ab2bf6bd808", "value": "2f69a3193b3e6797ed171bdeffc8b2fc77f4e8f58962370de1aa31c702ccb169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5438a166-e8da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Ebury)", "timestamp": 1683025993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025993, "uuid": "de37d907-c84a-4187-a005-02cdefb6eee4", "comment": "Malware payload (Ebury)", "value": "307e3a1b5ba852485936c7b63e363341", "object_relation": "md5", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025993, "uuid": "b82e0ded-b5d3-44e3-94ad-26cbe162bc9c", "comment": "Malware payload (Ebury)", "value": "2f6df1124caf0bfea76ba39bda0eeead2a001eeacb4d2aeccc3d7e193044ffac", "object_relation": "sha256", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025993, "uuid": "23695721-df73-4382-979e-427cfc30508b", "comment": "Malware payload (Ebury)", "value": "0f116c62923dbdf7861d9663f1a487e20c584899", "object_relation": "sha1", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025993, "uuid": "e2e3797e-f366-41c1-a1c6-1026a7e917d4", "comment": "Malware payload (Ebury)", "value": "621201fad9601fa7f2fdd755efefd31c47916ae082d6570d5f8be3c92d8403a5ec89f7b646712d551c721b7ce538823f", "object_relation": "sha3-384", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025993, "uuid": "4ca5df68-8bca-4b07-b8e1-f65f3716b542", "value": "T1E9033B67B5D4443ED54EC7708EDFC6330AF6B9896A3232CF29C46AB13F21A190B1E615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025993, "uuid": "3f9ab2ba-b708-4406-b358-5e2ecb5bc3b0", "value": "768:Uo15Tlua8JhxR/bVGE78h5vGkrdVus4BrEVCAE:LvluhD3/bVGN5+k2s5Cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683025993, "uuid": "720c16f7-fc40-42c6-9761-3372b5af378f", "value": 40224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683025993, "uuid": "6ee5feb5-9dfd-4ffe-bb8d-4e38d5f95be0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025993, "uuid": "8520dc2b-9c64-41cc-831a-a75b999e0523", "value": "2f6df1124caf0bfea76ba39bda0eeead2a001eeacb4d2aeccc3d7e193044ffac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821e4787-e8d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683022634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022634, "uuid": "02ac9dc9-f674-4466-afc3-f7f00a80e40d", "comment": "Malware payload (AgentTesla)", "value": "1c6ab72b17fe1fb8e6ddd2d8cdf5176d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022634, "uuid": "300c1e3a-897c-42d8-a52d-171b6f92f426", "comment": "Malware payload (AgentTesla)", "value": "3158fbfcfdcb87792e9ff2262df8bdd7c843058a019f0a731666c1d044923dbc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022634, "uuid": "d4de1ff8-a5a2-4487-a34b-3c95c19f40c9", "comment": "Malware payload (AgentTesla)", "value": "943cb73451c26513238bd850ade429e30d6d8df9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022634, "uuid": "11a5fa78-3868-4903-baa0-d9b8c73ef5f2", "comment": "Malware payload (AgentTesla)", "value": "b75dde6f9d7a82eda27bf790a143f34850d3ed8522a76f59d98f743a1a6d6258a5c68d5a50f4b7272ff485cbdf5f821e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022634, "uuid": "aea02594-3602-43d7-88e8-13979b73e9c9", "value": "T10AB4237C0C3F7EE7666B156F1D80D7A16014573692C3770344ACA4F99E3D0BA69B2398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022634, "uuid": "a38e466c-837f-4689-a559-5b1591c4da80", "value": "12288:PwThmnaBsD2lhu7rV8lvWj3fcC3O8TJb0uGjQJfyQqwtiJeUg68cQ1t:PwThmaBsDAurovWj3ftdb0Ehtr7Ug69M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683022634, "uuid": "cb9f18bb-a516-4ab8-8e91-9068e195dca8", "value": 514284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683022634, "uuid": "e28d9781-4ed8-4b49-bc0f-a6b5137dc1ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022634, "uuid": "6997efca-d501-4537-af16-ac21e5a73f08", "value": "New Order_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015f125e-e8cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1683019841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019841, "uuid": "439f1043-6b20-4e6a-b3ba-c691f7096e92", "comment": "Malware payload (Fabookie)", "value": "4fac556eceb3f6a6b28a39b7e555941b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019841, "uuid": "9e9511ea-a98c-46d4-8d5f-53fa5a5164be", "comment": "Malware payload (Fabookie)", "value": "31ca0502fe274d68c3da0efb2fa2584648c18f65697f0bf9be65559ff719e699", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019841, "uuid": "05dde035-0e9a-4834-a0f4-1fa419796404", "comment": "Malware payload (Fabookie)", "value": "b8deb206996db5df0524d4328a03cec7178dfe0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019841, "uuid": "909c217d-b241-4872-aace-04deac473870", "comment": "Malware payload (Fabookie)", "value": "4353ae79a5f87a01a31bee2aad80d3e5756f4215a13dc2783c0b6958606ab2ef730609e80a213ba69dc99bcde8ffefee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019841, "uuid": "fedb8e18-9f5b-464a-ab56-d47f411e6d82", "value": "T1B8A45C16B7A841F5D177D13889928616FBB2B4478B24C7CF12A8D36D3F236E14E3AB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019841, "uuid": "1e7cf5ca-1252-4a71-b5dd-0a90b90a6a7b", "value": "606a690081d1bdedf2f5dc3cb5f1d4a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019841, "uuid": "b4bbd1d0-aece-45e3-958d-4d7fb0b71990", "value": "12288:ZjaaF2sTh5S3B8ZlNnYKF/DCeT2T8fltAPCB:oaF2eh5S3B8LNnhZT2T8flOPCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019841, "uuid": "6d4fe712-c567-4a21-9e08-f1c7625d468e", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019841, "uuid": "b90c18a6-b88d-4e97-987b-71746bf8a319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019841, "uuid": "bd45729a-4303-442c-a645-ab24bf48b411", "value": "4fac556eceb3f6a6b28a39b7e555941b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688b3059-e8ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683006699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006699, "uuid": "0ac76aff-a72a-4a07-90fe-425f4d5cdf06", "comment": "Malware payload", "value": "6ae3e6cf7450a058a23576aa3f92c35e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006699, "uuid": "39de7955-e53f-47e3-a710-62dd721f7843", "comment": "Malware payload", "value": "320fad86cabde8e405f83ca85460229cfb6f3e8e44e379db7d234c71b0b8bd0c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006699, "uuid": "956f80c0-5d63-4612-96f2-74305aeeffc7", "comment": "Malware payload", "value": "a3957c6682cc1f4587b9eaaff2f52b658e21d644", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006699, "uuid": "fd1709fc-120d-4c40-8b00-0d28773be8b9", "comment": "Malware payload", "value": "959e2b8a2122fd87533bcac1a7a1603d60ebcef06d00672d600a30c5dca00fa3614b77b7f239e67b827257d9000a190e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006699, "uuid": "7cb53966-6dd1-4df2-a476-cf6fc29d6682", "value": "T1F582C788D74F04A1DF54A33B431A4A4942FCB73EB24585B634AC83B137EDD2E49669BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006699, "uuid": "a2f98761-bc4a-4e04-b23b-ba84f8f04bed", "value": "384:WN3VyHxDGpoiXTLYPpGGa7ik9wNSphCfqc7f+yH7MLL1DcTK70+:WNlsyoiXTLYPg9/9wNSJyjbeA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683006699, "uuid": "a0e84aff-f58d-46fc-a566-a3e0f6afff2f", "value": 17890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683006699, "uuid": "3a839d19-0758-4a91-ae4e-9aa75d7bece8", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006699, "uuid": "77a04331-a19d-4f49-9934-0ffef86b7a79", "value": "OrdenXdeXcompra_36098.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ae2924-e8c0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683014830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014830, "uuid": "f382044a-d6d4-4d6a-b94e-fd53cef7f5f1", "comment": "Malware payload (Vidar)", "value": "1c87be3086b35f72e87666036310df86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014830, "uuid": "eb06719c-417d-450e-9666-a90ede40d2cf", "comment": "Malware payload (Vidar)", "value": "3278651feaa6ef551f129a85d9e530f693a5dbf91b900024ee7533eff03efd38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014830, "uuid": "dcde294e-0d57-4578-b237-e63445d386d0", "comment": "Malware payload (Vidar)", "value": "72731934e1ece515cd8eea21eebcc99045ec81be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014830, "uuid": "16dac75b-d0f7-4e75-8a80-a7fe086ceb2c", "comment": "Malware payload (Vidar)", "value": "653fcfed52ea33f2b3c42c193f4be33f96503539933ddfe2a943bd24234767c21c1dd6f613a3d9b0cf40fde59f3a34ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014830, "uuid": "0f2d1cb0-6f59-4622-8735-55f94e7306f5", "value": "T1145608FA20D16D8EC20DD5BAF201BDAE8F4FB439061568D358C53672A992E037E74B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014830, "uuid": "95c877e4-0f62-4bae-abae-af3db9600b3a", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014830, "uuid": "96bd3f39-804f-43b8-a052-8387a12f7bc1", "value": "49152:qbjVOzG9vosBswUBzcIDd85mSCDrCp6/J2BAHh4w96Y/lprU3mP4VnsQeuRGIAhk:ajJ9vosBQ/d85m9D+6/kBtt+88hHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683014830, "uuid": "916a7585-387d-4f24-a9d3-1ba1a40319c1", "value": 5981744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683014830, "uuid": "9b2e4a5e-d7c4-4119-b0df-4fffc3b5b3d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014830, "uuid": "0a7fa7ae-67b4-4245-8010-c8ed852cbded", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05769fbc-e88b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1682991930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682991930, "uuid": "72b1edd4-2af5-4bbc-8a10-1213d3240600", "comment": "Malware payload (njrat)", "value": "aa9ad15156f2d781daa7694999e23c4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682991930, "uuid": "64ca0154-81fc-48ba-9a58-b67905c83f66", "comment": "Malware payload (njrat)", "value": "32a4977221277a715b2d2a2ff1444253552585e8c4359c496fe9ca6052f7f98b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682991930, "uuid": "c7eea217-bf58-46a7-a340-1653893b2f6d", "comment": "Malware payload (njrat)", "value": "e5186f3348c4abc35443099c593e4048c7da01b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682991930, "uuid": "94f3a532-7224-49bc-b2ea-4bc08c063de4", "comment": "Malware payload (njrat)", "value": "5fc3172be5ec7f0f59732dc26d48716dc02364f473342e2fe5dc8baf93e9bf627f63a5a4bd44c140d5b64fc70f83243a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682991930, "uuid": "0a8ce3a1-2ad6-4406-b7b6-8e91cfdcf334", "value": "T10214E7463BE88D54E17E5DF65831551003FABC276E21D20A2DFA38E9FAF67D04D02B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682991930, "uuid": "73048b55-d549-40e3-adc1-1ac0af4cb1b1", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682991930, "uuid": "21a3229e-29ee-4fcf-a747-66a68855d110", "value": "3072:ZBhnIAiCU/KSWU5Yl66R92rwGsi0GiC6lKXWUcJF66R9:LhnI5/KRF2wGOlKGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682991930, "uuid": "6d63e6aa-5a3c-4dc5-9938-64378c636c93", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682991930, "uuid": "994e32c7-5510-41e0-82e1-aed0d7c70a53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682991930, "uuid": "e797c544-340f-4a38-a958-9fe969dc8a90", "value": "aa9ad15156f2d781daa7694999e23c4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1122246e-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683013425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013425, "uuid": "07316989-731c-4f55-abf2-c20a303dc04f", "comment": "Malware payload (Formbook)", "value": "059add6a1cb1b16bc455af6686fb5b39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013425, "uuid": "ae910d50-7e3c-4228-9a59-850036371d5a", "comment": "Malware payload (Formbook)", "value": "338c24b4e755ad15fa3fba95c2a4df09d8fe2aa343b13dc8d5506013ba8bb94a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013425, "uuid": "bc37be46-4b4f-464b-811a-f5e85df9f3a6", "comment": "Malware payload (Formbook)", "value": "d40346d507ac935ffba292b9585fc156a20adb84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013425, "uuid": "05d5a5f8-9e0f-4bd8-bd1b-09696ef00cfa", "comment": "Malware payload (Formbook)", "value": "0f13c7c9b7b9767eda16f9bdb0c854608801f2a02226091d7d16b0f646cf2700ee28bbc675d514533c6927873902e943", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013425, "uuid": "4b5d250d-d443-47cb-8e80-f216ed017341", "value": "T104F48C3C2B6B1FA2DC39EBB7D2645416B3E5F55AB21DCE683CE61095090390371B32AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013425, "uuid": "821999ab-0cca-41b9-8eeb-732a0888913a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013425, "uuid": "905bb6dc-3611-49f7-8a91-bd2e6d0e0a8f", "value": "12288:rKJ1TC6YN1P1+70pKXQlIj5g15bAa9pA0nRd+9d3O+mJGUxgACYZ4M10Nvg+aMFt:W75g1hAaI0ubmJnjh0NWGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013425, "uuid": "5d19522d-1000-4b06-8775-2eb8ffc36200", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013425, "uuid": "8e68b599-c202-4407-af4e-022cd43e8966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013425, "uuid": "dbc5e478-9cab-4cf6-b322-5dd6e2717a08", "value": "URGENT REGUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9ef3ea-e8c2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683015588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015588, "uuid": "88f567b2-551c-45d5-9b5d-bbe845ab5dda", "comment": "Malware payload (AgentTesla)", "value": "b7f161f2dd817092a0199f5e59694528", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015588, "uuid": "9e391ba8-5106-4a05-9ae6-43ce2602245b", "comment": "Malware payload (AgentTesla)", "value": "369589e738fc8b7e8e74ae15fc398639e3ed906982c7244705a66875cca0a611", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015588, "uuid": "ea685fc5-ca5e-435c-a5a3-b99d9b9e0594", "comment": "Malware payload (AgentTesla)", "value": "a903fdee3c831bc76c85f985854a9a6ee69dc704", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015588, "uuid": "d9045b5f-6bd5-4526-8500-b868e733d9bd", "comment": "Malware payload (AgentTesla)", "value": "9066b833df6760798b2b9550400ab71ca0c6d0982841323b76ae733083b9b694add8060b8723d6b7e460429c86ec78b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015588, "uuid": "5c33c951-f0d7-4cc6-8e59-d6e108d01816", "value": "T114D4CF0261A9CF5AFD3A9BF144A8FF8067F1B57364E0D1211EF624C9DAA5F010F09A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015588, "uuid": "a9de2a90-e246-4fb6-9746-3bf746a4b3b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015588, "uuid": "58a1fdb6-72f7-4917-942b-ce83bf3b4439", "value": "12288:Izmb6VUpY+qhF8lRJ6zwpRW7kaE4i9MbNVFO86:Ombc/DF0RJ6zwpIkv9MDFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683015588, "uuid": "672c9fd5-0901-4f75-a931-25a15151c161", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683015588, "uuid": "1c07c397-baa1-4ab8-b6fe-5eefcd623b58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015588, "uuid": "9a2d4813-7745-417a-98e8-538e216704d6", "value": "QUOTATION-23050002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f95158-e8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683019473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019473, "uuid": "4a0be66d-d2a5-48c7-8ca6-a42c1a540fe8", "comment": "Malware payload (AgentTesla)", "value": "f84c0765285cfa761e31bfa7f5f2b878", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019473, "uuid": "23d36fb5-8b76-4306-922b-e68d74532d51", "comment": "Malware payload (AgentTesla)", "value": "37617e571066d7e620392e8be59f962ae9c20dade410e7291b345bf669b0c59d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019473, "uuid": "ba2eb8a2-a4a5-4624-ae95-5ccfe46f74c2", "comment": "Malware payload (AgentTesla)", "value": "5ef22c3d8dc871cb6a7b1c786db00ab558c64a97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019473, "uuid": "f7a44945-a01b-4086-ad4b-34b554d25252", "comment": "Malware payload (AgentTesla)", "value": "042203289c835755b71a66ca2c85709130276c74c53139a8e13d99fddd5d34c0859e074332e6044c85bb7d9d769336d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019473, "uuid": "c4b95191-7284-4b9e-b7f1-b972acab7750", "value": "T15DC47C63F135CADFEE713BA5C15DE7567E60E412E091F0A07E0920C8DAA57E21E8C17A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019473, "uuid": "884787a5-62c6-43e8-9978-b6cb1bc73bcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019473, "uuid": "05d06c2b-880e-4120-950f-329bf68dbb23", "value": "12288:34awZIJA5PDeLQM7SEUdnX+z3eSvDBKFtI0JrxwS:ygkDT2wnXQ7F0dxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019473, "uuid": "0d9398cb-58bf-4e92-97da-79761c732fb7", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019473, "uuid": "7724081e-cb94-4c5c-877f-a7576e5e6990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019473, "uuid": "3b812393-5ffe-4124-83d7-a91b71b1d345", "value": "General Attachment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c5cec0-e93b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683067787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067787, "uuid": "35ea7e58-adf3-42c3-8bfe-ba8ca831ae0d", "comment": "Malware payload", "value": "0d31c0ac8190a335a7504b3e9620b3e3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067787, "uuid": "01123919-7c8f-437a-a678-c8ba63a6d033", "comment": "Malware payload", "value": "3797720ea7795c332a38b53c7b3329a4f72ff81a32d59c5b4b5b2798af1a9f19", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067787, "uuid": "8e475baf-0bf4-41df-8b84-5afb5e72a8c4", "comment": "Malware payload", "value": "ee9edf4c51fd32f14ea702a07dcdcc4a2e293786", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067787, "uuid": "b5c1c82c-77c1-44cb-962a-45046ad8d7bd", "comment": "Malware payload", "value": "d7e8bf3e9142ca661585bd053511d13a27b6fa565279e88703a7ac709588cf84253a62ab7c076c1971a81de9dc659e3b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683067787, "uuid": "c91776a2-d3ab-42c4-8c49-d05b4214883b", "value": "T19FE07D606CBBCD80E4E01C3135356D8F91EAD22476C5A538A989E687AB8199909462D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683067787, "uuid": "9ea584b6-56af-4641-950c-b3ea84b8d16a", "value": "6:TMV04UoBGfWYOMiCysYWvAAT+gexLQGWHMfuVMgHtRsamdkjf8VvWypJ6o1MiOzn:TMG4UoUWUTvAJLGHMf3gHtaaASf8dTp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683067787, "uuid": "f8d309ab-d266-4c15-9df1-34d3a5fc6c0d", "value": 334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683067787, "uuid": "8c6c1615-8cd6-42fc-967a-8e0f17a3b4a0", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683067787, "uuid": "1a941885-4d05-46ee-a70f-2e12b070e51d", "value": "ahLOFwBX1JbG.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f9ab9b-e8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019479, "uuid": "d5bc06d3-e7e8-4c61-af4a-1ba146a9cb2f", "comment": "Malware payload (SnakeKeylogger)", "value": "b96706157a1d93dda7d037753161f1f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019479, "uuid": "9116392c-34bc-4f8c-a3d9-b8ce4e980606", "comment": "Malware payload (SnakeKeylogger)", "value": "379e369213c375ca8d627d44578fb2bac555cc650b20bb24850344ebe3df51d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019479, "uuid": "7ecd0125-edb7-4c56-aff8-15f10bd81931", "comment": "Malware payload (SnakeKeylogger)", "value": "1ec4e8dbec4c4d593de40c8a3fbc7ab819894c59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019479, "uuid": "6d2d073c-52ee-46c4-9dbe-789e9d2948b8", "comment": "Malware payload (SnakeKeylogger)", "value": "a4047f37a150fa8c292d7118eeae943f4b15308db9284253c15687522be50004142343d9f796bc2249cdfb14b601b9a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019479, "uuid": "5a1feac7-2804-48aa-91ac-77a69d9bdebe", "value": "T1E3D32A5E2BF44800E2FFAA7306B16212C375B822261ADE1D4AD1F55E2B7D6508E17FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019479, "uuid": "40cd5f9b-ac41-4b82-9f15-442b0e97a7c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019479, "uuid": "c3f2eb59-b3ba-4925-a929-f88f773c2fa4", "value": "1536:FJR6g1Z2Mx7km4THQ6822uS9tAnRpzvevwWRcIbKuJXbMf9piO5BKDF0Kcl:FJR6rIQ23AnRpzC5RnbfqfHfBKDFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019479, "uuid": "fa3023d6-8fea-40ca-b679-0f334cb0f8fb", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019479, "uuid": "3bebafa8-2ea9-4beb-9eea-60845d684fd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019479, "uuid": "3b560589-000a-42b3-9e47-7c53aaafdc4f", "value": "b96706157a1d93dda7d037753161f1f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3717bf5-e8ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683006932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006932, "uuid": "ec5d0438-c41d-49d2-b593-1ef4911a03ef", "comment": "Malware payload (AgentTesla)", "value": "1057fd88138a21fa9c5588cfbef3695b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006932, "uuid": "8088ddd8-5da7-4ffc-b9d2-0651722a0c55", "comment": "Malware payload (AgentTesla)", "value": "392c2c5123db28e02bdcb0424682686ca0f52cbc445d67320f8a0d4f617de5ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006932, "uuid": "52f410f3-3cbe-4ac5-a5af-2d219570da90", "comment": "Malware payload (AgentTesla)", "value": "037d694f82d526f1ab101915c3138fba453c514f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006932, "uuid": "17d83349-3a2c-4fe8-9abf-2d6c1c079fa0", "comment": "Malware payload (AgentTesla)", "value": "8949775e4e79ec5ea69ade34e5d697962f1fd7275f33ad4b2f76b82c3e790df7ece5610240737b63b1a5d26eddb8766a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006932, "uuid": "64580e13-d396-42e1-812d-a43c0689a8c9", "value": "T197C4CF1873F855E8F3F2DB70AA71516ABB3A7D9E2525C2AC1D04001C1D71B54A8A2FBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006932, "uuid": "0355b067-8d47-476c-905e-3a78d3f19f89", "value": "12288:qZNBzR9V7PlrGL2KGS8K1XWR6OPnmgubIReVc+Y8N:qZjR9VpSBGrK1XuPnmguieVc+Y8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683006932, "uuid": "02b91d3e-59a6-4ca8-a9e1-e7bfeb245f69", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683006932, "uuid": "8c9e38c4-53b3-4229-8d1b-47a180b0b42d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006932, "uuid": "78161ca8-269d-452e-8024-8222aff8a516", "value": "Fiyat _PER 120 mg 150 ml 50000 units_scanneed 00101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96edf66-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683013385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013385, "uuid": "539f90bc-ba56-4449-a4b5-b841e009ddba", "comment": "Malware payload (AgentTesla)", "value": "246c08bf6dbef849c0f4ac3791b02ba1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013385, "uuid": "832cf4c3-372a-4fd0-984f-7b34d09cff73", "comment": "Malware payload (AgentTesla)", "value": "397a6e1b47e1342772eb05cd3e45717a955efef85f78b8dd52c67286a8588411", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013385, "uuid": "8d95e91e-5665-42a9-8835-2c0567b93527", "comment": "Malware payload (AgentTesla)", "value": "4e4bbff06270b97ed705e544a27691672d3d8a50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013385, "uuid": "6ab55f74-dd52-403f-b3b4-538f79e6cfcc", "comment": "Malware payload (AgentTesla)", "value": "e1744788694fe206e4d17b21a0264903ebee75eeec8915f5e11f7665190a5dcef4283fd0518299bddbb9f97901dee611", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013385, "uuid": "7aabdf56-b0a5-489c-bec2-9d3f609c495b", "value": "T1E2A394D3B212C8D6FA3847759D23C88D11A7FDADB8A4146D70A6B7794A7B383041393B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013385, "uuid": "37e5d22e-28f1-48d2-bc36-141220f140d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013385, "uuid": "d3d53106-2894-4850-afe9-1d521b520864", "value": "768:3f234F/pSRmST294dWa2P7b1IzPrXMkN336DX+:3f234RpSD294dN2PmfMkN3KDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013385, "uuid": "12f88a43-f790-49de-9e2f-e6d1bb70eb6f", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013385, "uuid": "4ca61901-06dd-4fc4-b846-8f8c1a437e17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013385, "uuid": "678bc114-8eb6-43bc-a708-ebf8c7ebd2ca", "value": "FACTURA TT PAYMENT 230502.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de52a5d-e8b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683009259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009259, "uuid": "9a388d0d-a92f-412a-90a2-351550481c05", "comment": "Malware payload (RemcosRAT)", "value": "025b8ab849022495bba05df296c36324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009259, "uuid": "43ea0720-614b-48bb-a0f5-e6394c0e1b37", "comment": "Malware payload (RemcosRAT)", "value": "3b639f1284d130cce4e49977bff13e6424f5218b65a95a530ff6d9627837f2ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009259, "uuid": "e405bbb8-dc64-4a9e-8b94-78322580aa87", "comment": "Malware payload (RemcosRAT)", "value": "97c184b5fb7333bcf4f461cfe3c4717973d2399c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009259, "uuid": "cac167fa-2a76-4667-9017-ab8d3ede421f", "comment": "Malware payload (RemcosRAT)", "value": "a955764e342ee4da3f0c37159e5082696e76815bcfceddb8faf8c4f1823e71fefbc10d8165d0eb4f9a2f46dd575b60bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009259, "uuid": "9e889cd8-e1c0-4cbc-a8de-305c05acc8cb", "value": "T145A4B001BAC2C072D57664300D3AE726DABCF9211935597B73DA0D6EEE70190B73A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009259, "uuid": "c1c968e0-ee2c-4766-b8c8-89384bf4c923", "value": "b1c8f7572a6db205362528e88fd3ff32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009259, "uuid": "c3d2e0fe-e3f9-4c6c-8c74-d0c399ed8092", "value": "6144:sXVUvr+eNVx6JuGD5To83sRnymABKtqulRwOJfZJEfcZdC48hA6WsAOZZ8RX7mck:sX8/Vx65HCnDAByqulR1fZJQSs/Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683009259, "uuid": "6248f880-7c77-4e08-b149-39abbac34ce4", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683009259, "uuid": "a1194a16-7644-4b8e-8d1d-7633551fd6d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009259, "uuid": "5a069ff8-9012-4448-953e-3828334daa97", "value": "025b8ab849022495bba05df296c36324.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8487cd2-e8ca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019369, "uuid": "50f3b606-fc19-450c-b731-02fea3f0a514", "comment": "Malware payload (SnakeKeylogger)", "value": "e294436d97c4947e43179dac9b06112e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019369, "uuid": "a59a1511-f46b-441a-b651-a6963dad11b3", "comment": "Malware payload (SnakeKeylogger)", "value": "3c9a0065bf311001b5f09d72f88d112d93e67846a67df33a4e4bcc04e3edc173", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019369, "uuid": "eb16e6ad-5219-485c-b254-f9e6811ecca2", "comment": "Malware payload (SnakeKeylogger)", "value": "8b5455f100f9e9a752f234e5d2988030642def22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019369, "uuid": "6e7bdfd3-6311-4100-80f3-7930a3050db5", "comment": "Malware payload (SnakeKeylogger)", "value": "89a2b8e322aa062939b7c29f65c6add49ccc54686c1c4d380f26d506221994a658291631afbbdeb957a17cced6c10955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019369, "uuid": "5aa567e2-a8c0-473b-b4f1-e2feee6b8f0a", "value": "T138E47B382B6B1FA2DC38EB77D6645416B3E4F15BB21DDD293CE610950A0390375B32AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019369, "uuid": "41d75b69-10da-4011-a599-1d50ba74a5b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019369, "uuid": "ff0c748a-413d-408e-81cf-6446a6688e93", "value": "12288:pOLRC6YN1Ph+70pKXQlIj5g152ezjFafkS128Pl5nu1OrBZii6oxFuR:G5g1mfFPl0vi6+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019369, "uuid": "9b2becc1-2cf2-4382-a13f-5caff1dee977", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019369, "uuid": "b93e7f77-02e6-43ae-8ed1-7fbd80f2ad4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019369, "uuid": "dbd5fa51-16a7-4f9b-8f69-d6ea5e401f60", "value": "Company Products and Orders Prices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c0ab17-e8fa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1683039737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683039737, "uuid": "64270219-dce3-4aa5-b0e2-945b47903274", "comment": "Malware payload (Quakbot)", "value": "9ed2d5a1cf22f9cb54f9dabcfdcfc22f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama259", "colour": "#8086B6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683039737, "uuid": "84714c00-16c2-468c-86d5-5434179ec6ee", "comment": "Malware payload (Quakbot)", "value": "3cd245d944c5f73837b0e1cea7d63efba4aeb76ab3bd026c517c0066e7401069", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama259", "colour": "#8086B6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683039737, "uuid": "08f6ce4f-b296-46c3-a4e3-7f9943c5a16d", "comment": "Malware payload (Quakbot)", "value": "a85789a8fe10ad7e7b5418f8aaddbffd1c4b7b96", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama259", "colour": "#8086B6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683039737, "uuid": "eb990074-dca2-458a-a6de-8196a1f4e163", "comment": "Malware payload (Quakbot)", "value": "4db66046473090fe46f951e217efecbb0f7599565982755975a26a1fbd2ea3ef14a5580c3d0d6e38f69dc46d2756a7b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama259", "colour": "#8086B6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683039737, "uuid": "b12e524a-bc06-4a9f-9f10-60c91371fd15", "value": "T1D4747E223AD6D8BAC7A3C375495EE3AC44E9F0704E39121337B8076E1F746A1973586B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683039737, "uuid": "3c31b839-5191-4860-82a6-29b99a6405ae", "value": "8299f8aa7c72415c1fe84d5d7455caab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683039737, "uuid": "d360867e-d7a2-454d-abe4-3208ead47f5a", "value": "6144:Wndn8N6mSH77nGcRirEEgpOKqG4X7TBjpXNXpvvypNOcVWC:K82NRixfz/3RNANtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683039737, "uuid": "61c160bb-dee4-40f4-a821-37e22803f355", "value": 365056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683039737, "uuid": "6be4693c-16d3-418d-8955-8e2e363ed3bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683039737, "uuid": "e3875d10-0329-4eb0-b769-cb0fcfb7f41c", "value": "aMS8jtw13s6.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee3514e-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683013394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013394, "uuid": "e2af6675-449b-4f89-9170-bafe96fe7dde", "comment": "Malware payload (AgentTesla)", "value": "2c6696ccabb3b81424eac372a103b1d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013394, "uuid": "6e05c68b-4d95-4d44-8de5-60cef40018fd", "comment": "Malware payload (AgentTesla)", "value": "3d42bab61f618c233286e0a4668dc94035b789b13d09ebf21e79c8247827edcb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013394, "uuid": "7f687f37-d279-49fc-b828-2d7780dcb914", "comment": "Malware payload (AgentTesla)", "value": "27641dc63caa8a985d9c33e71eb9c5882a430454", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013394, "uuid": "c5390ab2-ca4e-46e6-b7f7-4b83d26659cc", "comment": "Malware payload (AgentTesla)", "value": "52e08537114f9624e8bf65172f02a6f786d822d8410a2223efd56aefbbce96bb63f78cd398c509b86cff1fedb2e98b6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013394, "uuid": "8f374ccc-9832-4616-8855-122747d06b80", "value": "T14DE47A3C19BD223BC179D6A9CFE5D837F044D96B3021AE26A4D787664706E2235C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013394, "uuid": "dcea5332-eda8-4ccb-b618-de81e4458a88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013394, "uuid": "4131c83e-8b1a-4f79-97a9-ee76be809cb5", "value": "12288:Rjm+vY07/dBjesMZ0EBd6wXdLd2UWGbSA8fWe7v10Fmv:Fm0/VMeUd6ahd2UrSLfWe7v10Fm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013394, "uuid": "f73881d0-dba1-4252-814a-183083a9d85c", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013394, "uuid": "19e18c80-c540-4c5d-a6e4-f4163f1df158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013394, "uuid": "1db35289-fdb0-45b2-ac7c-8546fb4ea93b", "value": "New file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a395389b-e8dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Ebury)", "timestamp": 1683026985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026985, "uuid": "26c9a7bf-f1a0-41e5-861a-c35367f44b37", "comment": "Malware payload (Ebury)", "value": "77f2920ae750b5fb96e14f7d4bc82679", "object_relation": "md5", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026985, "uuid": "9a626bd6-5f33-49d0-b320-d60278547f4b", "comment": "Malware payload (Ebury)", "value": "3d51fc45274380d14eed671d4127ad216525e92d7d658c0bec3b01d584fd6d2e", "object_relation": "sha256", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026985, "uuid": "d9790e80-5194-42ab-9165-35af9816a12f", "comment": "Malware payload (Ebury)", "value": "bb7dbd8930f0fd32f4128a51ebb9eeff6e86ec84", "object_relation": "sha1", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026985, "uuid": "15ab9dea-f2b1-48c3-98ec-3f4d4d695065", "comment": "Malware payload (Ebury)", "value": "13a80e4cccd56c7748bd60fd9e216569e6b31eaa5fb8011ae5610302f14d254bfcf9b9e826b2f3385e70355d20938fbb", "object_relation": "sha3-384", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026985, "uuid": "fc6097cf-b202-4b90-9ac8-129a19b1c69f", "value": "T1D2034B67B5D4443ED54EC7708EDFC6330AF6B9896A3232CF29C46AB13F21A190B1E615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026985, "uuid": "56a8911c-6390-4fc5-8cb7-ba95479dd182", "value": "768:T15Tlua8JhxR/bVGE78h5vGkrdVus4BrEVCAE:TvluhD3/bVGN5+k2s5Cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683026985, "uuid": "ce2195d9-3dff-415d-9dbc-af2c26d53c7e", "value": 40224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683026985, "uuid": "37e1fdcf-760a-48c6-a29e-bdcdc001316a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026985, "uuid": "cde8d1d9-b5a2-4b23-abf6-fe4b3fac7624", "value": "3d51fc45274380d14eed671d4127ad216525e92d7d658c0bec3b01d584fd6d2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4399b060-e8dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683027253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027253, "uuid": "bf380c7b-0fc2-4322-b33d-0d5698d80422", "comment": "Malware payload (GuLoader)", "value": "bb91cbb8a9c5cbdd3bd920edf9bad626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027253, "uuid": "9c811ff4-3f07-4d72-b454-62803f11edaa", "comment": "Malware payload (GuLoader)", "value": "3dab03c421a4b8af699ee0a73d29ad6061a7a71e82e11ebb00d6f88794b66ddc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027253, "uuid": "613debe4-23d0-4844-9f9b-9751b8f908c2", "comment": "Malware payload (GuLoader)", "value": "478cb2095bde562e35c7023c5da5d354740b5108", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027253, "uuid": "d88673c4-d40b-4b5d-bedc-f261e9a0952b", "comment": "Malware payload (GuLoader)", "value": "443dcbb1b6134af605e0109dd1a8f3474b2aeeb518ab57dc7e5aae75d596d035f2c2bb1cb5317d9d9071728e1ef67d43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027253, "uuid": "71f5853d-37d3-492f-b61c-632c2a33e22a", "value": "T1B26412573B81C86BD48807B60D77EAFE87B33C1D9229660B4771BF5A38312839E1D586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027253, "uuid": "7f2d1da9-293c-4da5-b979-3acdc7c932ca", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027253, "uuid": "60f7211d-a52d-4338-85e7-1846648decf5", "value": "6144:R4SUjhth5uvFJFdR5v1Nvhf51ZmLm56zsoI+vL9sEInDpc:q/uvFJFNvhf5LmLG6g+S/9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027253, "uuid": "b773e0db-d197-4cc3-8dcd-5f2d86999c4d", "value": 330615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027253, "uuid": "ede9fb3d-cac2-490e-a4a2-0eb75c01538c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027253, "uuid": "d9c04273-4b2e-4954-8550-b0d56d0c8732", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4017f277-e8dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683027247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027247, "uuid": "3a7f0d7a-2f88-4a0f-916d-c05375de7571", "comment": "Malware payload (AgentTesla)", "value": "755d1052d31f1d1bfc903c402f976d7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027247, "uuid": "445f1096-dd23-470c-a98c-9890c333e5ab", "comment": "Malware payload (AgentTesla)", "value": "3dbbb63d021642884105d294d22c1f0e5a1c751afb0c437f28b8fd57431eeebf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027247, "uuid": "60c9638b-fd15-4bd9-b459-6c9628ea210a", "comment": "Malware payload (AgentTesla)", "value": "6bbecbbacdc72796c645a91fad9cdb1ef8df3f20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027247, "uuid": "c08d8c08-c369-477f-9b36-28c416a6792e", "comment": "Malware payload (AgentTesla)", "value": "694b062494e9eae5cb41c372372559e32a83d014e90f130c38a78e7460206443781a52d5be44f62433a313f01e1d9cdb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027247, "uuid": "a6e99242-9d60-4b2d-98b7-eaf8bd8807ec", "value": "T19C64014626DC45DBE9AE1971BC35F32E7AE19C5404681C1B1F40F90ABA7390246BF3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027247, "uuid": "12f0b999-8cda-4c86-bb2c-9f166b6439b6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027247, "uuid": "b92801c1-8394-4c31-8b84-953782f39ab9", "value": "6144:+Ya6PqiPzhrowmihuxvzZI0Al1ypSY9jKIphsZHpxTqSC0+b1w:+YnPlooYxvNZAl1mDpE3Tq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027247, "uuid": "4d937efb-39d5-407c-944e-c8949e15f7cd", "value": 317100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027247, "uuid": "2109c5a6-3f99-4c0a-bd0d-d1d1c952528f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027247, "uuid": "aaddd52f-c346-4a0d-a067-23e0586904d1", "value": "Halkbank_Ekstre_20191102_073809_405251-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae1e7cd-e8e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683029816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029816, "uuid": "7c6cf9fe-0760-40c9-aaf4-1a2a6520754f", "comment": "Malware payload (AgentTesla)", "value": "81b0c0a525643fdab164beac3ac03e2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029816, "uuid": "578c5fa5-9dd4-4577-84e2-b8b6a948ba61", "comment": "Malware payload (AgentTesla)", "value": "3dc04b3237c4940f5c62206b168a4ca818d930c7da1acb4d24101856b7279d07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029816, "uuid": "d19e7cdc-7559-4ef5-81b9-c9e9d7bce049", "comment": "Malware payload (AgentTesla)", "value": "fc2f3ca652c7f205e62106b819b1e8daa99093d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029816, "uuid": "d8b59121-2389-4d59-adc0-89477329c390", "comment": "Malware payload (AgentTesla)", "value": "da97c8a108945448c6a773a65a2fe26ba9c0767474ca2fc559753443ac777269721fd4f91573ac8579bd1f120e38f73d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029816, "uuid": "54a91f26-2e3c-4cce-93b0-aeec23d1a5bd", "value": "T1CA132283F3CCBDE6D81A03728B7949F12026BE6945B4853E315BB716657335338A2DCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029816, "uuid": "90f2e78c-b716-4a7b-bd36-3b11c3f402c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029816, "uuid": "b64d6cb2-5d36-4f30-bf1a-7007a1959cca", "value": "768:heD8SC6QSRF/hC0gSWq111111111112tmhN:hewSNRF80+q111111111112i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683029816, "uuid": "6b1db1ff-92e3-458a-92a5-4bb07e910817", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683029816, "uuid": "16ce7be7-cf94-4b87-b20a-58e15cf37f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029816, "uuid": "92f6da20-c6c8-4df2-b2fd-2681d07c328b", "value": "Doc_7780_061161pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b4643b-e8db-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683026426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026426, "uuid": "bde614f5-2e27-437a-92d5-ebf6b05ae8d5", "comment": "Malware payload (Vidar)", "value": "2405f52eca4630f5ed7d0a5577457520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026426, "uuid": "8d8e1c4a-da57-4516-afc1-f2fa7ad2e086", "comment": "Malware payload (Vidar)", "value": "3df633603aa20a17b5f873d560019b5f19d151a31cb0ea9d56b2ad9f02b5b97f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026426, "uuid": "0bb8afc9-5863-4dbe-bd9a-ac13a8aeda99", "comment": "Malware payload (Vidar)", "value": "0ccada395556cca7a0bd6790260a3246e713b76c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026426, "uuid": "b84f37b0-9459-493f-8f8d-7854b55abea3", "comment": "Malware payload (Vidar)", "value": "3fb35fdd1b3edd22930b74790cdf312712118a48dcbc2edc38f624d54732584db44a3fc589ca522c68135dfc63201a8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026426, "uuid": "65fb3cda-f2d8-4aef-b8a5-d029007c9b00", "value": "T170955A2439EA501AF173EFB65FE479A6DA6FB7333B03646E1051038A0623A41DED153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026426, "uuid": "faa05d20-bd40-4c3f-be95-031507753e09", "value": "24576:HI9ogyrryrCG6XpMa53pAQJEUDSP8na7nUAdaf6CDruxp6/j:6vHr2pME+NIZa7nJaSCDrCp6/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683026426, "uuid": "3624774d-f7f9-40b8-a8d0-08d877e6ddd9", "value": 1969528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683026426, "uuid": "02f2e35e-58ea-4fe4-927e-5e6eb64921f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026426, "uuid": "829be845-e789-4a98-8b8c-ad38a54b0387", "value": "2405f52eca4630f5ed7d0a5577457520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fb9d71-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683013359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013359, "uuid": "ac1a78c0-0732-4006-980b-1dd63be0b042", "comment": "Malware payload (Formbook)", "value": "bfc010ac92518c474fe5a10c13d37e59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013359, "uuid": "24e2f6ac-e23f-42cb-96c1-8450cd39ad20", "comment": "Malware payload (Formbook)", "value": "3f95d87b384d8cc5b0689015483cf19f23bf75ae1f75f5043aed44dcf1cf07d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013359, "uuid": "2d417fb1-f487-4185-a275-405d15729524", "comment": "Malware payload (Formbook)", "value": "827834b3330cae14e0a4c9b88eb5649f4130e973", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013359, "uuid": "2851df4c-3f00-49b4-ae89-5b35f7fac1ea", "comment": "Malware payload (Formbook)", "value": "6fcf985dab4dfaa2bd4355244657a436c56cce189ea6141d0ff78e90b79614bcf3efca436f65f945b8a5d48db6f4c1be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013359, "uuid": "6fc4c22d-ba0d-4005-8af3-e8ef53ad4cca", "value": "T16C04AE32D602C071E2B251B5B6BD1B7B883E0E357295A0E5E3E116E16FE09A5F13931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013359, "uuid": "5bc3fee4-7016-4e2b-8787-666416d29cc6", "value": "3072:fGSfhE5u+KYx33/yvm2CjiwaH0QU8oIHZoCkiXidG/UQMEVrmS:5yZH/YH2aH0QU8oyuCfXR/UQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013359, "uuid": "1533ca33-03bc-42da-83a6-1aed4013e03f", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013359, "uuid": "5b3ccd42-5f0e-4ea0-998a-b25666a6d8ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013359, "uuid": "4a2eaf45-a093-47a0-a5ef-f10bb7d7de4c", "value": "3f95d87b384d8cc5b0689015483cf19f23bf75ae1f75f5043aed44dcf1cf07d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb8d0f2-e8d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683021848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021848, "uuid": "287e726a-207a-4a2e-b0b5-e8976f3b7f3a", "comment": "Malware payload (Amadey)", "value": "bf1059605d6989e1fdcc1c27f79c2ec8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021848, "uuid": "392f4c31-e4a4-4cca-8b12-9f7757fe2e4d", "comment": "Malware payload (Amadey)", "value": "42123a10f2fd1980fa8c5d3b5e37fee902cf921d1d95ab76ab3fb675b6760461", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021848, "uuid": "10943e11-178a-449a-b714-56780ab16431", "comment": "Malware payload (Amadey)", "value": "d6b5393d9721ded4c74dbba578b9dc2ac06e67cf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021848, "uuid": "822fa0d6-7259-4c5f-8686-7eec1c6b12be", "comment": "Malware payload (Amadey)", "value": "35b70acb4e43917a113f41e558aa1014826a1137189dc48aab8d550305ff65ffab348afdfc2978be973471ec67324586", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021848, "uuid": "b62d2c3b-4481-4ce1-bbe7-bb85b9bb3ebd", "value": "T1965533E554E2587B36C330DD92046AAF16DB8085AF0CD7631894F2F9F8989F81F27E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021848, "uuid": "ce31b202-41e0-430d-a83e-0e28c24935f6", "value": "24576:YfBjms1zokWC57tGP6JK1LVA22UGbUkw53BMb6YvbCv9Rzc3D4I57X4BaaTtY8jY:Ems1zxvJK1BA22UGds3qbXvOVu4iX4MF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683021848, "uuid": "b6fd55cc-6af4-45f0-921a-f708dd93ec7a", "value": 1303875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683021848, "uuid": "54bf5d0e-c73e-478e-9a63-11f307dc254b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021848, "uuid": "6caa1ecb-ddc7-4d51-a23a-d498301a6733", "value": "mal.bin.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365aeebd-e923-11ed-b3cf-42010a9c0076", "comment": "Malware payload (a310Logger)", "timestamp": 1683057296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683057296, "uuid": "61f8d510-244f-4628-836a-c718c349c231", "comment": "Malware payload (a310Logger)", "value": "34aa0ca40863c30653a0b6ba10d3daa2", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683057296, "uuid": "4c9dd109-a481-43da-a24e-406ad2639cf8", "comment": "Malware payload (a310Logger)", "value": "427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683057296, "uuid": "2773573d-8cbb-44db-8da2-8930c23dca3b", "comment": "Malware payload (a310Logger)", "value": "c5dbbc9a3f6d537ab49aeb89223810cd67c256f7", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683057296, "uuid": "393068b5-a695-4c54-b84b-4bac4f2e9825", "comment": "Malware payload (a310Logger)", "value": "360aa6605c15018e2846fce3ab0b18e9fca5e8d32054c01bcc3c79fb436bb52025a28178d4865b3e84b7fcba1a692708", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683057296, "uuid": "03772ec0-73d5-482a-95e8-0def07979f9e", "value": "T14E65121A5165CB1BFD7ACBF09078FF8023B1B47390E0D1351FB920C6EAA6F551A9852B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683057296, "uuid": "9b711f29-9b4b-4610-b99a-316bdc8404ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683057296, "uuid": "2c46fd10-d9a0-4675-b8f7-61c9ec9b316d", "value": "24576:O94Lauo2BLrZ6dj7Wd50QKQIsBJXkQsUc/i/Egj87qLom0Y5m6Uy:O/uHrZ6WPKQ5X0QsUN/EgQ7qEmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683057296, "uuid": "3be077e1-9749-46ad-a0f6-a6e887a40fca", "value": 1463296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683057296, "uuid": "480648e2-0f82-4915-9eb1-361718bc3146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683057296, "uuid": "d2991fb1-de3b-4b95-8034-392a2a8c20a1", "value": "Quote 1345 rev.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1ba1bb-e8d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SystemBC)", "timestamp": 1683023726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023726, "uuid": "82450279-6e85-4fc6-9b8b-6929026325dd", "comment": "Malware payload (SystemBC)", "value": "4c09e8e3a1d837f125ea9f9c0c2c5380", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023726, "uuid": "cc75192e-dfd0-4c88-b139-00be93e08e6e", "comment": "Malware payload (SystemBC)", "value": "44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023726, "uuid": "fa3ad9f1-add1-4b37-add2-d2f962963bd2", "comment": "Malware payload (SystemBC)", "value": "0221f489cdef441afad424b5954d07b432d0b8e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023726, "uuid": "61d782e6-42f4-423a-aa93-ef1d01e850c7", "comment": "Malware payload (SystemBC)", "value": "7c6d86d759f4d7ca7c9170410a83d18b10366bcabee3f07b8a7993b4feff3ce5ad3bbab2e7c9cce5c8b1256a754d0df8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023726, "uuid": "570a9159-db5e-46f7-b03a-8644b4ec8be1", "value": "T13772737EA640049EE761C2FAD18FC724D532713B0632E36BA3704B002E16977EB54BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023726, "uuid": "f56504af-59cd-455d-8390-e825149bc475", "value": "9d40dd67bb6cfbfeb09c141d693f05f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023726, "uuid": "ad5f701b-1ef9-45e3-85c4-35d9da97dad1", "value": "384:bHqHNJzn0I71uAstwLW8X4ne7OH0yJLhv812MG6CQ:bHrv5fdv8kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683023726, "uuid": "1c8f0561-ff84-4b37-8f52-6b5594354536", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683023726, "uuid": "4bfa0f9f-24b1-48bc-80de-bfd44e6ff052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023726, "uuid": "8701ed2b-2c9f-4115-a3a4-d9c55c92b872", "value": "4c09e8e3a1d837f125ea9f9c0c2c5380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c18435c-e8f8-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683038891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683038891, "uuid": "f46fd1da-936e-467a-94bd-ee33c963feec", "comment": "Malware payload", "value": "ee23ec0b48e7e9ac720d6febae30a665", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683038891, "uuid": "976339aa-f339-45fa-a1d2-2e5e674d5b88", "comment": "Malware payload", "value": "457fae87d3b9d7440daa1caca819cb37a9707e4d4ec2908eef8a077f3ef46a37", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683038891, "uuid": "21ca430a-e8a5-4187-b0f4-75c16cc23b82", "comment": "Malware payload", "value": "533bd376ec915cda1faafed8162a3a595938d38b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683038891, "uuid": "d7566dcc-37e7-4ee7-9e99-3b8d6781bc20", "comment": "Malware payload", "value": "5fada49d0b2c2f396b1ba446f3b1146d1f88ffe91d10248288ece70fdaed9a476241a7c0c155c8145e80f7b991d09c11", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683038891, "uuid": "a68ce792-0759-467f-a79d-bd9691ef3ceb", "value": "T1D9B109281A663DFC46062E00646D3ABFB890E4F4FC9CDB01D25CFAD58536B94EC129ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683038891, "uuid": "02156b1b-89e9-43d0-a07d-4beb7c4fa96c", "value": "96:Y3hUiqNjzrRt2/fLCgUx9wo8VH0Qb7C6Qef9WMV5HZctlKVX1aH54:YxUiqFzrRE/fL/CCH0C7CefdLoUDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683038891, "uuid": "5a8f0c5e-adfd-4be8-87ca-9ac179b1c292", "value": 5384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683038891, "uuid": "848d81fa-1f28-417d-a7e0-0d9a173f4d5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683038891, "uuid": "e82af6d1-b634-4b7c-8d7a-a32dc4cc731c", "value": "reviewProfile.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453193ed-e8ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683005781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005781, "uuid": "fe9d9676-4436-4834-8f99-40041c337cd0", "comment": "Malware payload (AsyncRAT)", "value": "207755332e7de0ac43bce9ec59534e30", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005781, "uuid": "1ac562a7-d7ea-40b0-9ab6-bbe59aa222bb", "comment": "Malware payload (AsyncRAT)", "value": "458bacf7b28381813ab395db163843e71f62a830db1e1274178c14d91d435ca6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005781, "uuid": "cb2e6563-142c-47e9-98d3-8c5599d7f3db", "comment": "Malware payload (AsyncRAT)", "value": "ea8b222d0c09a704e0b84a97ed480be4d2360d38", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005781, "uuid": "a21cdf5f-6097-456a-bdeb-d6d701b51751", "comment": "Malware payload (AsyncRAT)", "value": "97c5e64689ce77636b9fd8825a29253774e52222d52994a93ea2cbc4f10f5928605784d196c94919edd77cd5406acff4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005781, "uuid": "1a8f7dcf-5326-425c-9441-b45b6d698302", "value": "T1BDC523B964B1B95EF6E8023A8E401C36EBFC6705CBAD34CB8E544912F98301C5FE7924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005781, "uuid": "daa0c1f7-3570-4a11-82c7-6c45027e08b7", "value": "12288:u1F1xdEl2aB9GfUh2m3Nx+3ezaOkkTJTIVF/K2EKL9EVQa:AF1xul2aB9RhBb+UjT+VJaIOVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683005781, "uuid": "7c2b39bc-08b3-4606-a0b2-78a012e98d08", "value": 2524880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683005781, "uuid": "a8812997-f941-47a5-bc63-4140fd1b2571", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005781, "uuid": "501357d9-c2e0-4119-886e-e43db81c85f1", "value": "Ta.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e43666d-e8e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683032559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032559, "uuid": "953bbeaa-6cf5-4b7e-b2b8-cd0954cddd25", "comment": "Malware payload (Vidar)", "value": "2d1952dc0776774b3d9366412a44de4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032559, "uuid": "278fe726-f06c-47df-b2c7-eaf1a3cb8adf", "comment": "Malware payload (Vidar)", "value": "45ac86c9c4501113f3912d513270d66a5c7bf5a6edb0a89fbb23965271b1049f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032559, "uuid": "f890920f-076f-47bf-a507-7781ebc4a8ac", "comment": "Malware payload (Vidar)", "value": "7514b009e40d87f4b16d87c9f7dc35dcfe3239c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032559, "uuid": "0abd4b54-02ab-4f8b-8287-405268773485", "comment": "Malware payload (Vidar)", "value": "e3ef7dcf5c3e04bc5cafdafcd951d7db102c7e00dc7ed118aa181f8fffbd3fcec825a6cbf695c9fc00902a314d06b171", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032559, "uuid": "d35e6ca7-8d31-4124-8b2d-40bf0638a933", "value": "T1D475E117E284D022E5B222FA4AB9516879296D60171981CB71C47FFDBF765FEAC30323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032559, "uuid": "3fbad32a-09ad-41aa-83e2-12d43f1a823b", "value": "5dbd4b53304dc2aae0c97e1295bb4e1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032559, "uuid": "880e9e76-0906-4ca1-8491-735154379974", "value": "49152:FNwP4UmS2Wa0NwUKx6Zke9JlFRVtrq5cj0d:3wQrS2WQUKx6Zk0p2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683032559, "uuid": "b9b9ad56-4c00-4d1c-8b12-ef09fe154df0", "value": 1629088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683032559, "uuid": "1e036a3d-c45f-4982-a5b2-5878dcdd55a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032559, "uuid": "4b20602c-b5d6-4b71-848e-ab748013e6d8", "value": "2d1952dc0776774b3d9366412a44de4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8249b997-e8e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683028647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028647, "uuid": "77b30925-741a-44d2-92cd-7010204e8096", "comment": "Malware payload (RedLineStealer)", "value": "bc59b7084d6bc5398c8edcf790449802", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028647, "uuid": "00c87dbb-6788-43a8-95ae-e676416e6285", "comment": "Malware payload (RedLineStealer)", "value": "493a19faeacd4d8d427b79423c3b0e5bee8d2ae638e7dc7cc7a3d4f38fc523aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028647, "uuid": "cac5617c-8e46-4a01-a735-0117b3eb31c3", "comment": "Malware payload (RedLineStealer)", "value": "560226b14e8f6c122828c60b6deadd577553f8b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028647, "uuid": "6c318043-2c7c-4537-9f55-28ab7453d5de", "comment": "Malware payload (RedLineStealer)", "value": "2b9f5f587e859866b06c724c1ed3b03c53f758a1bd936dc3f758c34cdca0fee64e9a0d33ccf3f53c50be69b1c620858f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028647, "uuid": "f76d7b2b-1a07-41a6-9371-6d1c78752ce2", "value": "T18465239373E84062D8B23BF066F661471F31BDEA6B2482FB2685598750722D1F372763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028647, "uuid": "b36d5f92-2336-4b14-8ff3-b40590f1f3f4", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028647, "uuid": "9f060ef1-aafc-459a-bf60-81fa3a3033df", "value": "24576:Ny77TOO0uB0Ddntno7u2Dbl+Z12v4WWCUeq17R8TUU0bYRm9mQV:o7/OVDVtoR+Zkv1ee+R8Zmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683028647, "uuid": "4cd51cf6-3803-4708-b1d6-e194ffc8389e", "value": 1517056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683028647, "uuid": "b87a23ed-7c85-4af2-9116-07a62eafa34e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028647, "uuid": "fb8500d5-fe7c-4790-8b86-b9f39fb1df6b", "value": "bc59b7084d6bc5398c8edcf790449802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a827d1-e8fa-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683039732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683039732, "uuid": "cf01c8f9-e629-4ac0-83b1-1e17a6c7e45e", "comment": "Malware payload", "value": "760e4cc6b02dae0c2700b33f9627c9da", "object_relation": "md5", "Tag": [ { "name": "obama259", "colour": "#8086B6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683039732, "uuid": "537c50e3-6869-4ec2-8979-3e486f2ed3f4", "comment": "Malware payload", "value": "49939225440e534f215030d8616b0b4a73c908cdfc3c9fd25cf6e876073bf44d", "object_relation": "sha256", "Tag": [ { "name": "obama259", "colour": "#8086B6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683039732, "uuid": "616c5ba5-f88f-4a0a-84bf-410fa6416471", "comment": "Malware payload", "value": "910d9899d69d9b2813c12e3ff2574e963375f5c8", "object_relation": "sha1", "Tag": [ { "name": "obama259", "colour": "#8086B6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683039732, "uuid": "2e45c33f-bf87-4285-9209-6efaacb3449d", "comment": "Malware payload", "value": "e886aa5f3791af8c69cb85eea34d5e6ea1276b5618fd94ae6ac6c01cf762c82f1f88b4911d1852d6c824624f520572da", "object_relation": "sha3-384", "Tag": [ { "name": "obama259", "colour": "#8086B6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683039732, "uuid": "3a2e8844-1597-4add-b29d-e1dfb0ba0351", "value": "T1C8030B5B63800339556201256A0E6BD9F7B098386B26D7B8A44EC16D3352D38E7FF9FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683039732, "uuid": "d9506b8c-bf47-4f5c-85de-06da9854d71d", "value": "768:Ep61Sh/d1Td/HXwIe61mcXlllhkeC2Uy9Slty/3NlhkeC9q:UlwI9mcHlDCo3NlDC9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683039732, "uuid": "784aba21-f50c-4761-a425-74409f5adeec", "value": 38384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683039732, "uuid": "fb3ba634-889f-4cc8-ac83-366b20ea735c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683039732, "uuid": "ead23cd6-db2d-424a-94be-e1d6478ac3a8", "value": "Contract_B264_May2.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a529b6-e8ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683006176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006176, "uuid": "aec0179b-d5c4-4914-9ebd-14faf0db5ae1", "comment": "Malware payload (SnakeKeylogger)", "value": "3fb2019f03cd1972350406aa10e89961", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006176, "uuid": "e2401582-e81d-46c5-9b5c-77b9ee35df32", "comment": "Malware payload (SnakeKeylogger)", "value": "4a1a8fa3ff7b0bf9c376592e6335c82e99536853c0d274bce1a8443335a2cdde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006176, "uuid": "05017c19-96de-42c2-ac2f-201429cd5798", "comment": "Malware payload (SnakeKeylogger)", "value": "c68d0d75e6b80c9bfc5208d2f0abe6cfdfa5257f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006176, "uuid": "350d5fa0-c5a6-4e65-867f-fc40cfd6b9d0", "comment": "Malware payload (SnakeKeylogger)", "value": "d28012bcb733c6d5be5ff855d923dacc5bf68fbea73b98aecd4e8196b2f3eb7359a450da68d0bb442df25fb21e56e96a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006176, "uuid": "399716d2-815c-4586-8149-3f03a6321515", "value": "T120153CD1A050C89AFD5B46B1EC2AF5B024E6BD9DD4E4410E16AD7F16B6F3342209FE0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006176, "uuid": "f2213986-0e60-4bac-8137-2a4ca1dae7cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006176, "uuid": "d2d87f48-82ce-4afe-9bd7-5a28bf2498e4", "value": "12288:Cw0d2qj8Jz2q6InYwN4ZCM5WdK/ypQU46cyL+l:ZAdj8JKg6C+Wd4qp46cyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683006176, "uuid": "fa075462-a208-42e2-8218-7e1345b16b98", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683006176, "uuid": "d8f252d8-f56a-4dc6-8487-3051ae59bee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006176, "uuid": "e8c9ce90-dfe0-4f45-8529-90802e75e8a3", "value": "ORDER#102718.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815414ef-e8d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683022632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022632, "uuid": "6692e281-04e3-42af-88bc-80ea1e28395c", "comment": "Malware payload (Formbook)", "value": "266e3ca963a3bbae9dff800d7f22e204", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022632, "uuid": "0f7df6fa-7bd5-4b5b-be13-0b51f0fcf833", "comment": "Malware payload (Formbook)", "value": "4ad4c824651649fca236f7bab751aaa00ba24725a53c6f0700d3b729507a6a8b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022632, "uuid": "ef6ea76d-6952-442d-b517-6067e7474384", "comment": "Malware payload (Formbook)", "value": "b4e87d7a764794b98acae5ec54e018ecad47995c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022632, "uuid": "f5952b69-01e0-4e87-9fd0-9ca4ddcce584", "comment": "Malware payload (Formbook)", "value": "b7c061432b2c1c517a82c91e10575b72c8324a46ee49a8a97daceeec1b07ff702d8be4ba35eaeba74d9f40960854a398", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022632, "uuid": "88fc0cc2-2434-4e9f-8420-4aaaf0ace69e", "value": "T13445C00222B4CF26FD398BF00465FA4023F1BC7754E5D5682EBA70D9DAB6F010E65A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022632, "uuid": "3fc2d34a-3bf5-41e0-8d65-a38ede2c5c75", "value": "12288:SZZ2iNvj2vIUMgaw+UzS/soUHBaqLcKc8V5:C1tjCTa8S/2HkqL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683022632, "uuid": "3585c293-cfce-4d7c-91bf-450a1ee2a458", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683022632, "uuid": "a4fed10a-06c6-424f-a853-34dee9965638", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022632, "uuid": "7fbb699b-9309-4000-8e07-49c75b95295b", "value": "DBS.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f17d220-e8ae-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1683007006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683007006, "uuid": "5f195f22-f492-4f04-bff7-193e01752f6e", "comment": "Malware payload (ModiLoader)", "value": "8983a4b99c0e4d0f73ff5d266dd67530", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683007006, "uuid": "85e85d6b-60b9-4cd1-b3b7-f0f67de0334f", "comment": "Malware payload (ModiLoader)", "value": "4d8f8def81704bbd8e31779ecb3b8d25f0d8bc0d2a3dbd55c1f18217dd1ecf5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683007006, "uuid": "38dfe96e-c9f0-4392-8ed0-12f531ece771", "comment": "Malware payload (ModiLoader)", "value": "aeea9b73d6e3da69bc813f8631da539bb68e5a45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683007006, "uuid": "7c249acf-e5f6-459f-afbf-5bebbde315d6", "comment": "Malware payload (ModiLoader)", "value": "1f6b4d1bd033dcd9f2ea217e9e7e735e29245613810c922c504f74e8b445355ee7a12a890ba2b19e0aec07613788454f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683007006, "uuid": "7a80be9a-9d98-4d4e-a77b-e63bbdc94c9e", "value": "T11F45D062A6F14437D16716B9DC17A3A5693ABF602E296849B7E83F0CDF3B1403C1D263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683007006, "uuid": "71657e64-f6ef-4799-9cab-58d2d43e4012", "value": "3dfe0ecd898283287d5f7b650743b9fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683007006, "uuid": "57a08afb-b3f6-4709-84ca-8c4c5c8551c3", "value": "12288:NtN+qFRD49GYo3EU9Aj4aNJqASiMOUS+6IjfG80A5ZXYsLgzCROfekqQz/sYgVgw:NLX89GZ9Na2lO0Zf1/VgOk1zkfVc1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683007006, "uuid": "65badf2a-a06b-4d86-8b53-b64955489f0a", "value": 1186039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683007006, "uuid": "4cca22df-1f71-4b07-99e3-ea04d78452bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683007006, "uuid": "7ecba178-6e1f-40ae-8267-814815014e7b", "value": "swift103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4929d043-e921-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683056468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683056468, "uuid": "89b7972c-b23e-4862-9fc8-a621513c6e1a", "comment": "Malware payload (Formbook)", "value": "5bd5428d85868bdcdde85376b59f6bcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683056468, "uuid": "3544a011-942f-4d82-b227-44ffa6e9e288", "comment": "Malware payload (Formbook)", "value": "4dce4459e53e569a20c892efadb0424a4698bf5f67d16e7b73668dc2e172663e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683056468, "uuid": "43d702e7-9749-4e9d-80f4-fc27793cb2bb", "comment": "Malware payload (Formbook)", "value": "4bb3b3e12d29742722c9d56b76140b32f6089352", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683056468, "uuid": "fc565ef8-ced5-46ba-b53d-1761e1669132", "comment": "Malware payload (Formbook)", "value": "3e8eb357a05275d2f6cfb7318eaf77383fc08786320b5f101e3a788359c878da2215896e9e1d360216f36fe775ff2f90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683056468, "uuid": "15d9696e-dbbb-4dba-9a1d-474b7bcaf45b", "value": "T198D4E01251B5CF4AFD39DBF04464FF8467F1B1B7A4E4E1211EB624CADAA9F010A4C62B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683056468, "uuid": "36f3dbf1-b77e-4f05-b1d8-1e712c60554d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683056468, "uuid": "b40d4e6e-e2e8-42af-8f55-d05fcc115bb4", "value": "12288:7zmMJWjx0+6RY+kgTtMNBixK9J1rytQ5+ck:nmMJWB6RrTtMfiA/uy+ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683056468, "uuid": "de91bc25-2ff8-4f4f-92a9-3a9c70b49b81", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683056468, "uuid": "d3625b53-6cb2-4bf5-b882-1d8f65c6d8a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683056468, "uuid": "6abe3ac9-e1a1-40a4-8ebe-90306b1f8de6", "value": "New purchase order teams.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a4ea5a-e8ca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SystemBC)", "timestamp": 1683019306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019306, "uuid": "7c9ed8fc-5753-444a-9e75-e963d38d694d", "comment": "Malware payload (SystemBC)", "value": "c1631959fd2282fc1f4d32ad3799a895", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019306, "uuid": "a22395f8-5023-42d8-bb14-d52c0392e46f", "comment": "Malware payload (SystemBC)", "value": "4de65c2ba577ee5a6b05493239ca386700a9864e5b01f7ebd451b6c05c833f59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019306, "uuid": "cafb18a7-eb8d-4e43-8af4-5aa4a8082293", "comment": "Malware payload (SystemBC)", "value": "e4ddc8c538c3a30f8e0a09299f685a58c0ef6df8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019306, "uuid": "0b7cd17a-0600-452a-8993-472a6016e4d7", "comment": "Malware payload (SystemBC)", "value": "15d3f15002df1f4d844c1cd3cb6ab315d7b24c2c5fa95648a051f9e3697968365b0ab42c7435596534e9ac926029cb48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019306, "uuid": "89d67b19-5dc9-4c9f-af29-27a834b2d0d8", "value": "T1DDF10722BA9151A3C337E6FE7B4F9361E4BF59725330A409CFB11D1028758B3DB66609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019306, "uuid": "8565c696-2915-4dfb-983b-ede48ddac54c", "value": "c43eeea4eb37b541724563a3273bc88b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019306, "uuid": "c23fab3f-0855-442b-9366-da8fb2b4065d", "value": "96:PNoCMDnHFBkGNutaR/3Mnh/MM4odWLqhZAoUyLh/b9U/lpo2i4gwnpw:FoTH7kGsaBc/ZbdNdhEi4Ppw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019306, "uuid": "de96ff05-4fec-4706-8a88-4373fc5b8705", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019306, "uuid": "226966e8-376e-42e3-a2cb-c83b9c7d05be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019306, "uuid": "e2f539c1-dbf3-43e6-b9f4-33afe0e6d17b", "value": "c1631959fd2282fc1f4d32ad3799a895.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2443739c-e8de-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683027630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027630, "uuid": "ee1f5f98-ec52-4523-aaa8-ba93c682b788", "comment": "Malware payload (AgentTesla)", "value": "b071b61168d680f88f2d2c31114891a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027630, "uuid": "cc1cd8a0-4d0a-4444-b261-c3e1b46161ef", "comment": "Malware payload (AgentTesla)", "value": "4e07c4b00b345ceb00f859475df5179802164912527f8feae6820a8ef50bb15f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027630, "uuid": "53bebd8d-3b14-4583-9559-f7855958e197", "comment": "Malware payload (AgentTesla)", "value": "8c5eb8db5890b1b5084bc16d53375e96da87d0af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027630, "uuid": "98c89576-a20c-4b93-acff-f1379e3342a0", "comment": "Malware payload (AgentTesla)", "value": "8b7a619ce50ecb16011f803303c87a4df7a98f8089417b488a858f5cd3d4a8b4799a2c406db25adfd923968f816b9f3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027630, "uuid": "3d26a7e2-e3d1-43d7-9c2e-66c83d068e4d", "value": "T18F6412ADB390D8B3F467C77256B8D67D9FCAC41940585A4F23808D487CA8A93AF0D7E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027630, "uuid": "0f0adae7-a0d4-48c6-8877-0f3bc5ae358b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027630, "uuid": "92b98320-1e56-426e-9682-0418d411fdb0", "value": "6144:PYa69ZZLnjswLS28OgyNFD+knPABtqrfeTfNHQVGF+w1EprKBk:PYfrLnj3SJOg24knPABtHTfNBst5Ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027630, "uuid": "397f78f6-0440-45a6-9f7a-1dbb3098960a", "value": 323332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027630, "uuid": "bae8c630-4bb7-4f19-acb6-6ca2cd7092ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027630, "uuid": "d091c732-f26a-4171-9536-51864bc93f86", "value": "A 0083-as nyomtatv\u00e1ny online al\u00e1\u00edr\u00e1sa_docz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671510af-e8cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (IcarusStealer)", "timestamp": 1683020011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020011, "uuid": "eb37d792-c00f-462e-ac2e-df0c65992d20", "comment": "Malware payload (IcarusStealer)", "value": "01e031d7c05c245ecff24a536b5005d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcarusStealer", "colour": "#E74B21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020011, "uuid": "a11d010c-225f-4607-ac5d-febb972aa07e", "comment": "Malware payload (IcarusStealer)", "value": "4ec76c6c6b2b93873c53cbf094d1b4ad911e9615947039d8735e3e72e9b34ca2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcarusStealer", "colour": "#E74B21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020011, "uuid": "2179813f-dc94-4564-bbd5-6115ef797ccf", "comment": "Malware payload (IcarusStealer)", "value": "329e480e96472c35044d13713475ebeb7da91891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcarusStealer", "colour": "#E74B21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020011, "uuid": "ad7568b5-e721-4d57-b03e-fd95c3e7e801", "comment": "Malware payload (IcarusStealer)", "value": "726d171dd1c15ffed8ed79a8a36857f3198011dabdcce0f8e1f227c630c783d7d0348ffc6faa85a0a90cb6141e5613d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcarusStealer", "colour": "#E74B21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020011, "uuid": "d1303472-0524-49a1-be29-f7ca155bf6de", "value": "T1ED351202BBC188B2C46319325A7A67216D3CB9301F79CFCB67E45A6DDE315C0DA317A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020011, "uuid": "e3aaac6e-1af8-4841-9294-6b80a134c204", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020011, "uuid": "1eaa692d-32db-4a29-8840-b73f9c27e275", "value": "24576:STbBv5rUg09NfbZYkgcGBslupFKUEBCjDWhGapW:0BRe1bZYKGOl+FKUoCjDW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683020011, "uuid": "2247745f-a336-42f1-922c-f3d1a779ffb3", "value": 1145930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683020011, "uuid": "9afe3e41-99e5-4715-86ca-6c267ae33fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020011, "uuid": "01bd4e9d-bd97-48cf-93d2-8076c5b3a44b", "value": "01e031d7c05c245ecff24a536b5005d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04640feb-e8cf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LaplasClipper)", "timestamp": 1683021134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021134, "uuid": "cfc82fa8-980f-490e-881e-dd2a9a84237f", "comment": "Malware payload (LaplasClipper)", "value": "58ebee007754add007def09afff40098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021134, "uuid": "55ae68fd-7a06-408b-b413-da2ee6ef2f9d", "comment": "Malware payload (LaplasClipper)", "value": "4f2791af1936bb9dce9d865e6c7fef98e2931c7dc2a93955ee22de4dfb03ff5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021134, "uuid": "0cd0d923-9df8-4c3f-b5a5-c4a267ed8c90", "comment": "Malware payload (LaplasClipper)", "value": "99b54639bc099bd77c050f3d25d29d5b7948d22c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021134, "uuid": "7b1942f1-e020-466f-ac33-a1923af88f1c", "comment": "Malware payload (LaplasClipper)", "value": "7849022c1b6032b70eda73f2632d838435ac5cbbd63d6722c5ff741710267847e66704511042bff0a8a7178a827f0ff5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021134, "uuid": "a13c4b4e-3fd3-4ed8-9eb4-f274f6d6f238", "value": "T10CD53300BBD598B1D2331D711B36AB10567EBDA057B4CEDB8390661CDD329C0DE35BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021134, "uuid": "79a0fd5c-c543-4fdc-be99-f23651148eb3", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021134, "uuid": "cf9ff516-1f64-41b5-a144-92ea5e28a7c7", "value": "49152:IBJUv6J2zcRCQyUrlWU91Z1g8aCB/pv/R/QnvAw+RW56Pk3/:yo32f79xcsJJQnow+M683/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683021134, "uuid": "d4e68c41-fd07-45c0-aee5-ae3a5509a545", "value": 2801046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683021134, "uuid": "5086c673-ed49-46ab-960f-1ff83526671a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021134, "uuid": "81f1b308-3abb-4bc8-a7df-15b89feebda8", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f1f4e8-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683013401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013401, "uuid": "c17a5ce4-f7b9-440d-a308-cb57d2b0e081", "comment": "Malware payload (GuLoader)", "value": "86f880208b40e415a0cead09f6fa21da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013401, "uuid": "fc3c9de9-7a2f-4e15-8863-5f9d392f5a08", "comment": "Malware payload (GuLoader)", "value": "4f48d5f67bf8f4a9c1d79125e2ce1198ab781bbf4c74eade2bd5a23b48dadfe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013401, "uuid": "70cd455d-4666-4b79-af7e-7a928fe65335", "comment": "Malware payload (GuLoader)", "value": "b583f6866ad25c4fcc6b17bcc3e114b5dd3b2e62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013401, "uuid": "973d54d9-a579-4700-8b95-2df300526d40", "comment": "Malware payload (GuLoader)", "value": "af68e7be3e515fb5940f643968230934fef3951fd8ed1ddbfd71c8cf9087fe03e6c55bcf779c08b4a78aead25028cac9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013401, "uuid": "0882690d-ad9f-4306-b42b-d95680b0a6fd", "value": "T128B42391EB40A873ED67567014A52E6A1FDAB921AD541E0707406EFC3D23FC18E2F736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013401, "uuid": "79201c4a-874e-438e-9dd0-d38f2f7a9855", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013401, "uuid": "aea48b88-3571-4f95-b1e7-e578e8ea522f", "value": "12288:Nbbtyh0jsOZfZnLeYIUOwdl3RDrrhCJgkcQ8KYMH:Nb5yhiT9cvwdl3VygDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013401, "uuid": "aaecd9df-3de6-4ba2-ac49-41b127621534", "value": 507344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013401, "uuid": "dfa46186-b529-4131-87cf-e47f21e66336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013401, "uuid": "d2b267bf-a7f0-4b62-be64-4ed8e2b17d5e", "value": "PO_042023,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e7fe05-e8b7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683010836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010836, "uuid": "7de4a10c-3cb9-42db-977a-f07c1bbeb0ef", "comment": "Malware payload (AgentTesla)", "value": "dab8ed373763eb8fb9a60a52386d446e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010836, "uuid": "1c1ac535-8336-4c65-a7f5-959a5e815ea9", "comment": "Malware payload (AgentTesla)", "value": "518f005ddf764a1dd2830079e2734fb3e30b590e00627a71bac4c3fe2f88446f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010836, "uuid": "95352c83-0be4-403b-b24a-75ae82369036", "comment": "Malware payload (AgentTesla)", "value": "5e9f27998a9355155a74d8eb489dcbe330596d40", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010836, "uuid": "879604d6-b671-44a4-949f-0623c90058c3", "comment": "Malware payload (AgentTesla)", "value": "7de515b3701bfd435a76fd274070cd31ec2efc65b244322545bbf43aaeab736fc9d997c91e915687cd774ea78e8ffa54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683010836, "uuid": "89f31ab2-2979-4dc1-b439-3c628f8e54b7", "value": "T11DC423BC5E094A312D3DDF6B2DB272984E185BB31754465E382071EFA14E9CF7AB7A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683010836, "uuid": "47d5e939-fc3d-4f8b-8f43-76cafa241480", "value": "12288:h/EYCYjC7hmVPkC6PyqdejHTTsvtLj2zmYHxgXZyLwQGnFCw:hM+DZkUe2zjzmOxgl5nkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683010836, "uuid": "a8e7d468-1d7b-4467-b7c9-3bff82aedda1", "value": 544899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683010836, "uuid": "1bfe989a-6f42-41b5-b123-f27bd2126175", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683010836, "uuid": "b3e6a9ae-54b1-4cf9-af1a-606c4a8f306b", "value": "Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e44c15-e8de-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683027658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027658, "uuid": "05a1bf3d-5973-46c2-991c-c5fdaf51ed55", "comment": "Malware payload (GuLoader)", "value": "5c50f3aebb0b53a4b0f4d91236ee9209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027658, "uuid": "cbd5e7d1-157e-4a75-bf7c-1d7dd8fbc8ed", "comment": "Malware payload (GuLoader)", "value": "51b8aca1622a4a112aa586d6f25d2dd138de8bd6960fe7dfbab578ab5aebcd92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027658, "uuid": "d6abfc06-89fd-4b1b-888f-47ba9b1daf47", "comment": "Malware payload (GuLoader)", "value": "90ad259fc4f277396a9e79d52a3b995ccd9b080d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027658, "uuid": "5630496c-6b81-4c71-8e00-01d2ae114c96", "comment": "Malware payload (GuLoader)", "value": "0a2867c1771e818e67382abe4784fa7e9b94c1a869c1b218d22245aeb6ce552d25fbe22210e27389a0328a4c683997df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027658, "uuid": "fb09d935-48d7-4152-b386-be38fa8281b9", "value": "T1CF94F1423554A0AFD82641329167BE279B53ACF45F905FF73B977B1E5822282E33C22D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027658, "uuid": "9564c20f-14c2-41c5-aa7d-59be0cccf6c1", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027658, "uuid": "e574a7de-db2d-44b4-bc75-ab844e5ddf1f", "value": "12288:T4FAe+jtbt1JcA8V6icnPrxj3VpVcpO3EG6wC/:CAe+jtbt1JcA8cnPVVpGs9w/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027658, "uuid": "bc2d3ce7-1d0c-4923-a05e-c65ad50cb3b5", "value": 424280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027658, "uuid": "cb4fd0cd-3868-4c31-9e36-5e6bb3959812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027658, "uuid": "4a83d4b9-a0e7-44af-a42b-a162b5182123", "value": "New Order - PSFK23TT002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93174b8d-e882-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682988302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682988302, "uuid": "3dc065ba-7830-407c-9d0c-569ab1a7b818", "comment": "Malware payload", "value": "11c6d32eb149260071f8df2313b47b35", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682988302, "uuid": "b5323f25-bfbe-45e6-80d0-a1b326c5f7f5", "comment": "Malware payload", "value": "51e81f26e93788c213139654365a5a5723a65b6c08662c68b38b1825338b8651", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682988302, "uuid": "bb199ce3-c354-4445-b8b4-10357f0ecca7", "comment": "Malware payload", "value": "c38d6575065211c3c70499226bde3efa086d8fd1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682988302, "uuid": "5f1e12a1-41f8-4cb9-bc2c-26075ae16a19", "comment": "Malware payload", "value": "e37ba915089eb5422db47bda3a9c3143655a5673eec97ba152457dbc1fb2850c31cd601ed71c24e54c5d14895a8ccb1d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682988302, "uuid": "9f98d7bc-b9a4-426b-a714-98ef7f3ce15e", "value": "T1B7338C84D8301CA877A8B3F5DD97B57935F4B8D53FC1F00E64AAA5D018EA28AD8D407E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682988302, "uuid": "ad9638ac-38e5-4691-b479-5b9c5f857ddb", "value": "768:w4LO7YBQ7GHbpDI4o7ip3Ap7hvEB8gPsStfxZnQx1Z9AgGXLYKi:JYOaGHbpUc3OMKgPsStfHXLYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682988302, "uuid": "6672d2e3-f5c4-4687-a092-f33104d71f5b", "value": 52035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682988302, "uuid": "f587d08e-0fcb-40df-853a-d0fe11d30983", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682988302, "uuid": "6dc6595c-17d6-4ea5-a6a2-645a7c339b28", "value": "Invoice-DocuSign-May01-2023.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd6237d-e8b9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Phobos)", "timestamp": 1683011805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011805, "uuid": "a4a9d180-44d1-45f9-aa37-fba2ca455459", "comment": "Malware payload (Phobos)", "value": "4165a3dba3c7ac26b225f8623f70ebaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011805, "uuid": "05cfba48-8c70-42c5-a5f4-8d09846b7efd", "comment": "Malware payload (Phobos)", "value": "523d97331fcef84ff767dbb01836766d8b1be9bbeb3d76e9fda3a02ad46fd976", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011805, "uuid": "73cfe1a6-9590-4df2-a06f-d3843c15eae8", "comment": "Malware payload (Phobos)", "value": "587df43d63da7dfd726a4bb8f39877647cc07da0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011805, "uuid": "2b01c026-d44a-47f3-bf77-9b68a4cadd55", "comment": "Malware payload (Phobos)", "value": "bcc934ebac4406db0445129f9f899e1e4ba26bf922605da143f516105bbdb2c5cb3536a5a41170edd7e53c5eb6e878a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011805, "uuid": "69b77aca-7f25-40f3-89b3-bda00ac9c84e", "value": "T12B3402C2CE34A823D24DA273441E8FB0F357A71C9234DB36B4A5E0E476787D5714AA2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011805, "uuid": "9b70b0dd-fe97-48f3-a274-e0ac9da4d114", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011805, "uuid": "3b2f7d9b-52af-4451-8c06-5f2dff7a178e", "value": "6144:qb/A0SeQu0hL2cyBt2iOjese1HSCRhECwt6:q8D5P2ICsDCRhQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683011805, "uuid": "3a896674-c76e-4893-b1b2-0303d3d67cf8", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683011805, "uuid": "c6fd10bc-5383-4e66-aae3-64fb4b37eb62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011805, "uuid": "85fec262-041d-489e-9fd5-bd5e5397e43a", "value": "rundll64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af262db-e8cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683019964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019964, "uuid": "6cd4e449-2729-4ea4-9565-6506e67735a0", "comment": "Malware payload (RedLineStealer)", "value": "60163e3917d65d45489ae33b53cb2aaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019964, "uuid": "88b19d6a-d9e1-41c1-bcda-edbf5e31444b", "comment": "Malware payload (RedLineStealer)", "value": "53d58b1a7b4419209540e98dfc1b7bfd6377321daaeadc4ab9caddb3bfa9f422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019964, "uuid": "90213e77-7b23-435f-becd-1d5372e20b08", "comment": "Malware payload (RedLineStealer)", "value": "b727ca558160de74a9c262ae597b6a7f0fb8b888", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019964, "uuid": "72b25992-d2c0-40f7-b080-59f4dd2ba605", "comment": "Malware payload (RedLineStealer)", "value": "5a8129fc64e7a4704be4b2a748ec4aa52413601f7512de7009d44a1a873cece037c9296beae602d575a6c2054dcba286", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019964, "uuid": "27b2b27f-b6c2-4cc2-bf87-80232218891c", "value": "T1A105128266E8C033DCF91BB468FB13830637BDD38B2D42DF234A599E1D71685A5747A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019964, "uuid": "ca5a1513-1f61-4d5e-93d4-74dd9edf1a5b", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019964, "uuid": "cb12986d-5df0-44a2-9e18-caa2333a1a5f", "value": "12288:qy90TRQZtMQErLiTU03yctcT/q5IpUpABQ8QBGF6Wt6eJ8qIxl6gTQlxMQ:qygQZSQEPsRJOgUF6I6Y8rsgTmeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019964, "uuid": "b6889d83-4ca6-4210-8975-5e2d03dc49d0", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019964, "uuid": "96dd278e-7fb5-4027-a8f5-55470cf233a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019964, "uuid": "3d191f30-9211-40ff-a879-d87b2b607748", "value": "60163e3917d65d45489ae33b53cb2aaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dca5437-e8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683017795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683017795, "uuid": "127737ba-4729-4f97-900a-da8d93b90cc9", "comment": "Malware payload (Vidar)", "value": "59b3d4ac81baf5dad7e19cfe6aea9736", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683017795, "uuid": "cd11a5c0-e5b8-481d-94f8-e37a00c496ad", "comment": "Malware payload (Vidar)", "value": "541846929221612b779740077564c12cb5e386eaf0ecd895b8d8ee7008ae0fbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683017795, "uuid": "e9bfc4de-1113-4448-b349-a9c7c51b3f99", "comment": "Malware payload (Vidar)", "value": "cdcf474c377b4c7e14ed97bd29958837b09d5274", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683017795, "uuid": "dc27666e-87a7-4b22-bab8-e4621d29507d", "comment": "Malware payload (Vidar)", "value": "6386267746d2bb979d641ed6deec027a11418e84f9bdaea7c08e0037cfff69b6ced3647851698db2e3d5124e2b5822a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683017795, "uuid": "6c7e8924-1570-4ba2-a069-f31204a2353e", "value": "T17084BE1272F16C74F32656324E2A86E8671EFCA2BF153AE727146A1F0971DF2C172742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683017795, "uuid": "bee4be60-d496-4118-88cb-f157161b52aa", "value": "5e64b31f8e5697ceea07ff3f5dcea4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683017795, "uuid": "3dd6a457-1a93-4024-b5f6-171885f61cad", "value": "6144:cqlxiLrpqobVDQs3B2cjKkpSXxqCH3TSlGEsTIais1PqOO:cqlELFqQ9ocEqCH3LT/VPNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683017795, "uuid": "435e8624-cc11-4b30-adf1-9ab22d2f5c64", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683017795, "uuid": "0ed74dbf-e70e-4832-a0e8-64f510d904b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683017795, "uuid": "30ff88a1-2f08-4a0d-949b-2fc70b69d483", "value": "59b3d4ac81baf5dad7e19cfe6aea9736", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988f34f4-e8b9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683011934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011934, "uuid": "51c09a2a-6262-41d0-95b6-cf108b45373e", "comment": "Malware payload", "value": "1fbe8957428d279a3e4bad4e5d2e55e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011934, "uuid": "1598660e-7549-4c49-a2dd-fe64e540cd34", "comment": "Malware payload", "value": "546a439160f37f428820c787aa818b08ec334c8b27b631909a6eb729947ae102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011934, "uuid": "8e64604b-a947-4e16-866c-3b6e293d2451", "comment": "Malware payload", "value": "11b75a5370074ef6e153ccd85e4c521b29e2777b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011934, "uuid": "dce742a0-1e1f-423d-9a41-8b5333e47a53", "comment": "Malware payload", "value": "0c1336d0467e389349a87a5a74eda6bd82762b3f147e37f7d2ca7ea98aa62eec77bf98e10942c39cfc66fad5cf55197d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011934, "uuid": "3af71ca8-c4cf-4330-8999-f02a9d570eef", "value": "T171E4F43C19BDE22BD1B8C6A58FD18427F390A46B3115EEE5ACD747918326E1235C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011934, "uuid": "caf5d5d4-4aad-44d7-ad2a-2d042ba9563d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011934, "uuid": "dd395d12-427e-42ae-9ed8-dcb3f782c885", "value": "12288:9lVVXjANti848zhhYE4RkMcdqIHo7cZ5vf:/VucZ88E4RNcTymvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683011934, "uuid": "51461434-f5bf-40b0-be7b-6686d7cf4b65", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683011934, "uuid": "d93a3491-c073-4d0a-b6c1-6bb2de92c2c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011934, "uuid": "a7fa2267-5b98-4e91-807f-62ba04d0e1a9", "value": "Kr9buv0gQ4YmB43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f34ceb8-e8cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1683019918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019918, "uuid": "82162678-6bc2-4893-b2cb-e40d058545e7", "comment": "Malware payload (RaccoonStealer)", "value": "3ef1d7533a7326e342cd7f8d23fba59e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019918, "uuid": "60f540e4-5f5a-4312-b653-be966c2e9cf1", "comment": "Malware payload (RaccoonStealer)", "value": "553759a82e6f5e6b4601ceca89af43194acb1128134c6659a2d9809a6bbf5a2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019918, "uuid": "a4737b6d-2de9-4563-9771-9fc98c570a47", "comment": "Malware payload (RaccoonStealer)", "value": "c4642fc4a196f7d177f2b1b1b105fe5f509039fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019918, "uuid": "3eb4f27d-5d84-4efd-b4d0-31c67d443f2f", "comment": "Malware payload (RaccoonStealer)", "value": "8c7d6e62b359b2878b2cd0cfe7f76669cf89ed705ffcdc288f7436c7ad3e3094c86911e79f749763a05d997a1a5adf6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019918, "uuid": "18aa007e-f0b1-49a2-b7c7-1357ef125120", "value": "T13906233BA7E620C6D8E5CC399837FDA5B1B5272BC74298B099DDB4C41B121D0E712E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019918, "uuid": "f94e704a-dfae-460e-ad9b-4df2152beefa", "value": "215a4ae286896fe0a1129217f898f7a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019918, "uuid": "3b6c2af5-a115-4b20-9cfa-932d708952dc", "value": "98304:RXK3c1m/dd1TTXPqNXRn0fJavn2pxHZMc4h+obbNT:RXVqd1fq8fQvn2prjUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019918, "uuid": "b64dbf91-7570-4778-9093-9b131d571378", "value": 3929088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019918, "uuid": "91c45eb1-72fa-47e1-90ca-4639d0cf1051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019918, "uuid": "12e46e53-9782-429b-a34d-e6c8add7d157", "value": "SecuriteInfo.com.Variant.Tedy.349310.23773.24710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f386f58a-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683013375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013375, "uuid": "275115e6-149c-4025-849f-ef10fca97720", "comment": "Malware payload (AgentTesla)", "value": "527560c57b47028e55d1a4ebcc727778", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013375, "uuid": "1f386c70-85ee-49e5-90d3-5a86004fa023", "comment": "Malware payload (AgentTesla)", "value": "59e57cffbe59a4a8dd48220345e022b41deb60654705a518a0a74d5c86496951", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013375, "uuid": "4254320f-222d-44a4-82e6-624767945d4a", "comment": "Malware payload (AgentTesla)", "value": "60f85083812251f2e4491ed4504b83a148f3ad3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013375, "uuid": "87636dba-1881-4d1e-ad91-8395d3ad9adc", "comment": "Malware payload (AgentTesla)", "value": "a2ce0d35aed856d3c81017d7db12c1baf243ec4f4c8bd252f2801eddbbdc5703393c0152550c5c7d75e76355cb7b640c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013375, "uuid": "7c0075d0-2ce1-4c8e-ba85-5bf03d76e621", "value": "T1E1E4AE535065CD0FFE6ADBB091B4FF95B6F1F07360D194242BB921C9CAA9F011E8C52A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013375, "uuid": "a859e13d-7822-4e99-b497-5def6fce6c33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013375, "uuid": "761d4243-5430-4921-b066-20803b6b54bc", "value": "12288:A8kEA0YajQSOy1rug6qIo7BUDQANdmImzg/oXegQVt:A8kQNJOsruC6Dd4k/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013375, "uuid": "1d2c0426-e586-4578-8828-a9324f5a6850", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013375, "uuid": "2d355fe7-930a-4887-aabb-c1393d99fae8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013375, "uuid": "a55a255d-9116-4251-8bf8-8fd2d582eb3e", "value": "Declaration533049847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5d7b7d-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683013418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013418, "uuid": "3aef888f-d623-4eed-9086-e96a626fdc97", "comment": "Malware payload (RemcosRAT)", "value": "a1e8fd166700ebf21ae989986b1724a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013418, "uuid": "6e1185df-917a-4943-be37-929cf4858670", "comment": "Malware payload (RemcosRAT)", "value": "5a39ad41f48a1544240382fdfe5753d4132fa4df620c05b1ae5ff6336dd2882d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013418, "uuid": "069ae6b0-0ac3-4218-b310-29953c05d289", "comment": "Malware payload (RemcosRAT)", "value": "f74edd98b7b31546474bc70f837fc8c5b55e52ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013418, "uuid": "026c770f-0266-4fc7-a65d-148e1f8d6639", "comment": "Malware payload (RemcosRAT)", "value": "59430e8cca09c20ff9415e12ccf71de65810451acba45e75a029baf97aa6280ac602c6d519f206ffd7e1233a20ca545f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013418, "uuid": "ad35c127-defa-463e-b4ed-58b3ac972ddc", "value": "T14CE4AEF195940861F73BE7BE87BE5C717C0FBE395A7CA88824B6315917F75932022822", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013418, "uuid": "d2a4b758-912a-4522-a581-7b8ff3c73afd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013418, "uuid": "eebfb90a-e3f7-41b4-a484-ff0b1610950f", "value": "12288:AYtozyjSAjPcgLYXmlYlQvf/qEfwgv6+knZerqBMjccUe/l1+IrW09KD:AYoyNjnsXblc/qEfb63nvuccZlQIi6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013418, "uuid": "ffcfae7f-80b7-45ea-808d-176567dd8334", "value": 672575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013418, "uuid": "ad368fc1-c738-48b1-a3a0-a731b56ee49b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013418, "uuid": "e9ad9e04-5869-4574-8902-f022db230a5a", "value": "scan_doc_007393033_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99af3d1-e8d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683022324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022324, "uuid": "2c87c6e5-47a8-4463-96da-7d4a31003cf3", "comment": "Malware payload (AgentTesla)", "value": "12c1b30f4480bb23be1e4b5a84cf1cca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022324, "uuid": "032f4483-c7d1-4f7b-b436-48d9408cb50f", "comment": "Malware payload (AgentTesla)", "value": "5b7fd0a91db03a64277e79fa7e6b8d63674a8a3cabf30c78eaa56c70ba6b3ceb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022324, "uuid": "e1fb41c5-2f88-4446-82ad-862b8be56817", "comment": "Malware payload (AgentTesla)", "value": "1ddbd5c6b3000be23c2b56cf63b3c992ad2405f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022324, "uuid": "7e23a8ae-9cd0-4f2f-bdd2-27a6eb507605", "comment": "Malware payload (AgentTesla)", "value": "ce4994d3281a31a1d6b9debafc2e615c8442d938942a84a6b746f28da01b7dee6558ad5cae2d1466b397ecb0072170f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022324, "uuid": "350178bb-024f-4f4c-aff7-495f99c886dc", "value": "T14AD4D00A5164CF5BFD3A8BF14474FF8027B0B073A4E4D1351FAA60C6DAAAF150E59A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022324, "uuid": "baf2d1ef-e163-4a9a-9f8a-00806ceaac48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022324, "uuid": "96c0662d-0eda-4200-9aa0-8900d514a81b", "value": "12288:sEC8TMXbuLiq9hfB6HwfehKps5LNUhlNYEJFUA53euRX/u/4d:i8Yu2q9hfB7fehKulSlNPJuAnRPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683022324, "uuid": "fe69c297-7db7-4618-9efb-9718c7627ee4", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683022324, "uuid": "e21907be-3969-4939-9108-242b912697eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022324, "uuid": "25e45040-fd49-4bdf-afa0-2d69412a8a4c", "value": "DHL-AWb 451387.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebb47a4-e8cf-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683021527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021527, "uuid": "46ae0f25-a16f-4ef5-a2d0-2d5ec4ec916e", "comment": "Malware payload", "value": "b7be4082bca4e283624704ad2421ce93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021527, "uuid": "cfca4a05-40d1-474c-953e-7f69f007d378", "comment": "Malware payload", "value": "5c0987d0ee43f2d149a38fc7320d9ffd02542b2b71ac6b5ea5975f907f9b9bf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021527, "uuid": "ecb4dba8-8634-44fe-9801-8dda1bac4843", "comment": "Malware payload", "value": "f2007a5856fc2a0d1d96b7ea455b7deeeb521447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021527, "uuid": "f7986be0-e8c1-4842-ae1e-9902cca97001", "comment": "Malware payload", "value": "15ddf11607019a15996070e9a4f3f623c27ab79dab183e31f760f68c54dacf4a2e1503f055f77cfed7080ad9dd0f5068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021527, "uuid": "a3cd9bdf-09e7-43c2-8efc-27710f4b9e9c", "value": "T1FE247D00F592C0B3D83616B809E36679CA3D3E6400AC8D6B97C55F5B8D713B1A72AEDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021527, "uuid": "ca4a7b1e-afd7-4e13-8545-1e097e8eb85e", "value": "d6d4965d7fe2d90a52736f0db331f81a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021527, "uuid": "a90c63b8-0cd7-41b8-8cc8-d8f91b0009ec", "value": "6144:6d9vBFb7dPmTkyFukPNdyK0EQbVaRNYpDKw:y9vBxduTkxgdyKp+azYpuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683021527, "uuid": "1af1fe1e-7b93-4fcd-9349-90e23d401085", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683021527, "uuid": "a870ee0d-a107-44ce-a0e0-78bb46f51004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021527, "uuid": "4da1f51f-e7a2-41db-951e-839e9c4935e2", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac5d0bb-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683013360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013360, "uuid": "b3f3fded-5950-43d7-881f-56bf60892aa0", "comment": "Malware payload (AgentTesla)", "value": "bd183ee9bb0ac64a38c688de8e113142", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013360, "uuid": "bf49aa62-80e8-46a6-ac38-2b8ab680d80a", "comment": "Malware payload (AgentTesla)", "value": "5d737b16a110a07b5deb68609bf84e155b176b056986ef187b5f16a31cbdb7d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013360, "uuid": "cb19f009-a595-485a-8645-2c7defe9a20c", "comment": "Malware payload (AgentTesla)", "value": "a586bf4e5138d7be7d15065fe9837fdc853fbb61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013360, "uuid": "b1b731d7-3e73-40f4-bc5b-7f5a44c7c4dc", "comment": "Malware payload (AgentTesla)", "value": "5dab609c50305b19f27eaa65789ad90b845341dca69f5f408ec5972f4c13334b16293286e2f22eb3281ac7632293ec33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013360, "uuid": "8f84ac5d-90bd-4d08-a11c-33b0f666fa26", "value": "T1A2F3F96892858916D72D4DF5C4A4310806B2A1778617FE6F0EA49CFA3F463C336AFCE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013360, "uuid": "5313fcc6-13f6-4f2c-b8c7-5f27e8efa042", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013360, "uuid": "cd431362-daef-47d3-a56e-539b6d9a1bde", "value": "3072:XyrolgbJsWZMhmGLftpK4OgqRQJ+in1yDgB/jcCEW4964Hx++D7RTMrYuvQ:CrUgbqWZMhmGLf78gqRY+ykgirHg4HxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013360, "uuid": "50fbd111-62e5-44e7-b9cd-7a18acc0f06e", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013360, "uuid": "f439b6ad-a2c2-41c4-a963-8ced9bca0b74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013360, "uuid": "50cb1037-ef8d-4fa2-b9f2-1b308ae20614", "value": "5d737b16a110a07b5deb68609bf84e155b176b056986ef187b5f16a31cbdb7d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6daa32-e8ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683005718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005718, "uuid": "ff9cb2c5-8cf5-4e62-be28-edc148c803b8", "comment": "Malware payload (AgentTesla)", "value": "53178666fe0ed4bf9eca6ff6bd9a1175", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005718, "uuid": "5cbaf3d9-389b-46bb-9dda-66db973174ef", "comment": "Malware payload (AgentTesla)", "value": "5f2c559e070d9279ebf1519114d00ab17f817aff64970480721cd579d1fae612", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005718, "uuid": "d2392877-f7c1-4599-8e11-1eaf05e72cb7", "comment": "Malware payload (AgentTesla)", "value": "9ac6bab650c2bb37c37f8f18974a4dc99dec0ee2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005718, "uuid": "d458e454-a17b-4e75-a6af-0014d51450de", "comment": "Malware payload (AgentTesla)", "value": "f7d3ea58434f6e1203c759b2777b3e0767cf794b93e169feec847e72c8603a5b7fa62804234e49dc5ed2e8b96480cff2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005718, "uuid": "79c8afe0-ddea-4df3-8264-0cd67e9b1246", "value": "T135328407A3AD52A9EB763A358FB65F4D1ADFB312C0B18ADE97CC0F2A58C15831411B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005718, "uuid": "37e7e96c-e747-4ed9-a904-f1d085251a63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005718, "uuid": "ddd17309-a35a-48e5-86fa-2dcb7ffb2f2d", "value": "192:DWUwftwZIbb1pnkKVfIc7+yTKWEBbOy2xOdV/0xe6c:DYXb1lkKVf3ivf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683005718, "uuid": "1d5a7cea-48ab-41fd-a2ce-ee2f5a831436", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683005718, "uuid": "58111f77-cd27-4f6b-9e7a-33dcc8b33858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005718, "uuid": "af12a31c-ec86-4369-b1c9-36f6db18f887", "value": "Original Bill of Lading.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6b75f2-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1683013422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013422, "uuid": "16d2936d-d6fc-4465-8d34-f91c7fbc04bf", "comment": "Malware payload (zgRAT)", "value": "2a0a2ba9d0b1fb8839b9d4ac5f5b64fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013422, "uuid": "91963115-bc35-42d7-9c1b-b28828fd38b9", "comment": "Malware payload (zgRAT)", "value": "5f8d77ea877527a7bc8201ba782f2d6cd006f271c9d50bc4324d1f301c4f4ed5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013422, "uuid": "83a08d31-1eb1-4b1e-9744-3f7bef8b3b24", "comment": "Malware payload (zgRAT)", "value": "941acb95c2652f0ea32c25962f31503d089e7fda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013422, "uuid": "b6ba143f-e0a4-4a24-a710-00355db66d5f", "comment": "Malware payload (zgRAT)", "value": "0db1675673eeff9d57d88debb399c35d650e752fd73ee885df45b0620bffe5f4f1505028302dc53f6450290594d05738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013422, "uuid": "6fc4b6f9-5312-4ced-b04b-02154a32e852", "value": "T13284015777878761C64845B4C0E3880807F1E3466673DA8A36CD836A4E627DEBE85F8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013422, "uuid": "0ee0570f-8a6f-40c3-ab6c-3a203d5d2402", "value": "6144:TY/G/77DgAoLOiKkXZIMhWmAAi8OIiqfWU7cK0knn3WpsVqkLkXznUKzw+5n4:VDgZZHXaUtiRhqfF0kn3DokLmzTz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013422, "uuid": "e5310c96-ecb2-4df6-8eac-4ccc80514497", "value": 372808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013422, "uuid": "9b32dfc4-e381-4fef-b98e-3310188283c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013422, "uuid": "2eef4f0c-4b84-4284-ad5e-793417e6f64e", "value": "swift MT103 payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096c1af9-e8ba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683012123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683012123, "uuid": "9ed045c4-1b22-4b73-8de3-693acbd90e32", "comment": "Malware payload (SnakeKeylogger)", "value": "a8b7d41fc81e7c04f21bcf8b8fcc5cda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683012123, "uuid": "b4ce887f-2570-4a8a-bc06-3f880c157807", "comment": "Malware payload (SnakeKeylogger)", "value": "6056bd2c5f4adeadbafa4e630874fe41cf4cce06d46a7bc68a66e91443d108bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683012123, "uuid": "49baf351-535e-4340-b9fb-bfe44cbddc40", "comment": "Malware payload (SnakeKeylogger)", "value": "af51534bfe77d0ed0258110e2c50ead1af46b77a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683012123, "uuid": "60a91840-1239-4c18-8b41-e48bbf114ef0", "comment": "Malware payload (SnakeKeylogger)", "value": "9031f041d8b39705542c9d511cc6c6251f9b015153dccb869e8f814936129d6a0299ea59fedace9a8fc4dd028fc96af7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683012123, "uuid": "843e8f59-bdce-45fc-abea-98ce7379d401", "value": "T1A6052CD1A150C99AFC6B47F1AC2AF93025E2BDAD54E4810C1AAD775666F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683012123, "uuid": "1bfc871a-2925-4e9f-aa79-4377fe117f6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683012123, "uuid": "469df199-2f98-4ad7-bdff-ab0df3e3b7d3", "value": "12288:fYamM5hj9E2K5k9SGwLkmZ/fM74d2unVqDPc:JmM1MwmZ/fW4YsqLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683012123, "uuid": "5aaae93c-c285-4787-8a85-66ee323d7b84", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683012123, "uuid": "4549de8f-abd6-4b13-b86b-f0f7903b020c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683012123, "uuid": "3149bec3-370b-40b6-b07b-335078a52893", "value": "Halkbank_Ekstre_20230501_080311_746465.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb925cab-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683013362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013362, "uuid": "d972ade1-f195-49e0-80a4-3a0c373a233a", "comment": "Malware payload (AgentTesla)", "value": "b48848b1b292aa3259c45a2516d0aae4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013362, "uuid": "8fef631a-47f5-494d-9375-2a74d6a060db", "comment": "Malware payload (AgentTesla)", "value": "6091bd7232ac362de5f7b1618a8e476b146a436b4dea2c188b9403405dd7cba8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013362, "uuid": "bdfcfb23-3ca7-4cb6-be6c-096dc3da94ac", "comment": "Malware payload (AgentTesla)", "value": "ef895c4ae0748eeb99740f531f3e5361feeaaa4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013362, "uuid": "840c31da-4c79-44d7-94fb-fea50653660c", "comment": "Malware payload (AgentTesla)", "value": "3eff02f705a489254ac41b7b4a5b56f131366e68347f3373f21a4375f348d6ec720bc65109d7b618adb7622b14d1c68f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013362, "uuid": "7f243b3a-3a98-414e-95a4-2809db662dd5", "value": "T14EF33B6CAEDA8E11D72D40B4CCB1104807FE91464617E76D4EB0BCFA3E867D3762B866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013362, "uuid": "6805fe58-58d9-4941-84cc-db9b0214bf4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013362, "uuid": "e2ba1314-68c8-4aea-8bbd-f2b5bbc543cc", "value": "3072:40RSBDuXhOunKNBx0apGKxYvCSxxW6cDd2dDv+hHcEc:wBDBNEeGKYCS7WLQT48E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013362, "uuid": "4a940cdd-3b56-4be2-8ce0-77e2231f8561", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013362, "uuid": "fe224122-0636-4feb-b9f4-c56a50922bea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013362, "uuid": "ed3bbbd6-9aa9-4ba2-9d28-738f63d1076c", "value": "6091bd7232ac362de5f7b1618a8e476b146a436b4dea2c188b9403405dd7cba8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8af836-e8cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Nitol)", "timestamp": 1683020049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020049, "uuid": "de296311-4918-44e1-98d2-354fb3ce972d", "comment": "Malware payload (Nitol)", "value": "5c6a6f7377297fc6bdbce163d81db158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020049, "uuid": "56dc2910-2330-4484-941e-f9effa562785", "comment": "Malware payload (Nitol)", "value": "61f8fbf2ffad917599c955d013c8a45cc88ef9260914c0b313a7497a0dd8b4dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020049, "uuid": "076956d9-a893-4403-a9d4-ed61ed6748fb", "comment": "Malware payload (Nitol)", "value": "7b9d92b14db36ee61614722ef4267d3d4e7f88f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020049, "uuid": "a733d0fe-2dca-4c42-a754-8dd5d9107a83", "comment": "Malware payload (Nitol)", "value": "42159d66eea02a40668d5c584dbc3d258e2f45058cf650e3513fdb0f037b138ecf07e1e8d31c2684347402f3f2e8d7f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020049, "uuid": "f771ddfe-892b-4082-8e9e-85f6b13e2314", "value": "T1981512554FD78B11F7E66AB144A1D0497FBAFC2099104E66C2F0E958BC63BC4B930B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020049, "uuid": "c6cc9af3-fc5f-4071-9975-258f6479204f", "value": "c2614b8561d9942359875ae32fc701de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020049, "uuid": "fe2ee948-4f58-444b-881c-0e07c5efb217", "value": "24576:Iuxq4++ZqegnO3/zLBXSOZUlO05YTS9l:X04rZwOP5J0bv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683020049, "uuid": "2bc10c47-105d-4148-97aa-da188490f52a", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683020049, "uuid": "c5e887d3-dabe-4c6d-94ec-a29f7c440481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020049, "uuid": "2495214a-8407-4e20-8ea2-6a54afc7cfa6", "value": "5c6a6f7377297fc6bdbce163d81db158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d1a34c-e8ca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SystemBC)", "timestamp": 1683019305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019305, "uuid": "ac2a2a47-69e5-4d2b-b211-44c62374393c", "comment": "Malware payload (SystemBC)", "value": "a20d99e025fb23ba51d38a975bc10de5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019305, "uuid": "7f74541b-dc43-4ab9-9cff-389750a34b5d", "comment": "Malware payload (SystemBC)", "value": "6278b1a4d8a19c7ac40ee309c100924427fb35028f3eadb96112c9b70c3a0d59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019305, "uuid": "80958697-b337-4fe5-92b6-e4f7344703c7", "comment": "Malware payload (SystemBC)", "value": "6d58a7dc6f4e84ed6cf70fb154e6af3193ff4045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019305, "uuid": "3744d499-ec4e-4998-a11b-867fe7054df6", "comment": "Malware payload (SystemBC)", "value": "caa1e0f8eba7d58574d17a0585a766597f985307e114104e4027749e7123b7a89dda92a8896886abe1969bc58dd5e506", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019305, "uuid": "f6b0cdc0-bb47-4396-87a9-591f17d08bd4", "value": "T181E3E001BB91E873C40555B11522E7E1AA7FB8260A335A073B6C1F7F6F312D2AA77364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019305, "uuid": "bb11855b-06e1-4b34-b5b8-9b7ecd503eec", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019305, "uuid": "877c869f-b017-4414-a22f-eebfcab5eb11", "value": "3072:lbUHG5euMB5Y7S8TmACM+nhICbBUw3r5x:0uqYe8qAbCTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019305, "uuid": "8cb4ac59-1f30-49ff-87ce-5f987733be42", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019305, "uuid": "68ed895d-7831-4953-81a2-327f1ad895a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019305, "uuid": "9af083df-e538-429d-b7e2-1526d4a04d0c", "value": "a20d99e025fb23ba51d38a975bc10de5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bb1dfc-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683013384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013384, "uuid": "722fcc07-1d72-4c04-a032-2669d77f3282", "comment": "Malware payload", "value": "ffa8e163702fb8f65b04e0866976bcb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013384, "uuid": "178fd01c-6630-4623-bd6f-b4178a45ffb1", "comment": "Malware payload", "value": "64637811e8f619bc7ec9c16397ee42aca274673d421638dafb5586760b0f2085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013384, "uuid": "6249983a-a7e7-461c-9b96-fa10ff8e7b98", "comment": "Malware payload", "value": "e43a0d97a8ef5522501e5a9a278b9414e147a821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013384, "uuid": "af9c7a6b-cf91-4a13-8e5e-e120cf31b134", "comment": "Malware payload", "value": "0e5793587faccdd96093c80666e1be9fabc3e388fb5cae239d642c9b6ddcede1e62e7dbfe0bdc1b93ef1fc8f110fdcb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013384, "uuid": "d7722865-afee-44df-ba87-1670fec39306", "value": "T1A8343B6D528A530FEF119C337FD5BB61DEA7A8A8CB46C2F04580A1387D14CD6B81BD1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013384, "uuid": "d15a4770-000f-4bf0-996d-86387c19614e", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013384, "uuid": "7931e89b-6de3-497e-a8a1-2fa6bd65dff4", "value": "3072:ThQgp0o5vSj7aB7n03eN7Dxlyj0y8hkg0YLFJnqXxndLOaD1xprlfAgkmrTm0TrU:CgGkqhNJlrJvkShwAsc3BUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013384, "uuid": "6414b6c5-7a4a-4569-a40b-a6d39658f549", "value": 251232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013384, "uuid": "ca9149a5-adb3-4d9b-87cf-df13304a9e3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013384, "uuid": "4f84621f-335d-4183-b580-c000dadab399", "value": "FACTURA_NUPEL.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f03aa0-e8c1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683015179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015179, "uuid": "17a629f0-f7ac-42e3-8c14-aff9ccd82fa5", "comment": "Malware payload (Formbook)", "value": "2802851fab9b500aded4701b69886a03", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015179, "uuid": "dd5495e2-b3c5-46af-9b67-82c760509505", "comment": "Malware payload (Formbook)", "value": "668f55824109256ffecdb327adf60445c65c941a61549c7fd3631b1cd7513de0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015179, "uuid": "e5df56be-8e52-408d-a829-092752b572bc", "comment": "Malware payload (Formbook)", "value": "2eaa7e0e9d7cd9ae5cbd935e2b2f887d5b453508", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015179, "uuid": "c9f2514f-760a-4daf-b18b-aeda62c312f2", "comment": "Malware payload (Formbook)", "value": "59cd076a5db0cf500ba6b08c06428b7eb6139f5809f691089a72906d7de650d1824e9be3216dc35301895f413dbe5782", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015179, "uuid": "a74c51ec-ed98-46a1-a09f-ffca22bf5544", "value": "T1E9B423B9B38A6936CF144564BF2BA239F6955D0EF3B001278936670931024FA7E5F8D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015179, "uuid": "7548f608-6dde-41f3-b3f7-9f1b1bc69b84", "value": "12288:7mNY4WEiYwgCBw7N5JkuBUJcBsGlo2ojiGYGI/awCDOVFA:6NjD9wgcwN5SuBYcydbYrkyDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683015179, "uuid": "b9241bda-8f7e-4388-8d78-9f78691dcfbe", "value": 539649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683015179, "uuid": "bb8aecc2-d710-4dd3-9f62-03fe7d98fa3f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015179, "uuid": "ba8f41cd-4d1d-4be7-a08b-aa811fb565b0", "value": "INQUIRY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b5876b-e8e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683030074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683030074, "uuid": "3e2ec870-df89-4d37-80e1-134b25f1c810", "comment": "Malware payload", "value": "a316d3675925e9b74b3ecf2f96b8c62a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683030074, "uuid": "c5ee3103-e574-4ae7-9ccc-3f727238fcb9", "comment": "Malware payload", "value": "67cbedddee0cd07a57cfca548bb5cb781226821287daa762e77926b938233b4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683030074, "uuid": "746b6893-a31e-4bb7-bf8f-3140a7622b73", "comment": "Malware payload", "value": "b806ef9eca51689011af9a4845a8eb9cd64d607c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683030074, "uuid": "6a631242-5520-4663-9538-f3682a37f802", "comment": "Malware payload", "value": "ad13a0335b5dc2f8c2a512c52630ca720140bdce1fc5bcc519c680615ca3efc804e4c9cb6e407937449179609f17c7d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683030074, "uuid": "b483d5b3-02d0-4880-b1dd-d50560a71378", "value": "T1F383490070D6C072E01665BB8466C2B44E7B78792D226E8F6FDA16F94F297F2DB1530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683030074, "uuid": "679d9af7-e803-4647-9d14-aab85279bdd4", "value": "72cec88f84d6ae8cd9151d630ec13cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683030074, "uuid": "10e5886e-203a-4664-ba4a-c7a407dd2cd9", "value": "1536:SvLqL/4BSWeq4M2N2f425r8Ji1Qscpa9coW7wLTDRW:GLcgp4ECJirX1LPRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683030074, "uuid": "3edb1d9c-751c-40fb-a99e-6376640a5554", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683030074, "uuid": "48ee449d-e461-4b85-8e69-2e09cb63bacb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683030074, "uuid": "2dcbb9c7-8a35-4c19-afef-927b41a5c9ce", "value": "pqxkzakfg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a7759b5-e91e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683055316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055316, "uuid": "a8357101-9ccf-4b7c-8345-07bac1905849", "comment": "Malware payload (AgentTesla)", "value": "c2ff9f433b86048529020cb22f7bea9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055316, "uuid": "3a6a9f0c-94bd-4d9e-aef6-cb613e8d8eb3", "comment": "Malware payload (AgentTesla)", "value": "68332659490e748cae603f66d2011e055efb985711b8f99f44d1262b49030c97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055316, "uuid": "9ea3b613-5fa3-48aa-bdbf-20016c7df799", "comment": "Malware payload (AgentTesla)", "value": "2e7cd451261c505d32ac8f94f5d8abed8696be2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055316, "uuid": "f8742390-fddc-41b2-b9c8-77fb64c050e6", "comment": "Malware payload (AgentTesla)", "value": "89a2d3a3186aeb4c12a775bb0062a33df00ffe8c64ad6206f38dd67393b53decd08116a2d271b788fe20cecf0a444a8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055316, "uuid": "94f24d08-54ef-402c-9095-9c675cde09e2", "value": "T1BBB423B06E67B5AFE57C96D26FB94D1BCB2A8D10616E37CE0053721C8237063E259C87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055316, "uuid": "778e78bc-0aa5-4d46-af8f-0a07442f796a", "value": "12288:+FI/4vzWOgvl8+ltBC2nJERen6xNNMHJ+2geoGscWcndNe9lu0gR3:g7Svl5jJE06/NMp+2iGshZu0gF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683055316, "uuid": "7ac0e81a-a604-40e4-8825-eb7dcb82c51b", "value": 514312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683055316, "uuid": "4afe1011-0a7a-4e9d-9147-867c60ae7c9c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055316, "uuid": "55d7b337-e4e3-4f63-98f4-3550e01ba5d9", "value": "Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dad730c-e8d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683023458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023458, "uuid": "5d52b7c7-82fd-4c2b-978c-04e8a39fe276", "comment": "Malware payload", "value": "01314863a55fe6d3b6a9d502c3b6e7d3", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023458, "uuid": "9c4a0a1b-9856-4a06-83d0-34f639addde9", "comment": "Malware payload", "value": "6874da842d14e63a60f25fd5d3b95a1edc25ef3aa3eda4f4fc2a1f6fa5b54593", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023458, "uuid": "0cb06a7a-b32d-49ca-8818-443c25b8de9b", "comment": "Malware payload", "value": "1a64da10b25f7fda4b814864cd70587d6a683943", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023458, "uuid": "0fa7b976-1fab-4eea-b9e8-ce986bf9ac2f", "comment": "Malware payload", "value": "1ebcaa4833b0e2cc0ef1813fa82f06ba5fda37ca8bd6a6015eb5cc718de8e098fec14425092d41b98a5c653facc1b706", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023458, "uuid": "5c7cbd90-9977-49a6-88e5-49ef752d387b", "value": "T136447B513BC9C13AD2AE063785BADB6626367D710B30D0CB77903D6C9E316D2EA39346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023458, "uuid": "95273cba-068f-43df-810a-2785bb0fdc88", "value": "3072:lcspAtOXmXwCGjtYNKbYO2gjpcm8rRuqpjCLf2loHUvULyGxr5lqM2a8FI:ktOXiRQYpgjpjew5GAyGxjqo8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683023458, "uuid": "dd961ce5-0323-4d86-a589-e325f774f750", "value": 277792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683023458, "uuid": "9e6e1892-7a78-417d-9101-b63f8dd3d628", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023458, "uuid": "801723d3-79a7-40fc-b939-e8b09b3243d7", "value": "SHIPPING_DOCUMENT.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4b06e8-e8ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683006926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006926, "uuid": "cb144e25-5579-4725-803c-408d887a5914", "comment": "Malware payload (RedLineStealer)", "value": "d7add86c543d30ea08c0a9666f22ac25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006926, "uuid": "2c03b1f2-cdf9-405d-bbb4-cb56fe55ed75", "comment": "Malware payload (RedLineStealer)", "value": "69e78f9bd3cbc8d0d097e377bb9be8667313cb00fba0652a514d2658c3d68a97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006926, "uuid": "1843b8f2-aa60-4496-b4cc-47f52405d463", "comment": "Malware payload (RedLineStealer)", "value": "7fffab1c841ad6c338e426914cadf799fed1a214", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006926, "uuid": "75fa9c2b-697e-402a-9e7f-a03c9ee6cc36", "comment": "Malware payload (RedLineStealer)", "value": "d5d12ebaba3b0d5d86bbd390314e60d5d8c12ec17b3e7175747a12e63c78ffea5ec59a43d8067fa1cef1fd40a9789271", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006926, "uuid": "3a766a36-9927-4e6c-8552-d2b11bdfb979", "value": "T10BA49D9627469D43C46617F950F2E2751732BE9E6625D30B58F8AC33BB7A3932C0E183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006926, "uuid": "fe167502-a8b4-4be4-b2ff-5c3857ae8508", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006926, "uuid": "75aa92f3-8300-46ac-a5b9-bc557939b456", "value": "6144:hH99VAY+KJojNYo3pcJdR85y8d59O5QEvMtflh:htRsYocdRqzOZyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683006926, "uuid": "fbf94ea8-b3b5-40bf-aafc-b02adb9b3ef3", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683006926, "uuid": "513713c9-5f45-4f04-8d37-2fadea20fbfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006926, "uuid": "651b1fb1-5ab7-4662-8eab-5a746db18230", "value": "Evolion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1869cb5d-e8ce-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683020738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020738, "uuid": "5a24f097-8b44-41f2-a3d5-403f4746db1b", "comment": "Malware payload (Vidar)", "value": "bdad915c069e6f257cac2a95c9b8c33e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020738, "uuid": "ac4d7abe-4762-46d7-bcd9-abd0168033c8", "comment": "Malware payload (Vidar)", "value": "6bb95cec9fae853bb6149b87e3ed14e546e22e6dd8d9d76f784efab336515e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020738, "uuid": "8622023c-4b08-47e1-b304-4b104b6a0f9c", "comment": "Malware payload (Vidar)", "value": "c1ef1e12c2b84cc88339fc08b209cce3eb574d7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020738, "uuid": "6225f6bf-1a9e-4174-93d2-8fbe2f96359e", "comment": "Malware payload (Vidar)", "value": "ee203c0d2f664ab9123c5e9704dd9e12a227119033f6cfc86e76153748d1c9d049095bc678e279e07308063094712960", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020738, "uuid": "9eda9238-3042-4d88-87dd-ac921320db7d", "value": "T1E524D04137688412EDBA587161AB9A671B3578272BB0C507304FF63E4BBB7D2630E74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020738, "uuid": "ea08c9aa-e591-40ce-8201-2c26fd1a70ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020738, "uuid": "a0672fac-33ff-4e02-9f57-c2fd1a4f80bc", "value": "6144:rabRD2XVqy9mhZH/1amkyo00XDSE+q11IOq:rkUUrf1HR0XRL114", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683020738, "uuid": "b34b4afe-1a70-4c9f-a7d9-4a0cae3adad2", "value": 224808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683020738, "uuid": "f4b8dc61-0e1f-4520-ae0c-4e839b6a4ea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020738, "uuid": "bb836c98-5123-4958-8cba-68cc0e2690da", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2517d1fc-e8e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683028920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028920, "uuid": "30136c2e-7d74-4a7a-8aef-ed04a4327a98", "comment": "Malware payload (Rhadamanthys)", "value": "c94472dab9d7924b2290099edc9e607a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028920, "uuid": "5d54631c-2fc4-4a83-bbe5-4367f735a4c5", "comment": "Malware payload (Rhadamanthys)", "value": "6c5bcd67d98ccea99437e58f5d44d130f2ddfb3e245ec07ccc7230edd2a71558", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028920, "uuid": "da20b454-b553-4f39-98d3-329cab4b6540", "comment": "Malware payload (Rhadamanthys)", "value": "d65d8377c6908eaca2393d1395c397f55d1265fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028920, "uuid": "7950c3a7-85de-492a-a752-9296acba3753", "comment": "Malware payload (Rhadamanthys)", "value": "7a9df7c580064d4d0dff032c14fef9a18ab75a9357f76512497da2ee9a363b87eec08d0536f8d2e7f946251908b81308", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028920, "uuid": "8fa02bac-12aa-43a1-895a-3667fc06e08e", "value": "T18294AE137AF17876E63247328E6E86F42A5EF8518F15BBDB2214DA2F09B11F2C572701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028920, "uuid": "84a11acc-8266-44e6-8b59-fa6c9c92dfd3", "value": "8e1291b1baddb8fcca0899ad3cc587e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028920, "uuid": "5c970d2d-68aa-4f56-9507-8c900086d6db", "value": "6144:2Hf2Nauefw16FeZY5tH3YT3eshtJGIxWfqpt:2HfMauefS6FeZtT3ZUIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683028920, "uuid": "d6621c0f-5062-4ef9-95e6-94252e50021f", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683028920, "uuid": "b505f0db-ca2d-4c71-a20e-edcc4c151d1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028920, "uuid": "018b5c62-d543-4311-b1a0-1a31172ba9d7", "value": "c94472dab9d7924b2290099edc9e607a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37b5521-e8bf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683014529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014529, "uuid": "1aa3b92b-dd63-4a79-9385-3dfaabbe3ff4", "comment": "Malware payload (AgentTesla)", "value": "16db9460a6f56523692ac4d59769c09d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014529, "uuid": "3653977c-c13c-4df1-a6b8-a54eb30470b6", "comment": "Malware payload (AgentTesla)", "value": "6d3a01714c17f25c4391e3b367e96841d18d13f511638cb70d733c88a6699c52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014529, "uuid": "8508868b-1c51-4609-a329-cfe1ebb9a00f", "comment": "Malware payload (AgentTesla)", "value": "7a3803147ecdc2ca799cf774e5b67747b793c3a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014529, "uuid": "6768786d-9074-4275-9e26-fbf73819b332", "comment": "Malware payload (AgentTesla)", "value": "e119f04d503b3e1eb3663f51ab16133032877bef7574d77882b525dc49dd888a98d5c80d7134bde7c97f0b2c27ef7826", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014529, "uuid": "e441081d-e8e4-4212-b650-ff82c847a9a3", "value": "T1A90512C0B2E7A02AD24E9B71859486FE4B309259788BE74534AD03DE4F137CB7BA5C53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014529, "uuid": "4f62f5d3-e155-4e61-a653-e5429d8d932b", "value": "12288:wRKE9RpGvG6iA7nMGeKaq6IrH+NV39+BT+4PMfdWg8bDdyb55/H12v:4KE0vG+DMGeVviGUTMfdWg88bB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683014529, "uuid": "0c220117-703f-481e-a186-49168ee0d897", "value": 797768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683014529, "uuid": "aa03a533-71bd-4dad-8fca-fc45fee98ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014529, "uuid": "73c84d1c-6949-4563-ac5d-4b687101aeeb", "value": "JHbHh87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6f23f8-e8de-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683027620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027620, "uuid": "0b990da8-73fa-442a-83b6-8488d3981bb3", "comment": "Malware payload (AgentTesla)", "value": "d96a1883c541739abfb98c863fcd16cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027620, "uuid": "001ea082-5672-49d9-922c-0c92ada8c212", "comment": "Malware payload (AgentTesla)", "value": "6d7877be905049d2f5a8716b8e778ab4e32f4ee52e1496afa1c6e8bb8dd5ff49", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027620, "uuid": "af637981-8b33-45dc-bfdc-7485db5dab35", "comment": "Malware payload (AgentTesla)", "value": "9dbf2283aaf223d0d548df952604d9246d4b30ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027620, "uuid": "a0d78662-c5d8-44ed-8fd6-c8377459cb11", "comment": "Malware payload (AgentTesla)", "value": "a49cc7d5194b001c892b754ae64c2cd1241fcdb9edee1ec6b1e6687e0c99483503095708bfb90a470f5be348fba6b639", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027620, "uuid": "9dcf37a2-85b4-4342-8a30-6d59d6d543a1", "value": "T1C005F1566175DF5AFC7AEBF140A4FF8123F0B1B368E1D5215FE621C9DAA8F000A0865B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027620, "uuid": "9f54f7a5-2262-4311-83d5-a2a597fe22fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027620, "uuid": "fd53ef5f-acd4-41fd-bb1d-6fdb6ac2717a", "value": "12288:7zmpIpq7AZU872M1pHd8Znbccz8uHQ9HB2y5TSgoB4WKvN7q3jZ3uaWtblr:nme2yL1JdKheEsugptvNuBuaCblr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027620, "uuid": "4465269d-d91f-4bdd-a6e8-b43079e9092e", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027620, "uuid": "ff7533ec-d135-4299-ac68-c7316a9953e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027620, "uuid": "d89d480f-fcb2-429c-b04b-957a6778264f", "value": "Request for Quotation \u2013 Supply & Delivery of Construction Equipments Fittings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4d7720-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1683013363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013363, "uuid": "017228a2-1b89-4b19-84c1-6114927df1a7", "comment": "Malware payload (AveMariaRAT)", "value": "1095c81e5400a75f6bcc83e3017a8df3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013363, "uuid": "d6bfd04a-44c6-44d4-a751-b17bb9fcd280", "comment": "Malware payload (AveMariaRAT)", "value": "6dbf282ffde887f4c0a3eff131c6de2337ee492f7db8591bb45fa20c1a343d48", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013363, "uuid": "14672d90-6afa-47c6-9cdc-f9a88e83c504", "comment": "Malware payload (AveMariaRAT)", "value": "65bad543a80b99522cd38899c45ef92eb140a79a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013363, "uuid": "cfd59247-eab7-4ffe-8df2-042c2d316c3f", "comment": "Malware payload (AveMariaRAT)", "value": "7e40ac3d4dc8b107fa3c003b52c07bebd54ff733466ee3a0eec2be253acee392226d8f13e4e534399da87b991eb6423e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013363, "uuid": "1af34dd2-7646-4662-be3a-e4c649fbfb50", "value": "T169E37D227BF54439F7B705301AF93E25D2ACBE310E31CE4B5BD4488658B1589E93A3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013363, "uuid": "17fdafde-6551-4c63-b983-3dcdba8bf6a4", "value": "570db8ef63a92b7fa4b4955d1d36a178", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013363, "uuid": "b9977623-0696-4b52-b9dc-2795cfa4ec37", "value": "3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iw:RkxbQktMo4BRiyjYz6GTrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013363, "uuid": "63a79af1-aca2-4a34-8f76-4eab649d466f", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013363, "uuid": "0a2efb25-fd7e-408f-bb83-7cc001a79169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013363, "uuid": "56266931-585c-45fa-a994-475fb9f120a6", "value": "6dbf282ffde887f4c0a3eff131c6de2337ee492f7db8591bb45fa20c1a343d48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed18fb18-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683013364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013364, "uuid": "4a37ab63-6d01-4532-98e2-571fef2dca48", "comment": "Malware payload (Formbook)", "value": "4b95905b4641761632e01c9a13d829a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013364, "uuid": "ea54f881-9351-4331-b97c-43773a8c8686", "comment": "Malware payload (Formbook)", "value": "6e712a8a989b15c1469d1aab013e1374c2aefe81c06ba82d81deb00ea597f5fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013364, "uuid": "ebcc842b-74f9-4677-ab51-7e78656ba8d6", "comment": "Malware payload (Formbook)", "value": "2def810a6611892b5938268d146cd57473ac35f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013364, "uuid": "c8fa1aaf-ba7c-4869-88f4-89ac79b86f7f", "comment": "Malware payload (Formbook)", "value": "a60faade59b3c30d648488b95faf01cc4415ffc7fbe1ac78b74e559db1c15ad88f2ac7547e8e4ff7d24098e94d8fda53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013364, "uuid": "19ec6ca5-0b6c-4179-b719-ec15f3f67fe1", "value": "T13604AE32D602C071E2B251B5B6BD1B7B883E0E357295A0E5E3E116E16FE09A5F13931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013364, "uuid": "4dca8d50-6d64-4d40-96d7-cb5183d8e7fb", "value": "3072:wGSfhE5u+KYx33/yvm2CjiwaH0QU8ouHZoCkiXidG/UQMEVrmS:0yZH/YH2aH0QU8oMuCfXR/UQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013364, "uuid": "048e29a9-f6a5-4fed-ac79-b386822ba14e", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013364, "uuid": "e94ba2f5-7ae8-47cb-a54d-6ee20c053559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013364, "uuid": "12d08025-7dca-4c55-a98a-1340612d05bd", "value": "6e712a8a989b15c1469d1aab013e1374c2aefe81c06ba82d81deb00ea597f5fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6335f9-e8e2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683029687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029687, "uuid": "0e4fe0c0-9e09-4485-bb38-56504a6c2481", "comment": "Malware payload (Formbook)", "value": "0382b1bfaa12b7b20db5960008156baa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029687, "uuid": "560e3a86-a694-4d73-9932-b624db30062d", "comment": "Malware payload (Formbook)", "value": "706b8957fa0e937d89e442c4f15362a507cf950617dd5ddb16f16ef1dfc1c00e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029687, "uuid": "f7a4295a-61a2-4abb-883b-acba6edb5a1e", "comment": "Malware payload (Formbook)", "value": "9b6111c0d6809c46aa359d53c002abd62a487253", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029687, "uuid": "77f820eb-3015-4370-abf2-cc870af39529", "comment": "Malware payload (Formbook)", "value": "3698e854cbd95ff4dd54289fc0c1b4c54b02a40f01d45200c13acefb5b0f2ba4a7e94738206846b323572e16b8d06498", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029687, "uuid": "41bead10-4056-47fb-b944-3feff0a3322f", "value": "T172D4D00761A4CF1AFD7AC7F05464FF8463F0B07365E4E1282FBA60C6D9AAF110A5961B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029687, "uuid": "90c06033-26b7-4e0a-a688-cb9bfe6da1a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029687, "uuid": "dd51c4fb-7ff0-4d2d-9fe0-76b5831a9de9", "value": "12288:eqrgdVgbGVI0kYltrI1k2MpddulWbnm1rArSnzOXEl1hRs/vw0:yKil6/szuccArYwU1zuvw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683029687, "uuid": "c70b7ad4-b39c-42e5-b8f6-252aec7874f5", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683029687, "uuid": "6cecce48-6253-43ce-bbbf-04ae851f7b78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029687, "uuid": "f730076a-6498-4fe8-88ec-f8ddbe8c1fae", "value": "Quotation-pdf-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72176a56-e928-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683059544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683059544, "uuid": "6e7e4c27-45b3-4f22-a024-9860ef4973e9", "comment": "Malware payload", "value": "ff3bc60de16cecf4ad172ea0c8f18c5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683059544, "uuid": "9e387436-8572-4928-9744-434a033b5845", "comment": "Malware payload", "value": "706e3a7c2fa2185ab3d8b3801d70ef32d9a8b5edc289e46616d8e19f90e98195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683059544, "uuid": "b0bafead-d217-4399-b11b-fe75525a99b4", "comment": "Malware payload", "value": "8bee1f7b5e93f1223ec7618eb269c9bb6c03b81f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683059544, "uuid": "6ba4d8fa-e204-4722-8abc-ffd0a7a65731", "comment": "Malware payload", "value": "0d7921873bdee809abeb06913018d7eb4528b5ecff3dc3cd1ae68769371a2ea0de842953b46532940fe0462cb48decd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683059544, "uuid": "8c655425-5291-4863-9708-fb3dfadd54b6", "value": "T1EA55E101B5D1C472D47221320AE1EB765E3EB9700BA199EF6B941F7E4F303C2977296A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683059544, "uuid": "f29f9a71-b354-48df-88de-ed85762b6712", "value": "a474be77234ae202002ad60047ac23ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683059544, "uuid": "58de9963-f982-42db-9abb-9af6f225e582", "value": "12288:iry5lGBmeRAqyugQg+IxZWesiXV2bgry:i64Rhpgj+IjWCXIbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683059544, "uuid": "c1822fb4-2cb0-429d-b7c8-a2683f18c719", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683059544, "uuid": "cdad0c7a-c23c-4e17-b996-1a421ebf2163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683059544, "uuid": "fb559976-a603-4381-a54d-45acd855e97a", "value": "SecuriteInfo.com.Variant.Zusy.465956.15917.18418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a7ffbe-e8c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683017135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683017135, "uuid": "35c1edec-d7bc-421e-bec6-7ad932d22db3", "comment": "Malware payload (Formbook)", "value": "c3372a4f47f48147185e40a936eb4dd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683017135, "uuid": "fcb8da83-a060-46f9-a018-86c2979e6304", "comment": "Malware payload (Formbook)", "value": "70a378931cc4a1c5a4a8ef166e4be5d1e25dc1f164555a137ddf72b9eac7aef0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683017135, "uuid": "9eb0a906-bc2f-4276-9885-9045521ba741", "comment": "Malware payload (Formbook)", "value": "54d076d3ca7ba111a7ad0b02461b4c9999e37103", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683017135, "uuid": "ac75f921-815f-43fd-b8c5-fa8cb098d867", "comment": "Malware payload (Formbook)", "value": "0ee33a2924815b1553fb952b6782c0953b686f1bd8d3d6194f78d9ad8be8c4ff2003d23a46d1bb69a87dc5241c1c4bd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683017135, "uuid": "12408a3f-f440-43b3-8a67-3a2e1a434a99", "value": "T114D4D00A6168CF4BFD7A8BF15474FB8423F1B07750E0E2242FBA61C6DAA6F110E5951B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683017135, "uuid": "14554e8f-f51b-4d6d-9221-3e6f3a45d02a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683017135, "uuid": "5b3c1c16-0708-42ab-8b9e-a09a2897cc5d", "value": "12288:KDkFlBM30HzaNZ/eFlBT6FRC+ryGYkMqZdcT:hE30TaNZ/k+FR7rIIPcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683017135, "uuid": "6852a9ce-b191-40d5-935c-e33701d669bf", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683017135, "uuid": "33bc22ba-9826-4055-859b-31afbdf47b2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683017135, "uuid": "10b9f2af-e4e7-4303-b23d-552aa12b4132", "value": "PAYMENT_.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa131b96-e8ca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019399, "uuid": "4c57cb4c-acca-4065-b6c4-c3c4fefa2cef", "comment": "Malware payload (SnakeKeylogger)", "value": "d5a17638cd85bd565801945b2c1104fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019399, "uuid": "886a1e10-abf1-4ac8-bab9-7489ec54a078", "comment": "Malware payload (SnakeKeylogger)", "value": "70b86ae1a2b54a630bf94ed868958fdc478fa15368b29a8fef0953518fc64dad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019399, "uuid": "ca0cc17d-add3-449c-9b77-0e63fd2d2dda", "comment": "Malware payload (SnakeKeylogger)", "value": "edfdad7f4a70a535377d17987db7b4519bea6053", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019399, "uuid": "63bf8949-f5aa-4df5-b84a-c3a4fb1943b6", "comment": "Malware payload (SnakeKeylogger)", "value": "ce38db95dc0479e6f02ac4f3f5b229e0516a6fa4f431d59f5fb810c465be46b4efce38928fd9f2904052a15e4515e715", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019399, "uuid": "3a6c2b81-a184-42d0-8183-ae583a66fdfc", "value": "T1E5C4BE426165CF4AFD39DBF154A4FF4463F1BD7358E0E1202EA635C9DAB6F000A09A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019399, "uuid": "d810522f-8fc9-462b-ba61-5e2904590324", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019399, "uuid": "47b78ca1-5a72-4a4b-b737-8a120ed05929", "value": "12288:czmI7l+NMu6AzfSjzOgiEtqzlQDZ3+gp/g0UZHu5fmL:CmN6QfmzM2yQDZ3+gVgO5fmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019399, "uuid": "6a9e4152-dff9-46d0-ad14-94390fced22a", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019399, "uuid": "882ad7cd-d545-477c-92bf-64c263476532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019399, "uuid": "0688ce11-c2d6-459a-af9a-56710bcbcde2", "value": "PO HGD-062-26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3de6d2f-e8ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683005967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005967, "uuid": "2a4bf50a-905c-49ae-a450-cd8c52cea4e9", "comment": "Malware payload (Formbook)", "value": "3a1f0643aff3a74eb7cbf7e3e998e213", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005967, "uuid": "0ca4e93c-e198-426c-896c-54dedf3a304b", "comment": "Malware payload (Formbook)", "value": "70bcbadb3a0abc69b680eb0fdb9c28073dcac6cf7230c855c2bac00943d81485", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005967, "uuid": "3a99f732-fc76-4afc-8839-982a038eb8b0", "comment": "Malware payload (Formbook)", "value": "8f48da3b1ddf4da7006dd0a6bfde7ed18120be71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005967, "uuid": "6a4aec23-46e4-4b4b-9ffb-98ad0056007b", "comment": "Malware payload (Formbook)", "value": "62035647b5fdf8e18134611bebf230ad1586c34dcb78626c9a8f55b789e202e2e6571e70216343ec9e4e557f2e86c0fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005967, "uuid": "29c61318-59b1-4cc7-8560-a250cb9b6496", "value": "T1C7F4CF4121B4CF2AFA399BF40064FA4423F2BC3754F5E1690EB670C6DAB6F050E65A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005967, "uuid": "b2cea434-e9ef-4f75-aafa-bf137ea55e9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005967, "uuid": "366f62fe-4d9a-4d9f-8bd6-4577862811e8", "value": "12288:U4d2iNvbFyOoUgPKmDRdJeNqJEQv2dot7845uTl:/1tpyOoZC6RfeNt6tJ84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683005967, "uuid": "8d632f53-da85-4d4a-b83b-4281d8f66fc8", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683005967, "uuid": "f9a08f94-a5ce-4bd8-809c-5883d311d5e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005967, "uuid": "47de0a48-b21e-472e-b122-5700f9252492", "value": "Hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed7d1c6-e91d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683054733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054733, "uuid": "6b9b9f77-3541-449a-af6b-919197e7db97", "comment": "Malware payload", "value": "f501bd428377b0409f3c19b0be19643c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054733, "uuid": "1581393c-ce63-4c90-a0df-4f9eddd65743", "comment": "Malware payload", "value": "70d07397898f5f1ff1151749648c1208019f139a4f2a242a0e5759a4a8b5c8fe", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054733, "uuid": "2433582a-208b-4f6c-87b3-59cdc52c47c8", "comment": "Malware payload", "value": "d1b655aa1237992853ddb3dc8feb7a24a5cc6b10", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054733, "uuid": "3e78fe83-05e8-4232-9e33-91827ed92060", "comment": "Malware payload", "value": "439fec7fa51f143a49d904fe511bc26bf6144fc78b98bcca344656f0a7d8e8e65aaffdf95af5ba872564706421df5054", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054733, "uuid": "770784b9-c455-48c9-9eb0-6d353ac2b489", "value": "T1C0B42389A833B421F6041D9716FD73B2E7E28374419F7C167A6B0FA41AC33849EE6D61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054733, "uuid": "ffc91515-afea-457a-8035-461ff4468ae1", "value": "12288:SbSrFv7AWZ2lPCNbjQZO4lhPXchLgekSIICsU4O7XLATfxh:SbS6WmP9Z3HvcCjSIICs5OrLAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683054733, "uuid": "a89184cf-d7de-4193-8389-ae56a921a72e", "value": 537658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683054733, "uuid": "126d261b-a218-44ad-867c-d5f235e6272a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054733, "uuid": "0a380676-fb7a-41ed-8147-85213c4a4eba", "value": "INS Rem CrdT TT copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a65aaa4-e8cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683019990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019990, "uuid": "7e1ebe7b-9b04-457f-8e5a-551dc1955551", "comment": "Malware payload (Formbook)", "value": "4d4fa95111e180bb6072b32c98ebeb28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019990, "uuid": "03dbc4bc-cf4f-44e9-ba12-219f0c912e25", "comment": "Malware payload (Formbook)", "value": "7145d9d7dd02971872d0f257c6d833125882a9a710d5a631f3f4e2adcdfec125", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019990, "uuid": "2adb1dd5-0142-4145-9b57-4b28aea14e20", "comment": "Malware payload (Formbook)", "value": "dcce0de0ddb73ff8acb0ffa7ef095724ac4f2487", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019990, "uuid": "b70cf6f7-384a-4734-84e5-30cb125e221c", "comment": "Malware payload (Formbook)", "value": "81ab42299c23336cc3697917171c99734af663512f6fc577bc93febd7597bd1862c077925230202c594882574c49d920", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019990, "uuid": "fb7b4133-92d2-466f-9bd2-8d1f6f2325ed", "value": "T196E4D0136056CE17E96587F84170FB9853B8BE7349E6E1582A7A30D2C9B2F071F4C89B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019990, "uuid": "99a057ac-9379-451b-9754-c761a7a336a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019990, "uuid": "8e579060-1e02-4c6b-9c03-e0122f274359", "value": "12288:8V2njoB4CyjA6o5Lm43oU5xIReaukz9J30ndi+0InQmJxRHHE6mRsc9gC8NLhPtD:W4VM9x/3z4R9uUJkndb0InsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019990, "uuid": "d6df40e4-9e66-41f7-aa5a-0516e585864e", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019990, "uuid": "f41bfd6e-7541-4e44-970a-95222cab9f5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019990, "uuid": "363f6642-33c1-45fb-99cc-d2b31c0666a5", "value": "Hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fbfe07b-e91f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683055647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055647, "uuid": "6cf41759-f003-400b-9f58-d5659b0c92ac", "comment": "Malware payload", "value": "d8942f4a942d49c61f90875bad2e3bd0", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055647, "uuid": "7a999984-4261-46fe-b010-2e9683edeb93", "comment": "Malware payload", "value": "720b4ea73cbbf0d6cda0398747438500d108af0916e211065756337e13d45196", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055647, "uuid": "6f10ba40-319b-4e9c-aea2-30ecb60a51f4", "comment": "Malware payload", "value": "945119934df86fc6a74de91ba90038a55900abea", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055647, "uuid": "5fa68152-96db-448c-8027-84fc0ce3dd38", "comment": "Malware payload", "value": "08ffd8cbfa7ff04c70da5156e0fc3d0dbe96ef833076c8943a8740a08aec1cb5167f407c5d33330a7bd6ac96cc6ef12b", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055647, "uuid": "76f4c284-10c8-4058-bf1c-96c1392a3925", "value": "T1A8E42385EA9F3893CE5F2C739E6F95F988E2E20176F9556EC4B39F04592D42D1C001CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055647, "uuid": "9b91243a-dac1-43a3-86bd-cc2dcacdd570", "value": "12288:+58EJGInNpv+k12Zia11dVAuXZsspjs7phI0yIZxempHjk/4:WbBN5+gvmSsK7phryijpHjkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683055647, "uuid": "aef9d053-9c0d-4591-87a2-68ce4eda7b65", "value": 688824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683055647, "uuid": "40d3ba08-27d4-4935-baac-0cd14f0ad0b3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055647, "uuid": "c7e64352-8f21-451e-88e8-35df982b69e9", "value": "New Order PO 208472747_IT.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2682269f-e8f5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vjw0rm)", "timestamp": 1683037512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683037512, "uuid": "e2f3f344-652f-4c5f-ac14-fdc94e8ee87d", "comment": "Malware payload (Vjw0rm)", "value": "8aa7859f1d6f56bb1d077b28134f5e06", "object_relation": "md5", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683037512, "uuid": "abe7c9af-4755-4044-adcf-6bd6a61523f8", "comment": "Malware payload (Vjw0rm)", "value": "72ba4bd27c5d95912ac5e572849f0aaf56c5873e03f5596cb82e56ac879e3614", "object_relation": "sha256", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683037512, "uuid": "e04b1922-4f3c-41ca-ba7b-12af54c47ba4", "comment": "Malware payload (Vjw0rm)", "value": "5db3b86166730fa4f0eaa619c1c533710bc2256a", "object_relation": "sha1", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683037512, "uuid": "efae3bf4-e9fe-4ff3-b602-a04aae89828d", "comment": "Malware payload (Vjw0rm)", "value": "f93e561fcf99bb516a2e53fdb46469dc89aa8846da55209567268924be5d858c487d44498361905dac68938d9bd13acb", "object_relation": "sha3-384", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683037512, "uuid": "e78b65c1-7d9f-457e-a01b-82c7cb0603e4", "value": "T194178D34B3F04FA2D1A9063B9AE1962956FC6E48DF76C38BD160388564F2FC16E4125F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683037512, "uuid": "6d43bc14-0790-4b88-8e82-1b5d219718fc", "value": "24576:wS5Sjh/M4YK6dJ5oA8F2nFnHb6T8Ujl6vO01C1GCTsYoQZtlsZdc40QDrUYuGG1p:B0jVBkBHdTUwTGTTOWjBiO8pG+C3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683037512, "uuid": "cefc6a63-594e-46fd-a71e-f9e0b2fb7172", "value": 18919424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683037512, "uuid": "52c454f3-4026-45d9-80ad-30f811410f90", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683037512, "uuid": "788c6b77-8465-4a6e-a766-82723bc4f47e", "value": "invoice.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e76aead-e8ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683005689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005689, "uuid": "1d1ea28c-6e9c-4d02-8421-3389632b6dc0", "comment": "Malware payload (Formbook)", "value": "1c2813ce588a985cf09c6770f6d90ef7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005689, "uuid": "6025fcbe-8f51-4545-916a-8a5a402cb870", "comment": "Malware payload (Formbook)", "value": "73590981b7857ca8bcc0b3146eb889c47b16be2ded82056930a8a227940f1fce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005689, "uuid": "394a35cb-97a6-45b5-885d-fe707266cbfc", "comment": "Malware payload (Formbook)", "value": "ec183a96758806b7f27c07806e61f9c37c883d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005689, "uuid": "75b73892-e5bc-459c-8ab1-8338c7e0a406", "comment": "Malware payload (Formbook)", "value": "81e1823316ff49c5d607b50d0e8421f7f0fb88285d17ced508bb9603ada77fe785faba837cd61a499501b873026b5936", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005689, "uuid": "818c32a0-d916-4562-858f-8f08cf30a8fb", "value": "T13042D610A3504590EA528D328CA39B580137F923483AAF5E37CC5E1F6F37EC99572B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005689, "uuid": "fa5a7534-d61d-416d-ae59-8e1d6d9783ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005689, "uuid": "f6ac452d-a5cb-47ea-9328-b491128afa14", "value": "192:n2WU1f8wiInejkKVfkPHLMTNeTW3GNeT4+vDX3dwjiGN2s:n2v4WejkKVf1TNeZNek+vDdw2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683005689, "uuid": "113b2e7d-7b2a-4bf3-9839-c99424b98d90", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683005689, "uuid": "3913e9c7-e7af-4870-996b-bd9396006b7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005689, "uuid": "bd694afe-9ac8-41f2-851c-aa9b681827cf", "value": "DHL_CBJ5012315242.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a76a7db-e8c3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683016125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016125, "uuid": "4c1f7d6e-1a4c-43e1-92a3-9c268d807d00", "comment": "Malware payload (AgentTesla)", "value": "5484b1c200efd72fc7f1489e7a823592", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016125, "uuid": "495110ee-ab23-4d37-b0b0-bb8a33c9d0ac", "comment": "Malware payload (AgentTesla)", "value": "74364dacad18ae5d6930c6b8d3c41210ef3d3c2c7899386c2b2c17d7c84142ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016125, "uuid": "695bc3d1-cdfc-4643-a224-abf2a1cb473b", "comment": "Malware payload (AgentTesla)", "value": "a92ceb830f156d380a313df9b96b791667632644", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016125, "uuid": "eb95f7c5-cdb8-44c0-81ed-a04f00eddde8", "comment": "Malware payload (AgentTesla)", "value": "6497d6b827d1644047e2325f3f85c4f2c5d05d91133443cfcb0523206d067e7bae3b42b61001bc130b81ae406bf07f0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016125, "uuid": "a16d59b7-9882-4256-8d94-708e6a82272a", "value": "T12825ADC5DDA0CA46ED2597F2D1ACFA8052A0B4635BF0DC2D1A7523C5D9A7B0DCAC80DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016125, "uuid": "260d7259-0b2b-4e24-8c0a-83615da40267", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016125, "uuid": "ed1a705b-417e-492f-a128-54abfdb418bc", "value": "12288:+Ty6pmZQnlF2MTNNVBJjD70z7mtG7Fb9s/HHXgSzEqsLV7hkOuIFC:YpEQnWMX5P7yB9WvEJLV7vuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683016125, "uuid": "883cef51-44b7-49d0-9a2a-89f176b25252", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683016125, "uuid": "d06e4f94-65db-41df-bf97-a871f60f68cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016125, "uuid": "c39ef71a-9ed9-40bd-8845-ce09c7e06d48", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b78df34-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683013415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013415, "uuid": "9dc4603c-2380-47d2-af5b-c1335a50c6cb", "comment": "Malware payload (AgentTesla)", "value": "71ec5221a2034695e676cf553ef632e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013415, "uuid": "6b0e0acc-875c-484e-bfb8-1909337a9517", "comment": "Malware payload (AgentTesla)", "value": "746604779bf099b84b5a237bc6e777b10cd9ca0d02e49e136f4856debbb89d65", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013415, "uuid": "7d1a829f-b66d-46a1-bde3-56c5343e4a8c", "comment": "Malware payload (AgentTesla)", "value": "e724930b8c2aed088d4d205ac882197f8b67e462", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013415, "uuid": "ff707c1f-a01f-48da-82a1-6a882d4e8a75", "comment": "Malware payload (AgentTesla)", "value": "ed26318159e7c9f6d412acc2b9b2e7c9e1f2b292b89697e08e1a8bf6eb4b18c95a3107565a76f59b18c0d6512167f22c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013415, "uuid": "ebb7ec42-9ebe-4753-bd29-024bc4f1f107", "value": "T1AF05483C19BD263BC179C7A68FE5C427F114A8AF3121AD6598D787A6034AF1235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013415, "uuid": "0ed076b1-4043-45cb-9e19-602161cc6395", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013415, "uuid": "9231c7ca-9015-4d4a-877d-96ac9bd37842", "value": "12288:yc/9WflU/9K2tNHlu3elvjE63hjMLsGIWb/yqYHDC92OzfJ/:hylUHtPu3Gl6IAyq/2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013415, "uuid": "34d24dd0-308c-4a2a-ad6c-5c7442db2a41", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013415, "uuid": "31bed59d-ee10-4740-aa00-a60a67789c11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013415, "uuid": "93e99e06-07c5-472f-b070-92e464a6b169", "value": "RFQ_#2573664_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eea400f-e8ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683006334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006334, "uuid": "8dd84ceb-1510-442a-8612-d6a7117511cd", "comment": "Malware payload (Loki)", "value": "bf8678f9fed47a79e79d5e87ce588dab", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006334, "uuid": "9e386740-b28f-4652-b857-147139907c2c", "comment": "Malware payload (Loki)", "value": "747c08f3e6b45582d4c2227f0b64b216e6ab4849728c24099cec65cb16e0a885", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006334, "uuid": "e23b77b0-8daa-4618-973c-d7b26ba9f5c5", "comment": "Malware payload (Loki)", "value": "2d29705fd6f2dd24954a75fa7dda6f119680e9f5", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006334, "uuid": "7021b10d-2207-4c45-92c0-80b691b0ae31", "comment": "Malware payload (Loki)", "value": "285394588baf3582831625a37ccb1b870eec4442dab014f885e082e136f65e7352f7fe08355e7eccf6b291e28e8c2c76", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006334, "uuid": "ccccce47-a756-4fca-8772-2fa31868572c", "value": "T1E1C2A356E79A13B48B8102B1271F1BC9AB7EB03DB3509171386C937423E5C7A4676AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006334, "uuid": "1ea3a004-0391-4513-a413-319c61a4f2a3", "value": "768:4Fx0XaIsnPRIa4fwJMAoVpomRn0GUsde1aI2u8:4f0Xvx3EMPt0G3ap8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683006334, "uuid": "0362d7e2-7416-4959-afde-226c87af42a9", "value": 26691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683006334, "uuid": "f00fb4a4-087f-4405-a22d-8df8192b92f5", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006334, "uuid": "008e8ba8-5f13-4d12-933e-5a4c3fcefb41", "value": "PO_4302023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9d1fe1-e8ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683006434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006434, "uuid": "b4768400-27b8-4cec-a2f0-98907660233a", "comment": "Malware payload (SnakeKeylogger)", "value": "1a745ec729be5f2a5a43370840bb202c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006434, "uuid": "2cd3a9ee-1859-478c-a018-3926ee1056f2", "comment": "Malware payload (SnakeKeylogger)", "value": "75a590c715fffa15469f377ee398e84f033be800187f3092fbfd5c1df4fbef58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006434, "uuid": "d7cc489d-2440-4217-9630-9b75ddcc32d4", "comment": "Malware payload (SnakeKeylogger)", "value": "a6389f3df128b015d4b478993dafe1e867c18157", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006434, "uuid": "08b7ad64-7a49-4e18-809e-27b3d516ec51", "comment": "Malware payload (SnakeKeylogger)", "value": "9e551746cd3220579b4f573edbe4aa2bef1ef683adaaa7cf43a5526c7a350b48e73b55e4a31eca4254821a3888a2ac63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006434, "uuid": "3ffc5e43-a313-471d-a162-9ea3e73417a4", "value": "T178D4CF0221B4CF6BF93ADBF40464FB4427F1B43754E5E1281EBAA0C6D9A5F050F64A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006434, "uuid": "0b52e9d8-9ee9-4f04-829a-389b3f68f7a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006434, "uuid": "59b69369-f236-487f-aa43-d1a4b62785bc", "value": "6144:tXWOVOsbiZJjKd7DbxW2GhNO+ntAz/CzBIbhDuVcwvq/PoFeytkXvF7fIpNHhfU5:Ji2iNvHm4OXIkbgCiwMnDIfUQ94oH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683006434, "uuid": "6949e875-95db-4fb8-aed5-064fd19658f3", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683006434, "uuid": "6994221a-6b65-476d-b9ba-c5059c0e5f90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006434, "uuid": "8c8f3987-7c2e-4701-a374-949c7e399876", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea36983-e8fa-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683039727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683039727, "uuid": "475af257-3860-4690-81bd-5c883bfd7ec9", "comment": "Malware payload", "value": "d2570a173d8461c3b25e3f60f90b4dc0", "object_relation": "md5", "Tag": [ { "name": "obama259", "colour": "#8086B6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683039727, "uuid": "bab87c54-9edd-4e85-81a2-060bc2810eee", "comment": "Malware payload", "value": "769419991aa952a71b598f76acfca9e5e27853b7bc01d77d73317b405bc07ab0", "object_relation": "sha256", "Tag": [ { "name": "obama259", "colour": "#8086B6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683039727, "uuid": "0f9b30f8-4496-44bd-9281-019aabcbe771", "comment": "Malware payload", "value": "3e865e11ff9bd443bc469ff1a87d9986814eae1e", "object_relation": "sha1", "Tag": [ { "name": "obama259", "colour": "#8086B6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683039727, "uuid": "2d707cbd-31c1-4407-994d-10b890d855d2", "comment": "Malware payload", "value": "fb3bc2a64613a9767fda606fd56540fc893ea5ff05a074cdaaddbf925a40d94376469bc4c996d2e92e4a8c852ba8f6ec", "object_relation": "sha3-384", "Tag": [ { "name": "obama259", "colour": "#8086B6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683039727, "uuid": "6ceafcea-dde6-4198-9415-72f3f2ecbd12", "value": "T1B862D0A7D09324E39E7671A6A06A4D49C78C0D43143FEB256FBA0136640F96B42FA3D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683039727, "uuid": "ac3a65ea-c67d-4459-a8ee-2e40cb4ef719", "value": "384:ueG/HqbbqanQyNkiduOQOk7YnVuF4DxpPTuC1xIVJmijLMMnz:bbg5idHQYndxpV6LMMnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683039727, "uuid": "f6b80509-2e92-42e9-a3c9-3d00203417af", "value": 15598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683039727, "uuid": "a2822a1e-9150-4098-856c-8c2e278966aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683039727, "uuid": "813ef592-95bb-4431-8280-cc229a2e4762", "value": "644b9cd60b520.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f802f8b4-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683013383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013383, "uuid": "a21f5f1d-5141-4776-babb-bc66a0619563", "comment": "Malware payload", "value": "003f7ba125be369ba746843c0dc5e841", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013383, "uuid": "4ef903b1-08ed-46d8-940a-8f8809b74264", "comment": "Malware payload", "value": "785e217edb98a2a08c5604cfa9a6a002e7c1a61a73f5dba18cec2d3ee2a81e83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013383, "uuid": "f90eeb54-45b8-4500-b08a-cf058a03a9af", "comment": "Malware payload", "value": "67d5a9d56cc663f4c32a2bca43b3ad186db76532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013383, "uuid": "919ef56b-6463-42f3-b4f2-8dc4ce0ce9a7", "comment": "Malware payload", "value": "b1b2d29217ef5cd6d3654554b6211de361c5b51fe7d7297b7a93ac123ffc04d7f90271b310d578e8ea340005e2ae1f22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013383, "uuid": "169dd730-0b2f-492a-8195-c15e0b36e037", "value": "T12F443AEEA5EBE047FD31DC749ED87B268627147D8E1AC3E244D8F4602920367CA95B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013383, "uuid": "68f85d71-ddb7-4895-9404-25ad88920024", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013383, "uuid": "1b184e52-174b-4963-93b1-cf0c7e949bd1", "value": "3072:9DJl9jA+980gs7Dl/IUXUxvnIyIBn9Ngh7fJUas4ctb+stoGuWz7FRJOb33YIh1o:y0gwNKEEJU/48AI7Fi8Ih1FNtRQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013383, "uuid": "c42ec7a4-4fc0-4e70-9ece-cea2f4423d90", "value": 274272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013383, "uuid": "8c8cc72b-bef8-4337-b604-b43f996be3ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013383, "uuid": "f7549326-a903-43dc-9f65-fd245440d5a3", "value": "FACTURA_FINQUESCERVELLO.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a221b24-e8f6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683037921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683037921, "uuid": "8f2cb57b-2094-4165-9b36-ed40c9283178", "comment": "Malware payload (Formbook)", "value": "70eaa6ae1ecad9b014dc74c309cd7375", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683037921, "uuid": "7cd7ed45-9dbb-4816-ba2a-844bfa736bf5", "comment": "Malware payload (Formbook)", "value": "787749eb7f58d153e79642ec221d253fc05da6fe31db65e423f14d02ab4d87e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683037921, "uuid": "dc0a35f5-004a-4f25-a960-f7eae2a6c272", "comment": "Malware payload (Formbook)", "value": "b33e152dce0ff8edce7b8a3b846b4ab5d554f2ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683037921, "uuid": "de6588a7-4c0e-499d-926a-f3c364290142", "comment": "Malware payload (Formbook)", "value": "63c1412be07803c58bac9ddfaa19ab56b4222edefa1934b2f71436a204e6c29389177a0933cb0badea477222fca1ab06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683037921, "uuid": "f15346c7-164c-434c-9f27-66b65440e59b", "value": "T180F47B382B6B1FA2DC78EBB7D6645416B3E4F55BB21DDE283CDA1085060384375B32AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683037921, "uuid": "5998297f-73b2-4bc7-b5e0-f34abe8da410", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683037921, "uuid": "0d9c5c97-df2d-4a82-bbcc-8565c7cad35e", "value": "12288:x9LHC6YN1PR+70pKXQlIj5g15ik/mYpqhuahR6nWwUUYrASH9FZZGjRerRnHFuYE:X5g1ck/mYpwuM6WTUpSHnsUhlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683037921, "uuid": "c09eb58f-b194-4985-adbd-f23b0f88b7f9", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683037921, "uuid": "60db5371-6d4c-47fb-8c76-019f38202877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683037921, "uuid": "6ba57391-8b19-4a05-8d5c-33259921fa0f", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f18d818-e8bf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683014522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014522, "uuid": "a2f6e18e-66ac-4338-97d4-1acbde8c8b6c", "comment": "Malware payload (AgentTesla)", "value": "5885ec05abbae4117e7a363948f28735", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014522, "uuid": "561f069c-eefc-4f12-9fe3-8a1b70198e93", "comment": "Malware payload (AgentTesla)", "value": "78d0387b41098b1a5956377826eabed47775d90d353c0aabed5210412d1ef25d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014522, "uuid": "a36a3c16-7b47-460e-8ce7-3b754eb71dad", "comment": "Malware payload (AgentTesla)", "value": "6ed073128f0032f8122ea888f6f96a278c01c574", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014522, "uuid": "09ee7399-2707-408d-aae9-40b88f4e0f75", "comment": "Malware payload (AgentTesla)", "value": "8cb3d2e758bf67fbcd4672d13aa666e7edb79bf5961742c348c184992315dc41e1c1093d6ad02ae9329b101718fade3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014522, "uuid": "cdbe5026-439f-4bd8-8e82-69429529a1aa", "value": "T195D423925EF4A5B8357B22EC17FC769FF84279177AD502CE2007458258A1B3BCF9A40E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014522, "uuid": "688d8db0-5a28-46a8-8360-a9f299933c59", "value": "12288:2IE8HeACL7w6CAnJ1fG6bIP04+rVldU3kb4NBhSRHxijXfVTPEQXu:TE8H3U6KG1P0vrbaBWxWtn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683014522, "uuid": "ea77c2eb-1250-447f-9a98-50eef6d2968b", "value": 647959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683014522, "uuid": "564a11fd-bdb9-41f0-a7f6-993a58f7e359", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014522, "uuid": "fec8a13f-6db3-4a93-bd46-2777f3e9b7f6", "value": "NEW ADDRESS LOCATION.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb28970e-e8e2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683029682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029682, "uuid": "3f684647-839a-47f5-ae33-2517b0c9853f", "comment": "Malware payload (AgentTesla)", "value": "3317f716392e2abd3fa735b6f08e6706", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029682, "uuid": "50892e7a-1c0c-4b95-9156-d4fefb615075", "comment": "Malware payload (AgentTesla)", "value": "791323da206a57c0ad79545cbbed9f97b0979d578689982a5b2ce6f2ec7d0534", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029682, "uuid": "541a4758-fc38-4b60-9315-ef1eb84ff754", "comment": "Malware payload (AgentTesla)", "value": "75139a245283f184a21ef20919e706c32279ee0b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029682, "uuid": "31b71042-a955-4353-b9b4-2e15f5c1525e", "comment": "Malware payload (AgentTesla)", "value": "c54792d55baca19fc6ae033cb3637f48dc46b75efcbb232e8b19ad1878644342956fd4e1590c66cbe8473523bd9b0ea0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029682, "uuid": "ff3208e8-82eb-4c1c-b44c-b655013939e4", "value": "T149C2835AE79A03758F9102B5271F1BC9AB6DB13EB3518471386C837423E9C3A42766FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029682, "uuid": "4cdbf706-e500-42c4-9208-b032e027b6fa", "value": "384:XQMmdOFNYY0aaaIswqPeOrka1+fHQJ+t3rQkRhZpZB+Ot6X9FK/s936639ESJ+Wa:NFx0XaIsnPRIa4fwJMWSEHc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683029682, "uuid": "ccbda8fd-df77-4d43-b722-5e08f793d366", "value": 27369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683029682, "uuid": "afc0e39b-9414-4cda-8bbb-e127f358e92c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029682, "uuid": "10f3d1b7-1e9a-4d4e-adc6-0e89f77d94ef", "value": "Contact Agreement.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb90969-e926-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683058734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058734, "uuid": "25ad3586-1147-4af5-9870-6b260dde65f5", "comment": "Malware payload (Formbook)", "value": "07d88b39efd596674939bdcb015965ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058734, "uuid": "563d88ec-ec28-4aad-bd93-c7dba1420d2b", "comment": "Malware payload (Formbook)", "value": "793fd72de26ca82fbb56a14449a994058f34b4dc3fa1e7562ad32e5b405d3659", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058734, "uuid": "de2b6d9d-7d06-483d-832d-37312bb703cf", "comment": "Malware payload (Formbook)", "value": "cb003424683e922dcd18ea8dc3fe6db72fd5e694", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058734, "uuid": "e5ca6def-621c-4d74-b039-5e8e5857f8f2", "comment": "Malware payload (Formbook)", "value": "641e72d060bfafe773a3a6fa47f3ae1cbb490ed0febb5883c1367b786ea97f3f213dfb02917ee3565cf823898ec13c09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058734, "uuid": "c881ee4a-acd9-4ef3-b201-ecf3a05bd2da", "value": "T18F6402126A04ED67D97902B238B3D632CB615D4499154643ABF2BE1FFCB27874E0E393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058734, "uuid": "ba0e3f30-372a-46a8-ac60-e5ae1d1e198a", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058734, "uuid": "fdcfacf5-5858-45cf-b4af-2a53a841836e", "value": "6144:V7ewbW4Tvmpj0et4b72tQ+L6fLq3vJlq4tfR5VcJ6rfB0yj+OUu:5VbWhpn4bte6fLovJV5V66N0iUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683058734, "uuid": "29cf6fd1-ad59-4f8b-98db-9f1bc4bf53eb", "value": 309288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683058734, "uuid": "20ced7af-389a-41d1-824a-6ffc3cc79185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058734, "uuid": "78659927-f9f2-4867-b340-da5ec362e3e3", "value": "Official Signed P.O no. MGE-WJO 9006220, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ec4322-e8ca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019387, "uuid": "00d035d0-64ae-4302-969e-7b86cfed5c8a", "comment": "Malware payload (SnakeKeylogger)", "value": "51bb2cd3a440b03b8f3395668bb7ed44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019387, "uuid": "9b6a6bd7-58bd-4b6d-9f05-ccd14d4cdb71", "comment": "Malware payload (SnakeKeylogger)", "value": "799ad2554344216d192896a517536862c2435f054182bb8e468f6dd9f15f3e33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019387, "uuid": "d7b2235e-f21c-4dbd-934c-329deb1da6a7", "comment": "Malware payload (SnakeKeylogger)", "value": "de675a2e334b5d1c30f52184cb1b2c7c9e071656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019387, "uuid": "7a38e3ef-2560-41cb-9059-ac2b919f98af", "comment": "Malware payload (SnakeKeylogger)", "value": "f0f30a74bf4324efe31ec724f1ff3417504526c5e377a79ce35f267aca9fabdd13a724c9d009b9b491895280fc7eb6f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019387, "uuid": "4f8c5727-490e-43e2-afb1-dd5488b708f5", "value": "T1F0C4CF066165CF1BFD7A8BF19474FF8463F0B07365E4E1282FA620C6DAA6F101E4991B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019387, "uuid": "aff6a7cd-8da4-4a4f-bfe1-97d4a349f4ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019387, "uuid": "aa0215d4-329f-47c6-94f6-df6afe2d1c03", "value": "12288:VOhXGPstv/uHCuBHzmZ5i7TzVx0vq60btUP+2wuZ9Cb6rh:GXGrxk5iwq60btW7//h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019387, "uuid": "7f683596-dcf8-496d-8d69-9cab21f111cb", "value": 553984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019387, "uuid": "fd839657-198b-4427-a367-02f7b67d81e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019387, "uuid": "5070887c-a6d3-48d1-9bd1-37961f088e11", "value": "VESSEL DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb21a69-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683013395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013395, "uuid": "227049a3-57c2-49f9-b875-02f4ebc0522e", "comment": "Malware payload (RemcosRAT)", "value": "f35c5aa1435e921f2d5e2ddafcf73b19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013395, "uuid": "e760a3ff-8168-400b-a33f-2fc1760b907b", "comment": "Malware payload (RemcosRAT)", "value": "7a1cd0e91238713dbcd41db9836bbf23b37a558d5c31fc35e0d52b5e4581c4f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013395, "uuid": "1d069b20-2b3d-4dae-b250-89cd8a2fc351", "comment": "Malware payload (RemcosRAT)", "value": "d68c83a90bff954e9e6000c501a7f59bd2e8b384", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013395, "uuid": "9260a707-4742-466e-b29f-58fdf027077b", "comment": "Malware payload (RemcosRAT)", "value": "7b39b02f5c2dd38b545640281b22de0338d3a87efe203615fd3c15ec7b023e524355e83b76742773f2a17e60b9212c38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013395, "uuid": "5f691211-6cf4-4ec2-ad59-783fd42b5c01", "value": "T179B42349E7A1E627CCE216F15C369A01D5A58D116422160B03D5AB0DBAB324CF52FBFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013395, "uuid": "969f97cb-813a-473e-bb25-2c94e77e9962", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013395, "uuid": "f416fd5d-32e6-4d52-958d-cf76b5123789", "value": "12288:eY2bpNOpGHPENUFmEc9EHCfVSS/r5mKdZn:eY2VNOoHPDnSYCdSor5mKXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013395, "uuid": "89357527-6dba-4cf5-b995-a0063b7aa57c", "value": 541898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013395, "uuid": "1b68e4df-7b16-44ea-b7c0-55345b0291e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013395, "uuid": "955654ff-0a66-4b8e-b3c7-e82af7c62188", "value": "New purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b19d37-e8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019476, "uuid": "f347b626-b121-49b4-9b38-ce98eecb7743", "comment": "Malware payload (SnakeKeylogger)", "value": "b87ccb38d408270f66f79e7d0e9734b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019476, "uuid": "b376b7ce-bfd0-4020-9839-3409d7e9f242", "comment": "Malware payload (SnakeKeylogger)", "value": "7ad28fb37f9da0fde0ffb177a30906f48388e89e61ea5e8decb7e94e06661504", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019476, "uuid": "4fcf98e2-d783-4142-8d04-2cf311fbf955", "comment": "Malware payload (SnakeKeylogger)", "value": "eb3f89cc8572d102931e2a4be4400178cf4ef8d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019476, "uuid": "a67fd3fb-3d56-430c-a5a3-56c15c818661", "comment": "Malware payload (SnakeKeylogger)", "value": "d7268fafe0da836e7d67894d5127f2448083ab1807aa9bb8f73bb3287fa271fc58d8399417f5f900f94c111c62e617d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019476, "uuid": "c564c8e7-659e-4026-a76c-ed43320102a9", "value": "T123C3285D2BF89900F5FF9AB305B16112C375BC12192ACE0D4AD1F65A2A7D690CD0BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019476, "uuid": "e24ef3b2-792e-4c63-a6b0-49d1c67bffdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019476, "uuid": "172154ec-5219-4a57-b383-06a5899e62ad", "value": "1536:4tMpEvqHEIsang0ly+G0/nE+vBUFrlY9DZKkAMFFORnT/G22C7kbKuzPjaQlBUpx:4tMKHE/tDZvORT/G4Qbfrm4B+wBjFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019476, "uuid": "0c55d860-e9e8-4c77-aa36-2a6c0ba5d87a", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019476, "uuid": "7dfd1315-d356-4549-bd1e-d5209ae52dee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019476, "uuid": "cb42bf21-96fc-47ac-b565-f560e910c0be", "value": "b87ccb38d408270f66f79e7d0e9734b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694ad4a7-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683013143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013143, "uuid": "6452f0ef-de7d-4373-9189-19a90be12f3d", "comment": "Malware payload (Formbook)", "value": "b432cabe91966162915095832bf8da3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013143, "uuid": "673c381f-044d-414a-b1e5-9246536edbd9", "comment": "Malware payload (Formbook)", "value": "7b222afd2a90cd509e30c2d7bb748e2de92feaba064da9acfa84ac7684768d72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013143, "uuid": "9725feea-9d1b-452d-8d0d-6e179690b695", "comment": "Malware payload (Formbook)", "value": "4960a290c3a8c69d5fa1a5084e5b22bebb549ae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013143, "uuid": "e170d113-734c-4780-8420-7df76cf20928", "comment": "Malware payload (Formbook)", "value": "eb33d624b51d0be95c62efa60b396bdd1c0f0b51f8c67757edd93606b03d48574fd427fe3cbbe9c8af9f1d2fec69007b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013143, "uuid": "905c55e9-aea0-4e32-a8f8-944adc56983b", "value": "T161D47D3D16BC6727D17AC3799AD48413B3E0A85F7221ED996CC603E60753A427AD323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013143, "uuid": "bd67aede-df76-413d-bb3e-5b52cae2ce14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013143, "uuid": "17a39d6b-b411-4bf8-8149-a85a7c0694d4", "value": "12288:hT5Fu9kbmHSVgNJS6L6EKKNpTxr85KIaLFnnFubOLGO:1u9kbG68XW745SpyFnFuKiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013143, "uuid": "f028fd07-c1a1-4854-8692-ab062d316f75", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013143, "uuid": "634c64e0-3296-4339-bb65-4608cc095419", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013143, "uuid": "13457fe6-ae54-40c3-aeca-8e19278b90b9", "value": "new orde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a834f321-e8dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Ebury)", "timestamp": 1683026993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026993, "uuid": "87edeafb-4223-446a-b71d-dc8035857630", "comment": "Malware payload (Ebury)", "value": "b2cb202971a069915925596b73693f35", "object_relation": "md5", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026993, "uuid": "d9334948-a315-4fb8-9f74-c9eeecdcaaa8", "comment": "Malware payload (Ebury)", "value": "7bae0b84d489f027ec6d46ef925058fe04f6a74a2b561c79171b9747ddbf9d79", "object_relation": "sha256", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026993, "uuid": "1b776f85-8ad4-437d-b74f-14593b1dba82", "comment": "Malware payload (Ebury)", "value": "0c205c4c7772be8e222fc577f7fc7db8ac69cbfd", "object_relation": "sha1", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026993, "uuid": "b62bf8dc-af25-42be-80c4-5e62dedd8be1", "comment": "Malware payload (Ebury)", "value": "6f064a6e903ab7697bda45e75cadf37acf9619f1e40af4e4045204cf1d3978683063ddcd9e6f95d9ef970508c39b4ae2", "object_relation": "sha3-384", "Tag": [ { "name": "Ebury", "colour": "#4BA4D3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026993, "uuid": "4c316b54-8a05-4316-9d98-8c63fd987fad", "value": "T1CF033B67B5D4443ED54EC7708EDFC6330AF6B9896A3232CF29C46A713F22A190B1E615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026993, "uuid": "70c673ed-cf0f-4348-be43-a8a1dae41da6", "value": "768:b15Tlua8JhxR/bVGE78h5vGkrdVus4BrEVCAE:bvluhD3/bVGN5+k2s5Cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683026993, "uuid": "0ccdfcfe-a840-405d-9bdf-aa1a9c81cb58", "value": 40224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683026993, "uuid": "90c5f4c3-4b89-4726-b72e-5444e47258f2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026993, "uuid": "c341d1b6-1295-4dd4-a6c1-773c6292ba51", "value": "7bae0b84d489f027ec6d46ef925058fe04f6a74a2b561c79171b9747ddbf9d79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdbc508-e910-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683049447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683049447, "uuid": "3114f59d-b556-4935-ba29-cf0e53c0ad0c", "comment": "Malware payload", "value": "17c7dc612ab439c50db10d2b9c6be386", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683049447, "uuid": "478e4dd3-5e09-4b73-a18e-42fc35d47101", "comment": "Malware payload", "value": "7c097aac7fea970ff441027a817d7a03b4556262747bc0567f9c96694bf2532b", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683049447, "uuid": "54db4241-e0b6-40a0-ae17-c40465262d82", "comment": "Malware payload", "value": "552b4f075c78f09ffb3197616fe17c330250f422", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683049447, "uuid": "a5f75d4e-1bca-4a6f-8f74-28d5a168ace0", "comment": "Malware payload", "value": "b3d099f66595ec3dba1047ede5bfa84a63875e7589e4cdf059a115e2a13db1fba992d1481576c42cd94993ee9a84328b", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683049447, "uuid": "1f740321-48e7-4b73-af71-6c9fd832156e", "value": "T10045CF0651A4CE5AFD3687F04474FF8423B0BC7764E4E2282FAE30C6DAB6F511A5895B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683049447, "uuid": "47140b19-8714-419e-8f59-fd98f931bc85", "value": "12288:h/5BifkoZtTH9WKK5dDCwua/GC+MTKCCbVQkJcUZbF+PArtBi:hifkCtTHczn/G3EK1VJJdigE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683049447, "uuid": "8e4b4074-a3d3-4ca2-8620-724979384977", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683049447, "uuid": "d5015765-7555-4388-8802-06f71dcbd7ba", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683049447, "uuid": "0d7ec967-10b1-4209-9969-d728830eca7a", "value": "QUOTATION.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015560e9-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683013398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013398, "uuid": "bac5c74f-1520-4ecd-9b3a-87fb9882a3e2", "comment": "Malware payload (AgentTesla)", "value": "0c948b28f0ef4ed8659c5ba77ac0f6b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013398, "uuid": "74f97546-c4a3-47c2-a5a2-62848357cdeb", "comment": "Malware payload (AgentTesla)", "value": "7c7c175dfa9da91a269d895d032e23574102163d9b6a37d4969f16e54dca120d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013398, "uuid": "ee09c70d-e887-43dd-a4ad-9b615e718c71", "comment": "Malware payload (AgentTesla)", "value": "aa1dadceec929b2ba84f6eb11a80dae7ce26e42f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013398, "uuid": "5aca1947-44dc-4369-a7ee-713b4d68e599", "comment": "Malware payload (AgentTesla)", "value": "369ac599455a758aefefb6f614b5dc7d10f50a246af547a66d5974c7451eef9ade925e0e1bd41161976907412abe6a49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013398, "uuid": "882d74c9-464e-4913-83c9-365ddf5a7c71", "value": "T13D159C3C29BD623BC179DAB98FD4D827F414D4AF3161AE25A4D787664706E2231C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013398, "uuid": "c7063ce5-7f50-41cb-9ea8-da4892af954a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013398, "uuid": "56fd32eb-34b3-4f65-a125-b70873e55f0d", "value": "12288:/3m+vY07/HObd+MCDo89QUTb6h7KCGKpDQbusGX4vwx2grAeixZAKTMZVxO:Pm0/ubd48oXb6cSmbu3IYx/MegMTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013398, "uuid": "a9ee3037-6d7e-4ec8-a574-7fc3a08cde81", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013398, "uuid": "ea6f0c5e-bf62-4195-b7be-736fc276e285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013398, "uuid": "867bfec3-416e-4603-a96c-d9a416e42704", "value": "Offer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0c079f-e8b7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683011239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011239, "uuid": "c5ff8339-a2b7-4d20-99e2-0ab7cb5dd9a4", "comment": "Malware payload (Formbook)", "value": "dc7d38c9d3daacf652a2c97f88a79815", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011239, "uuid": "d5a90c53-f161-44b2-b3c7-ac45beb11529", "comment": "Malware payload (Formbook)", "value": "7d05369e7f8c3f1ae6e8e52d34c33707768c9d50c7cc688198f1e72bfebd2599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011239, "uuid": "8540243a-748e-4fe9-a2e1-1e92ef5265d7", "comment": "Malware payload (Formbook)", "value": "02210f8c3266b22783161ca482693007db7b0d4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011239, "uuid": "bfcbf196-ab8d-4f96-8a73-32adff1d507c", "comment": "Malware payload (Formbook)", "value": "b73216568dc432cef4242545bceb578f2b78080b53ed3780f70eb8da43611131a1500772f95e3fdaae554b557de9836b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011239, "uuid": "7d80a33f-8168-4898-a338-43aaff83d0c7", "value": "T1C635CE429264CB5AF9399BB04464FF7467F27EB3A8E0D1111EE13CC7FA76B02095990B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011239, "uuid": "acad164a-ccc9-4c71-8701-2d40b2503225", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011239, "uuid": "554db04a-30c9-4359-935d-b278573b1a89", "value": "12288:azmbNsNWnnoQD/PX12tmovzYG2zo5fa/2hcjzzu6PP1BR+VZwAXz:QmbNsN6HnQ06zxFI/TVdBIVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683011239, "uuid": "42eea711-9e82-4fe1-89e4-1879f5bd96bc", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683011239, "uuid": "9750db6f-5209-4cbc-a075-766b7cb98ea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011239, "uuid": "a0eec0de-a6b6-4b48-811a-95cb62828d29", "value": "Consulta000399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e77656e-e90e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683048209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683048209, "uuid": "24b85b93-3c24-4918-8505-39e9a3a314b4", "comment": "Malware payload", "value": "de22353c9ac8ee03fd53bee49b867919", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683048209, "uuid": "283778f8-bd13-4509-8727-eee5a63aa455", "comment": "Malware payload", "value": "7e863f1c886d41690c1626abe000aad850194b11f8606ca739fc8e5e2c77b8e4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683048209, "uuid": "2613dcb3-b396-4919-9bca-2bf695cd249b", "comment": "Malware payload", "value": "e4ed3fe6be9b9cbfe88e38b399c65da0df210d98", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683048209, "uuid": "ad7d0738-6f31-4b83-81d6-1cd1bae39c7e", "comment": "Malware payload", "value": "9619b0ffcef3325cd10a7ee1503bad2dfe8833064224e50942ae98d81c2e3a140d429ac494f305cf25e3c9292f4eaf25", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683048209, "uuid": "5314eba1-00fa-4780-91b9-3e774d236771", "value": "T1DAC2A496E79A03784F9101B6271F0AC9AB6DB13EB3505561786C933433E9C3A4277AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683048209, "uuid": "04265bee-b54a-4724-9f0d-a5c8fead21a6", "value": "384:VQMmdOFNYY0aaaIswqPeOrka1+fHQJ+t3rQkRhZXzybA9YSpI1h2nBtO7MCtVuUt:DFx0XaIsnPRIa4fwJMtu1cb81cJxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683048209, "uuid": "fa3162aa-a58c-4702-b490-c3f903b195f6", "value": 26231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683048209, "uuid": "a8e061d3-5f05-4deb-b1eb-813418f8f288", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683048209, "uuid": "d255bd7c-88e4-46a1-af64-c706c5628982", "value": "Payment List522023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340bd8fd-e8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683020355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020355, "uuid": "251fb670-65bf-40f3-8ea9-36f84b6edfbd", "comment": "Malware payload", "value": "0d37c7081bbfe26a38f0f274b0f255cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020355, "uuid": "96d67a46-604c-4b87-99dd-3b2870d8b2a0", "comment": "Malware payload", "value": "7f9030af40b04e18dd1e9dc5329b56fd82ab05c6eaa67c70ab94cbc2c52df0df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020355, "uuid": "1dcfc0ff-460c-4260-8183-756e0697b2a6", "comment": "Malware payload", "value": "dd657b66e63877baff351079f519b25f36a8410a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020355, "uuid": "51119f2c-e2ac-4411-9e9b-94d7489604a0", "comment": "Malware payload", "value": "f0d348aae1b5df2156bec8d11c35a1b77be87c7fff8c2f1c0565c20e1a98a6665631f11631a198891610d9d05c146cfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020355, "uuid": "fa5f69d5-b3a9-4254-8744-e1bc694361a4", "value": "T182E5021357658071D99AA8394E37BE9A32FE6752CB03D8F7E289D9C618313D3E532243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020355, "uuid": "3341524b-6535-4f8b-a07a-b334eff65141", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020355, "uuid": "5e7ecd1b-5da4-4b6f-8521-c74f8f398bf5", "value": "49152:Fo6iI7SmZLovFBrp1kSl4gXkGBlcup+ZiyPRo9oX7gXpRq+f:i1mZQ2vqkilQZ0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683020355, "uuid": "15acddb7-3403-485f-ba7d-ba7120cef117", "value": 3125000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683020355, "uuid": "1244627b-d054-4806-9951-3b07ae2fe0f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020355, "uuid": "8ac5dd9e-7e9a-4cb4-a079-f1be5198335d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2313938a-e8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019468, "uuid": "4ba7c20c-b393-490a-8670-8d5ad2c763f8", "comment": "Malware payload (SnakeKeylogger)", "value": "a4b4494d2b7db94bd68151f464a8044f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019468, "uuid": "dd8da2d5-9df2-4d46-8bd0-251923b2633e", "comment": "Malware payload (SnakeKeylogger)", "value": "80abc5a2938aa57416d1535827fe006e5cdd18713367977551af15247f9d8f25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019468, "uuid": "3682acf0-c49d-4543-a71a-bd50d0f2004c", "comment": "Malware payload (SnakeKeylogger)", "value": "bb23ea3b40795c0d78aab86563a5bc933b988b86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019468, "uuid": "165e58b6-49b4-4516-b568-c735196ca833", "comment": "Malware payload (SnakeKeylogger)", "value": "80c8c3add223cc56c56b80d410cdd41d9d33424642e3200b69a305030576da21604c120ef54664a0284d2cb9c45eb7fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019468, "uuid": "e0c36ff5-0085-4684-bf6c-08d329c853f2", "value": "T112D32B1D2BF89800D5FF9A7301B15122C775B842192ADD1D16C2F95A2A7DAE0CE1BFE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019468, "uuid": "861f7572-e308-4642-a0a9-5d8d1119a0da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019468, "uuid": "92316c42-f2bd-40c9-b8d6-0bab68623cc1", "value": "3072:0AgAE/4HwL17Qd8VQC/b8rknhwBOOoFbY:9K44QWaC/bNOMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019468, "uuid": "a76eddfd-47cb-48ab-9212-529184520ce6", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019468, "uuid": "10d5594b-9a6c-44b0-aa88-f1a9ef7b471b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019468, "uuid": "ec59b336-ed7a-4d05-8955-f1a457066846", "value": "a4b4494d2b7db94bd68151f464a8044f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdae9c78-e8d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683024130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683024130, "uuid": "98a9bb01-ca30-4d02-9b66-df57d27f2497", "comment": "Malware payload (Formbook)", "value": "6bdf298a79ef2210f4a6e6642fe1970b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683024130, "uuid": "55db47b2-6d82-4fa1-bc44-0764d847befa", "comment": "Malware payload (Formbook)", "value": "80b897554137c088aba36b0d51a665979e7b3fc04f99bc5f5ba8f1a4f84fa296", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683024130, "uuid": "b13b5718-0a72-4331-b6d5-51226216a02b", "comment": "Malware payload (Formbook)", "value": "ab1ea61da9d210c9ce34b305fd6d6fd857611d21", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683024130, "uuid": "69b3e34d-28e0-4e87-8653-4c8629b71fae", "comment": "Malware payload (Formbook)", "value": "cfcd459111cd959d3d5c630b51bf00b31dd96b410a0700ba8e9a5b6bee6430c4db29fe75ab7cb77ee48e80c4f54940c8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683024130, "uuid": "2baf62ac-9001-4ea3-b1fb-dee88514a32c", "value": "T19274F00AAA00E8ABC87546BB2872E73997536C901875960777EC7C2BFF735105D0E3A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683024130, "uuid": "9cd47bdd-1514-4ade-a826-85c03226abeb", "value": "6144:77ewrGFEEcCQ8DVbE/A/j30wrmMAjUNi9bsYuWVs3lAD:HVrGFExR8DG/Ar0w6A49IlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683024130, "uuid": "e7edfd78-0fa0-4311-a1fb-f2dc69b9f770", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683024130, "uuid": "041bf78d-2e67-4d3f-9d74-8712eba9c8b4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683024130, "uuid": "7d449dfa-f991-407f-8cbe-f05db893cb61", "value": "DHL_2017128 Receipt Document,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427d1c1c-e8cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683019950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019950, "uuid": "c5240677-1d7d-4bae-9fd9-5930b585d341", "comment": "Malware payload (Vidar)", "value": "a5293cb8841eb96b8a6618f1e11cb730", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019950, "uuid": "2b9b1e21-dd7a-43e7-96b7-5e456ad82ac8", "comment": "Malware payload (Vidar)", "value": "810be76ae3ecc5ab7f019f91979ac9ebf76ed220a7b42c2254a21ec660f8289f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019950, "uuid": "5d5a5baa-b632-40fb-96cc-84b421221f1f", "comment": "Malware payload (Vidar)", "value": "db640ebdfc3b98fe7a8223a44f4e997fa28cacc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019950, "uuid": "36970e70-b357-44cf-aa42-488d67998408", "comment": "Malware payload (Vidar)", "value": "f67f934427d3c1e6684c49a5740a90cb9de34a19cd9a7c928c575f3445d9cc213e9c949d39dce827c4190d21028d64b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019950, "uuid": "7dde082d-6fa3-46cf-8326-66b290ea6f13", "value": "T144945A1392E13D44EA2A8F72DF2FC6EC7A8DF2509E493775121A9A1F49B01B3D263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019950, "uuid": "8f98340f-1ceb-4d7c-a3a9-5a24cbd13901", "value": "203b54dd7cb5052a152152d37aa392da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019950, "uuid": "10caa4dd-1f3e-4113-b372-65a10cc65826", "value": "6144:VTIN6lFfkmWZ36iEV1JBO1N6tmuEJTX8Td3dl9Ytqv+S:+N6lFcm66i60NJQkHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019950, "uuid": "e2cea1d3-0934-4053-a0ac-a0a6c30bd3e7", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019950, "uuid": "7d80a27e-4465-4f7c-9efd-2221a8068cf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019950, "uuid": "3a96231e-312a-49ab-b884-f6ef48514a7b", "value": "a5293cb8841eb96b8a6618f1e11cb730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d412f0-e8dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1683027047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027047, "uuid": "93f26274-38e2-4c16-bafb-95b7829d5c4a", "comment": "Malware payload (DarkCloud)", "value": "ac798236993af26702d4307c4f999bff", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027047, "uuid": "a2e28200-9266-438f-93cd-576edd8e9208", "comment": "Malware payload (DarkCloud)", "value": "814feb1393d69a3a46e80c35cabffc0c24ee035c94754e72179ca8627afc2e08", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027047, "uuid": "fb3a70af-774c-4382-863c-69d30050af71", "comment": "Malware payload (DarkCloud)", "value": "ac0be0ef8ec71dd0d6f93b7936ab6e08b99e6477", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027047, "uuid": "1a720bb2-ced9-4446-926a-ee3051f0956a", "comment": "Malware payload (DarkCloud)", "value": "6483b9b15ea8eae895d043719fef2e9bcfcc0d1c9d37269794492d569f58ed999ffcc959fd26e93beed2897256e4c338", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027047, "uuid": "50a5b877-3f13-43f9-bdc4-79ddb83c9107", "value": "T19C1361D3EFD8ADA5E81B0F368DB785013167BF6959B2051E2079F02259B337B24A3D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027047, "uuid": "9abad488-9ca5-4c1d-bb3d-2ab5ee105d94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027047, "uuid": "f72cc8d6-5e3e-4188-bc34-c630a754381c", "value": "384:s34L7mVUfN0Y6+v6X7LiIqr5LR5FxlQV1111yt6cj4ajdU:scKwFv27+15xxlQV1111O6cddU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027047, "uuid": "f318c97d-b952-482b-95f0-c96bb6d865ea", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027047, "uuid": "19b11d16-1407-4003-9289-6413d8449654", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027047, "uuid": "75a4ac12-c072-43be-ae89-55c13ea06830", "value": "Booking_0026_062pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d353c8-e910-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683049215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683049215, "uuid": "a095362d-8ec8-4b56-b626-dce743975fa3", "comment": "Malware payload", "value": "fd7178acf1cd802dd5df5b2a29c17395", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683049215, "uuid": "4382d53b-9160-488f-aca6-98eedd09075f", "comment": "Malware payload", "value": "82817cf90168804925fbbfef8779cad5ff3ef353327ea237eaaa4837aa8097ff", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683049215, "uuid": "be56a383-695c-4ac6-8bbe-cc7f7723ed78", "comment": "Malware payload", "value": "a775a43119b48b64dac8f98c23481efeca989c39", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683049215, "uuid": "87603bab-ff17-4898-878f-b42f62126745", "comment": "Malware payload", "value": "234c901859fdb855554d4a4b5fa8d27902135d1a3f6aa7eba8390c54827167594aab8c1b2593db355bd9b3bf9e7ac28a", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683049215, "uuid": "a5a4032e-656f-4add-b48d-a7cbb239c89b", "value": "T1F172AFBFE4852ACCCD46E20A0CB5B876D598B013D2D67C4B216C4EC9F946976A261173", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683049215, "uuid": "6fb9a46d-8329-4040-ac65-86e3636c5bfd", "value": "384:338M4aIlNVilj6rxVjO3yZ5MJMLNYHuru10qFthCAAJG9:H8Da2MS1OCZ5MaLNYyu10qFpOG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683049215, "uuid": "853c7410-d02a-4a9b-ab58-b2e73333ce77", "value": 17538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683049215, "uuid": "e314bad6-de5d-415b-ab3d-5437e888c9b7", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683049215, "uuid": "80fb51aa-6e21-427c-9dff-1603bbee45dd", "value": "Vel.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d861805-e8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019458, "uuid": "807be16b-94ae-4751-bdee-2b48af019cb4", "comment": "Malware payload (SnakeKeylogger)", "value": "1879ec072e089e0d52cde1857f578144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019458, "uuid": "2a72977c-9afe-454d-af5d-f28312aee293", "comment": "Malware payload (SnakeKeylogger)", "value": "82a9b190644c8424e65714aaab0bfd3d60cf0c4f1e4baa0385f4942a08f4f6cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019458, "uuid": "b02031d1-860a-4c61-847e-ad4c5d91d14c", "comment": "Malware payload (SnakeKeylogger)", "value": "c9f1ac0ef9329a6c5eac26029c3690d809340ba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019458, "uuid": "c9271d5f-7a7e-45db-bb1c-95a17c75a4e4", "comment": "Malware payload (SnakeKeylogger)", "value": "e2b6b92b46ef07a85c45588318c757469a345b5ccc3bac5b92274a4ce4634ce65eec75f05b78df219ce50d35948eda72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019458, "uuid": "4a57bf87-d7a7-48b8-8a18-18b688dca855", "value": "T103F4BF162018C946FD9CA734CE64FAF013B47CA3E8D5912726F67D47FAFD603194826A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019458, "uuid": "f01593c7-0768-4195-b6d9-6ceda95577f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019458, "uuid": "e95e9bbb-c419-41b0-839b-0ff09ca33dae", "value": "12288:2Cdwsj8fm6hEdLyG42Jg231aFrGHcafzy0:x9j8NpG1Jg231PH3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019458, "uuid": "1229971d-73d6-4d3a-b24e-af9134d35bf2", "value": 781312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019458, "uuid": "29bec96a-fe02-48b5-acc6-750be4f1aa20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019458, "uuid": "4cc1fae0-f77a-4fe7-9f1c-c94d59db3fa7", "value": "PO 229052023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff497dd2-e8b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683009529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009529, "uuid": "ffcfefa9-7b43-4d78-b2ac-eeaf3f0fc3c8", "comment": "Malware payload (Gafgyt)", "value": "781e131c91637f26a4d547b69d639a5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009529, "uuid": "577e19e3-7e24-42b6-abb4-dabcbf3bbbc8", "comment": "Malware payload (Gafgyt)", "value": "834f74d089437c3da789ff12f14a4879525f8645589b00a4e07101afc887960a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009529, "uuid": "a05343fb-5816-4917-b1d7-3b9713e7f21e", "comment": "Malware payload (Gafgyt)", "value": "1d41e02c11b33b8d579a3df1234ad8e74a89c454", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009529, "uuid": "a34e7037-d226-4481-a031-395f5daed79b", "comment": "Malware payload (Gafgyt)", "value": "7dc35220ca2469b59d86db78cf11da3e42c37882ce222b75aab512203d7bfc0a2641da76439dc677a0d22124443a5812", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009529, "uuid": "3ba2e69a-3e86-405c-bfc5-20c784bdc364", "value": "T180C30910F900473BC3C227BAE78E464D3F351EDA9797731576347A702FE6A992D26920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009529, "uuid": "99d15bd2-67e5-4628-879f-b8ac0f1f80a7", "value": "3072:Bqefq8lOJDSCK1P35MqpAMu8DubhrZgCsqmP46aQ7f3lfbsNb:By8lu21P3tTu8ibxzmP46aQ7f3lfbsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683009529, "uuid": "9f82200b-0d07-4aed-a208-5ad5001b0da6", "value": 125929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683009529, "uuid": "74833821-6574-44ba-9004-55ffa3af4c29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009529, "uuid": "ade54f23-d2ab-46fa-9942-a10121be5616", "value": "781e131c91637f26a4d547b69d639a5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9e774d-e92a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683060450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683060450, "uuid": "85cc4d01-d2f1-49ad-99c8-a694c1a2e583", "comment": "Malware payload (Formbook)", "value": "7efeff7e5f25b22273eab9e0dbb54171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683060450, "uuid": "92975a46-1fb2-46c9-9514-540eaf7c1ada", "comment": "Malware payload (Formbook)", "value": "8371116d95aa209dd33ab56ef48b991b23c0882d04efe59bee73039077565197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683060450, "uuid": "e8bc9835-d524-41f8-925c-c19cecea9c1f", "comment": "Malware payload (Formbook)", "value": "c7d70a0a745a0618b00eb4ffe6f15a0e32beb87f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683060450, "uuid": "3a7e008a-c6b8-44f9-872f-0df926a766c0", "comment": "Malware payload (Formbook)", "value": "1f8e124dad7b748b22469f83e531a42d029ee988d7e1c815ec5caa0d1a9f4c6d6773c900e57bd37ee8c952e220851ed7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683060450, "uuid": "8cb58752-536b-4be8-bbe3-e68dc61dec37", "value": "T1BBD4CF1A21A9CF1BFD7A9BF15574FF8063F0B07765E4D1242FAA21C6D9AAF000E4851B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683060450, "uuid": "f739af8c-5a60-4bf1-b2cb-33aa980a06f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683060450, "uuid": "bd65fcf4-3f26-4959-8972-798a2a4afb38", "value": "12288:SX0fr9PKoj4HyPG0fiJyfuqwhNKlUR5Sgw98EcXeN:Pfr9SfWoEwhMCLEcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683060450, "uuid": "337f12d0-3836-4afd-a404-3fa67f683712", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683060450, "uuid": "6ea5b1b9-75a3-44e6-9395-af9085c05201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683060450, "uuid": "a77cd0c6-ee07-4a67-a9d6-641079797940", "value": "4TH HIRE SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985090c1-e8e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683032549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032549, "uuid": "b17f195e-510b-4764-ab38-7ecf3cc063ae", "comment": "Malware payload (AgentTesla)", "value": "0ed74fd744a343bce4c700b078631cf0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032549, "uuid": "ba0ed65f-a890-40e8-ac44-db7230642257", "comment": "Malware payload (AgentTesla)", "value": "84a93af9e18d782e353d1249988ce2fe42208f613fcd1f53287b327a693b9ef1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032549, "uuid": "affd0b14-25ff-4ad9-a4eb-f5640b926838", "comment": "Malware payload (AgentTesla)", "value": "2784a814a4346a85526cc5690b28edc66a01ed4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032549, "uuid": "67e9ad9f-390d-4fbf-9dd3-51e3de6467be", "comment": "Malware payload (AgentTesla)", "value": "75b4017611cc64123662d393293d525e9f3bbe731caccd123b502fd924549665ef1f62a7771372f47832abc762d2baae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032549, "uuid": "d1da15ca-f399-46c6-9ec8-674605ea532a", "value": "T136C4D00A6169CF5BFD7A8BF15478FF8063F0B07395E4E1242FBA24CAC696F111A4851B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032549, "uuid": "aa4351fb-f065-4de2-85ff-ad2bd8aff147", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032549, "uuid": "97f2594e-bbdb-4f44-bb41-066451650d24", "value": "12288:2HnRGw6nvPM4vcFlf8tiMYJ1nW9vOkF4J6FzW49wTwSqU:46BcHvfwvO0HzW49BSqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683032549, "uuid": "a798e213-b96a-4d7b-aa28-5d57453482ea", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683032549, "uuid": "23b0a55b-c53e-467d-98a7-bc2e3c42a54b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032549, "uuid": "4f3b0839-4626-4424-822e-9a0d3ca61584", "value": "0ed74fd744a343bce4c700b078631cf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edda4b64-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683013366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013366, "uuid": "96f2fdfd-4a77-4aeb-9c33-b38c181212ac", "comment": "Malware payload (RemcosRAT)", "value": "fde7a1d1f68a13c0d1849883f343f163", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013366, "uuid": "ed22fa5c-0590-4f39-a557-f3e89f10ed71", "comment": "Malware payload (RemcosRAT)", "value": "856ce5a32f99dc3f289d214f344adcfa5acf7f2c9f7db5cf38317d19a9504361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013366, "uuid": "e779f64f-b95c-47e7-8365-f1e07cda9dfb", "comment": "Malware payload (RemcosRAT)", "value": "ad1b77edb947c0ab74ce9cba7e01f633b03dac1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013366, "uuid": "63e40089-3a9e-4f77-9157-f1fb2fd75a1b", "comment": "Malware payload (RemcosRAT)", "value": "c34e722c840ea06f7e1241c590c5dc04c8dcf64c794a64fd530630fb31b9c4fff53f88c035d36d9ec45bc3d536453912", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013366, "uuid": "b4b1880b-2a57-42cb-8ca1-e0c743bacfa9", "value": "T16BA4AF01BAC2C072D57524300D3AE775DAB8BD212935597B73EA1D6BFE30190B72A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013366, "uuid": "02c56d09-3608-44f4-acf9-9a0c3eb053c8", "value": "bd51a645a9c68bd03b2e51586e5cbdcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013366, "uuid": "f41427c5-a4dd-43e8-9b11-db2b7192ae44", "value": "6144:RXVUvr+eNVx6JuGD5To83sRnymABKtqulRwOJfZJEfcZdC48hAiWsAOZZ8RX7mck:RX8/Vx65HCnDAByqulR1fZJQGs/Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013366, "uuid": "54eeac62-a477-4f81-8efe-a88020a69a3b", "value": 478208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013366, "uuid": "1f583970-b8d2-4e26-826e-8719263d1fa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013366, "uuid": "e6178c13-eabf-447c-b7c1-9d2ddb8a09db", "value": "856ce5a32f99dc3f289d214f344adcfa5acf7f2c9f7db5cf38317d19a9504361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5c1154-e931-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683063322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683063322, "uuid": "9259ccb9-cc32-40eb-9c3e-0aadc0b0408c", "comment": "Malware payload", "value": "f8cf53124194268ff601f364d00cd52c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683063322, "uuid": "45fa8e9e-c0eb-4578-a277-c2bbc24fd96d", "comment": "Malware payload", "value": "85a508d7a33f455aec8a7f735630b27ef6d2963a0d7469801979d6f06e1742e6", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683063322, "uuid": "ec05766d-8562-4a1c-bc49-bf2401aaa414", "comment": "Malware payload", "value": "af2fad9c405246d80981f596d2dc2b6605b439c6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683063322, "uuid": "0d3a5ca3-85a6-4229-825e-f16f7428aacf", "comment": "Malware payload", "value": "5958dd268c92f05749413d1b2b3cde5eacde106c64be3ce0d28a05139e19beaa5319a74ca014890c150f18c55427331e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683063322, "uuid": "e130ea2a-f485-48f4-80af-615811d3e5ce", "value": "T158C52203F3A6E55BC8F3C33221751635907A8D29D743BB892D5873BE28B78E84756AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683063322, "uuid": "bbcd79e0-2a7c-41a5-a734-905863c41b93", "value": "49152:R/ZBZ2+5hxSolpfMSSSSSSSSSSSSSSSSSSSSSSSSRYsLteqlrpKob7RyFdcvz/n0:5ZLNn7fMSSSSSSSSSSSSSSSSSSSSSSSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683063322, "uuid": "6c3316f7-4386-44b0-90e6-09a80ff68caa", "value": 2675506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683063322, "uuid": "a209548f-d97d-4aba-960c-3658285ea913", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683063322, "uuid": "60438cc3-345e-4acd-b683-34c73b0a852e", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ea520d-e925-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683058292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058292, "uuid": "00fa2f45-e2b6-4a25-8034-d3f5922d84b0", "comment": "Malware payload (AsyncRAT)", "value": "6308684da90f4ee6ebfedb508b55cc18", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058292, "uuid": "9e890a96-13d6-4819-b10f-65f4b8b106d9", "comment": "Malware payload (AsyncRAT)", "value": "86a67fbf1de00944aeb574247e7514d9d5aff04914c2335fa58be35dd3b43bde", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058292, "uuid": "f5d98e89-9632-4ad4-b305-b40118880134", "comment": "Malware payload (AsyncRAT)", "value": "1cca6699f99f213aa147c154acd91c738aa925eb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058292, "uuid": "d1715ed4-bbac-48e8-90d5-784c1226777b", "comment": "Malware payload (AsyncRAT)", "value": "50617d959f5757d22c99546d0418cd0d77b7d1725132bdb3297c558d4505069f4023e5aebb0e88d01d04ac7c3f63c76f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058292, "uuid": "93b20bc8-0376-4a08-83d8-f6f2e7cf0a2f", "value": "T1552533A5AFB39BEA1A2FDD96C551590C7058B00A757E23AEC7F741F90423F80406DAF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058292, "uuid": "5b500494-cead-4b8e-95cc-0dd8b66066b7", "value": "24576:4gfLuUQzxA1fgVXXEI3s98XIVs4hJVBCmaBh5+hQpkV:LqUTQ844NhgJBh5+hQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683058292, "uuid": "6fcbda59-e20c-4112-9fdc-76f273bb8046", "value": 1038577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683058292, "uuid": "8e4e0890-8573-4c04-95a1-dd517c44e478", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058292, "uuid": "89881c41-3118-4b00-b936-e7f895e94b42", "value": "ODEME_1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072f95a2-e8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019421, "uuid": "71ebff35-20f7-46b9-8220-3fdd6e0de5ab", "comment": "Malware payload (SnakeKeylogger)", "value": "9985c8f5479f71e0648429e2ea8fab05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019421, "uuid": "d01a0c25-f595-4c36-94bf-c9577cc31355", "comment": "Malware payload (SnakeKeylogger)", "value": "871c9c0e18ace8f981b24671bb9da121bc7bfea7704c4a0f9d672021a0567ed5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019421, "uuid": "1d42d331-d28c-453d-9dfe-87cbc0e3ffd0", "comment": "Malware payload (SnakeKeylogger)", "value": "0fa255381d6ac10f6974fdf995032134fd514997", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019421, "uuid": "efcc383b-ea20-474f-b6b4-4035eba93a7b", "comment": "Malware payload (SnakeKeylogger)", "value": "a8b7c04e50f5da8ce0ff194c832a5b1ac41332fc7ab5cfaa9bf07b8be4c48c90a8b5ae4c3788d84b10dd8bf318847350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019421, "uuid": "cec122f5-433a-4661-9dfa-e8b4d98fc416", "value": "T17AD4D04122B8CF2AF9399BF50464FB4023F5B03750E5D1681EFAA0DAD9B5F050FA466B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019421, "uuid": "df903e6e-c526-41f4-a672-f0835dd465f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019421, "uuid": "d08e16ef-c8a7-4a9f-940c-65e22d48c74a", "value": "12288:Xa2iNvw/TUxd+SLvPIsiW3O+LLP2nwc4zvaIX+dt:K1tGTykyvAMO+LCwRzvj+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019421, "uuid": "18bac16b-6e71-46ff-8da0-2bfa628a1222", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019421, "uuid": "f6e4284c-7b5f-4aa2-9526-1efab5404100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019421, "uuid": "42c32210-3012-4e0e-a8a8-9901f6cf8f95", "value": "bPS8aFpnuj3mebc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f5c0bd-e8d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683023128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023128, "uuid": "7ded2a14-976f-4900-84cb-4307dff84697", "comment": "Malware payload", "value": "649ce60d0d8764bdd5dda73685b29fd2", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023128, "uuid": "64376085-604d-48ba-80a9-cfb1930de216", "comment": "Malware payload", "value": "87bddfda1f72f77f1e9dbb680525d4cb8b62a3e573a99675ed494893294bf8f8", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023128, "uuid": "1b210210-6b7e-46dc-94b9-f50bee9ae1ba", "comment": "Malware payload", "value": "c7d4a865e80f6fc5fdbce0719acb76df8874ddc3", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023128, "uuid": "ef2ae600-de12-4c92-8032-e8c26b61e89d", "comment": "Malware payload", "value": "34a014eefa1aa5c6966d3767e3ab4d22c1acd19e68b0d9c6f92be4e9291479a52a1b9d44efd5da585a1609b377c4c672", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023128, "uuid": "a32af3d5-c8f4-42e1-9ae6-4ec7da7d74e6", "value": "T14954F0177614CF83E090D3F47F93AD960B86BF0A998275EB2491774FBB3464059CA22E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023128, "uuid": "e0a199d1-ae56-41f4-ac6b-2410fd98b46c", "value": "6144:X9NaFJkKXiDU7w5d5DFldHzCzBWTtfOVDoY86GFSFuyEC54i1vR:X9NaFiKXKBZrWtKtyJGsFJEA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683023128, "uuid": "b4b337f4-6887-46de-bcf2-4b83e3d09e81", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683023128, "uuid": "3e8c3d4f-f71b-4dc0-992e-464e564acfed", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023128, "uuid": "c6b8c660-a425-49b1-875f-43251c9ae03f", "value": "Revised EPDA COPY.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ec1ef7-e8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019412, "uuid": "496625f4-9a74-4009-a27b-a12406066469", "comment": "Malware payload (SnakeKeylogger)", "value": "c76720884aecdaaab9c0a0de1bd932e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019412, "uuid": "d846364b-a6e2-43e6-83fb-3f68a9f9e2ea", "comment": "Malware payload (SnakeKeylogger)", "value": "88594695bdc9357dfd4ad5736af7f8ec01912cca4bb418f842228cf9ab1c9156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019412, "uuid": "7acd2cd2-6ff3-4522-a836-adc3b2923dad", "comment": "Malware payload (SnakeKeylogger)", "value": "ba027a79ef8cfe430135776d7c5ff742b3fedb32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019412, "uuid": "4f83a586-e156-4fea-931f-cc958740e11b", "comment": "Malware payload (SnakeKeylogger)", "value": "cfa36e68a67e22bfa17460e3528862a1fe912be0fefb0a6934bede421ded6c8e558022199392fadd5158dce56ccdd814", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019412, "uuid": "45e699f5-ac7f-434e-a0ef-dda07e65e654", "value": "T1D4C4CF42A1A9DF5AFC3A9BF054A4FF4467F0B5B3A8E4C2211EB564C9DDA5F000B09D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019412, "uuid": "bcba9e3e-8228-4e14-9453-546f2ac0c009", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019412, "uuid": "817505c0-931a-4f52-a175-b45c0bf3c51b", "value": "12288:IzmLBfalaBQMjDdpauE2Eie76lGgiDWqalb4c:OmLBfaMRG376lGVCRlb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019412, "uuid": "bec9cf53-0474-4213-ae25-08ddd222462a", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019412, "uuid": "db4e5c65-4e8e-458a-87e4-f42ef610875e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019412, "uuid": "6311ea15-ab45-4a65-947d-b410a9ae32ed", "value": "PO 229052SS316L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d10a6d-e8be-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683014030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014030, "uuid": "f893316a-87b8-4466-87cc-bf74578cc706", "comment": "Malware payload (RemcosRAT)", "value": "d6bce3df731ca623b99883a73a98fdcf", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014030, "uuid": "f957dfb7-f337-460f-8957-ebe561cbdca7", "comment": "Malware payload (RemcosRAT)", "value": "897616b24bebbd22e1434c357b3c069889fa7c8d7e2ec1b679f7ee6bc2c270f4", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014030, "uuid": "912e1c49-234c-42c5-84c8-af3bc8278d89", "comment": "Malware payload (RemcosRAT)", "value": "626529006824eec082edb560e1a5d9fb7514431e", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014030, "uuid": "ab6615c1-0ba5-4ff5-9eb8-4ad0fe06107d", "comment": "Malware payload (RemcosRAT)", "value": "9b0e2d633d43f9d9ce06018b925698e7eca6fa550b9c1de71ac803a53d69a8d9577dc7212ba1cfa7a6d1ffc400395884", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014030, "uuid": "8b77f722-f773-4321-9dc9-89c5d0d5b372", "value": "T18963C420ABD48476D9724F36A87E7240437BB66049F6CB5E74CC204F5FA72610F623B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014030, "uuid": "08ea0566-3846-4f39-81a7-09038ded2b29", "value": "192:ulz683fmMbhjfON+D5LUELalfNXTRe5YqM0UP8mmILgmNfDTgP6F:05lYMLUELsfNXdPjngP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683014030, "uuid": "4426a041-36f2-42a7-acbd-09ebea61888d", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683014030, "uuid": "a2ff7ef7-d9cb-4817-9a8e-b1738d925948", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014030, "uuid": "a1dd1dd7-b9aa-4ac0-80a3-3725f65b41fd", "value": "AWB25637373283GT.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9b3c35-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683013367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013367, "uuid": "ec57a033-794a-427c-a86c-bcc3bf4f4c75", "comment": "Malware payload (AsyncRAT)", "value": "a803fcb732c01dcd837615590e703ec9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013367, "uuid": "7b47b7ed-dba1-4645-8d59-d78fd18ebdad", "comment": "Malware payload (AsyncRAT)", "value": "89782566a604a31492cae1b1a48dee2d8db48183762f967d7c0e3476cf0fe556", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013367, "uuid": "2551fe94-0aa1-433f-8088-858050519fbd", "comment": "Malware payload (AsyncRAT)", "value": "da6f9d1a49a9dbb232c0515aff0e0070e2cd47b6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013367, "uuid": "d91f3427-f56d-4321-a34a-54fe877a8e31", "comment": "Malware payload (AsyncRAT)", "value": "577749ae53f8abd324a627ba06ec682123f366f6dd811a26ee435206e232c8f2c0434387937ce93de1a91b89bd8aef17", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013367, "uuid": "fb58c9c8-94f4-4da2-a418-7e90e6ca6897", "value": "T10C231C003BE8822BF2BE4F7899F25105867AF1672603D54D1CC451DB5A23BC69A53AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013367, "uuid": "c51e0dcd-9108-4ef4-acfa-2e2593a981d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013367, "uuid": "3f2fd3eb-d839-4301-b12b-5564e8f320f0", "value": "768:tuwCfTg46YbWUn8jjmo2qrDKjGKG6PIyzjbFgX3iLmsH8gR5kGRKBDZzx:tuwCfTgp/2OKYDy3bCXSLDLgdzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013367, "uuid": "4963f989-fea4-41bb-b650-78aaf4198425", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013367, "uuid": "73e6fc9d-db9e-4240-9dc9-b091198cbde3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013367, "uuid": "da3c740f-abc5-455f-acbd-831412e808ca", "value": "89782566a604a31492cae1b1a48dee2d8db48183762f967d7c0e3476cf0fe556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebdfbfff-e8aa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683005631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005631, "uuid": "7085e7c9-53a1-47e4-8df0-d63e85704a28", "comment": "Malware payload (SnakeKeylogger)", "value": "c51e75e076ff7a7fbee9e4f3e534af4a", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005631, "uuid": "218c4c05-53d1-4942-b7a9-d523bcccc88d", "comment": "Malware payload (SnakeKeylogger)", "value": "898f81a22ef9c7e3202c36f85747b9632ce54c2cf52d752aec91c9f8c3c000e5", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005631, "uuid": "e5a0d450-c684-4c25-af87-36cddc199b29", "comment": "Malware payload (SnakeKeylogger)", "value": "7bf2a3a521add44370703f2027b717b70f355320", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005631, "uuid": "027750e2-2083-4e4e-bfa5-294325d925de", "comment": "Malware payload (SnakeKeylogger)", "value": "3e4d9c4b0a1bff432bac860e3ec7ba4b925df2140221e88ebbd852b77b3dc4f1298480a3632adc580c850ec703ee0947", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005631, "uuid": "a81d6159-c08d-4610-8ac2-f2e8eaa1ef9d", "value": "T12C9423E29488C02292E5FAF75E96C61F0E728CB179AE24325759AFF5431BB777138009", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005631, "uuid": "64b12939-c11b-4867-a878-e56ed7777800", "value": "12288:feJ4YwwDL42EMapYlXQ3aZf4+iIDzETssNrXQGvRN:GJTH42EM/lAqZglwYTsAkG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683005631, "uuid": "313ff598-c193-4629-b715-c32d983d0968", "value": 440690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683005631, "uuid": "46a272bb-9d2f-48ed-a774-6e2c6c0c7a46", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005631, "uuid": "7c7140ed-90f9-428d-9f30-6d351074b5b2", "value": "ORDERXSCHEDULING.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472d36b6-e8dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683027259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027259, "uuid": "c8528e55-4364-4cd7-b788-47889c21a34d", "comment": "Malware payload (Loki)", "value": "1d61dcf6eb7607c4bde5a4cc793fa816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027259, "uuid": "f644f718-0414-42b4-9ebb-886a039def16", "comment": "Malware payload (Loki)", "value": "89a061946525216eb7a324c3e174cb8ed1bbbd139647ba16844ffe8feb22c8d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027259, "uuid": "526d0693-c8c4-4791-bc72-b7caa465b567", "comment": "Malware payload (Loki)", "value": "0a6d23d164483b7665f39727133b01d890a4019b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027259, "uuid": "f6a93d3e-83af-43ba-bd16-4e82f328c11d", "comment": "Malware payload (Loki)", "value": "04688d1b4dcc5c1c743955cca2d391a9447e1013cb5e1035a76b3a03d4eae639cec68b78f4c6e9f87691bce77ad27e65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027259, "uuid": "2da06f5f-3ff8-4d57-a280-021c60db43ff", "value": "T135B4CF1A61A5CF1AFD7A8BF18474FF8023B0F07755E1D2242FBA60C6DA9AF011E4855B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027259, "uuid": "79337fc9-ecf5-42e1-8f0c-91d1774b55a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027259, "uuid": "c412c265-2102-41ad-8997-8ce4357d555b", "value": "12288:e+WXS4qn+TiQUSfF2vitpD/ci/pL0DgrQcsWZ6wpeeO:eBPFMiHRd/Qp4pO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027259, "uuid": "08b5f553-0537-438e-9812-ca09ae8b7f56", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027259, "uuid": "28646096-485e-4661-b36e-5db2b09602be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027259, "uuid": "7868cfac-89d1-4c66-aa06-88b81637c3b4", "value": "FedexShippingDocument.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c92e3cf-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683013417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013417, "uuid": "7d5665c6-0341-44b3-8a50-0d7642aecbf8", "comment": "Malware payload (Formbook)", "value": "4777efd2f16c045b10721a57bde59f50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013417, "uuid": "ef41b89b-439d-40d7-87ba-38bcafca3484", "comment": "Malware payload (Formbook)", "value": "8a2b49852ded17c14a5909ca022342ad063470dfd23a2dc51fdea29c29c4e314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013417, "uuid": "92cab512-1a17-482e-a7f8-181d2722e08d", "comment": "Malware payload (Formbook)", "value": "72702b442881e1a35837a470ee69f300e3c40ee7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013417, "uuid": "9111f83e-1559-4558-8745-7e4740fa5f64", "comment": "Malware payload (Formbook)", "value": "2e94e5da3662b03da7b4b16e75c7f33c46d78515477c8430deead89ec9a1c148546e76fac66bc7938841cf770328ac0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013417, "uuid": "8a2c91a9-2f1e-451d-adcb-be86e261848c", "value": "T1A6E47A3C28BD223BC179DAB58FE5C867F054D96F3021AD25A4D78B664706E2235C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013417, "uuid": "0993de65-c130-4705-8362-e88983fd27c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013417, "uuid": "8330dfc7-c7b6-48a8-9c17-88ea0b7305de", "value": "12288:fqm+vY07/1u1v5KKmKe+PFR2LNtf4sGGSzuudJBzpjKTdBYvZCbHu2:Cm0/1AR6Z+PFEhypgutzpOCCbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013417, "uuid": "9c0a5d9e-d93c-4cd0-9e90-9ebc2fb5b1ec", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013417, "uuid": "dced695f-4e04-495a-87f4-180b068b08d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013417, "uuid": "a7bfaa4a-6430-44c6-947d-7a8d1f722401", "value": "RFQ____RM quotation_ JPEG IMAGE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c1ddb7-e8b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683008874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683008874, "uuid": "9de9bfac-7a0e-4ddb-a7f0-31ed8481ed94", "comment": "Malware payload (Gafgyt)", "value": "03c29e21ef0f4bd1647fa48ae3505546", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683008874, "uuid": "cb190193-682b-4972-81b6-b84945883160", "comment": "Malware payload (Gafgyt)", "value": "8a6eda9ce0d52464112848f84a2df29af7e30cde2f76e85dbe8ab7db31e5ab2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683008874, "uuid": "52aeba83-87e7-4a01-be9c-a6a36175219e", "comment": "Malware payload (Gafgyt)", "value": "c49efad6044ba6681c1684337bc48bb1c8c869d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683008874, "uuid": "5289c24c-fb20-49b3-9fc4-9475ec0d11ad", "comment": "Malware payload (Gafgyt)", "value": "924fb73ada29da1d0013252c9884a48c1571525ef1e02cd36a84e61b439eae6a23b3e25fba356ebbabadce65d09d5092", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683008874, "uuid": "3fe3d8cb-c45e-4538-8956-37098970d9f5", "value": "T141C3FA24F8004737C3C227BAE78E864D3F355E9B57973315B6347AB02FE6A952D26920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683008874, "uuid": "8c1efcd0-1fa2-4c56-99f5-972a1234deba", "value": "3072:CqPfq8GOyWbz7WCjPJG0pbZsneZLm7/L7QLvqGfziNb:Xy8Gcz75P00pbNm7/L7QLvqGfziNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683008874, "uuid": "bc623788-e062-4315-ad5f-751ff20f1bba", "value": 120911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683008874, "uuid": "af580d97-4cb8-49a1-80f9-74c8ba99e7ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683008874, "uuid": "42662305-fcb0-475a-968b-ca69949cb61b", "value": "03c29e21ef0f4bd1647fa48ae3505546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a1dfeb-e8b8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683011411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011411, "uuid": "b2067411-89f4-48d9-a316-c0b6b293ed25", "comment": "Malware payload (AgentTesla)", "value": "ed9c99ab3309712a7d6134a5adc54717", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011411, "uuid": "ceaa4db3-9cc4-49e7-8d7f-86b91cddf2e0", "comment": "Malware payload (AgentTesla)", "value": "8b9f947c59cca3c9b59569f3502f2b7635640cefa1c96e7efc15d364641fa047", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011411, "uuid": "2dd184c9-1652-45f9-805d-312d330f3ff9", "comment": "Malware payload (AgentTesla)", "value": "fde32168e7409aa863b7c7a1a1cb58420d19d16d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011411, "uuid": "a361d8b8-a366-43c2-aeab-8e36c0221a10", "comment": "Malware payload (AgentTesla)", "value": "3d00d462d053fddb27bee67655cab842795d08401c4ba2a059bbe041858ae9fe2de6ef9ee85bcff65f3c97b32de82446", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011411, "uuid": "f02d3e75-d5ab-44f8-99d6-bc5ca18010d0", "value": "T1B6C423BC5E094A312D3DDF6B2DB272984E1857B31714455E382071EFA14E9CF7AB7A10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011411, "uuid": "59d665c7-0f5d-4081-947c-5d6229e47625", "value": "12288:S/EYCYjC7hmVPkC6PyqdejHTTsvtLj2zmYHxgXZyLwQGnFCp:SM+DZkUe2zjzmOxgl5nkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683011411, "uuid": "26870365-ff72-4d63-b6b9-4e7221d84724", "value": 544899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683011411, "uuid": "955d04e4-454d-4a84-a9bc-8c7a1ea3058a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011411, "uuid": "3192e8f2-4de6-4135-97dd-d47908c03581", "value": "URGENT REQUEST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09dd24b0-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683013413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013413, "uuid": "76fbebee-691b-4ee9-ab38-b4916ae2d4a2", "comment": "Malware payload", "value": "3b40d868701fc6e1865168778f1f3678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013413, "uuid": "811c7410-5883-4caf-9c96-d30fa1e5374c", "comment": "Malware payload", "value": "8bce8704f2c112a2534c4215dca317d21c999a01c7e775272c56a060ab9b32fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013413, "uuid": "6d4fda08-253b-46b3-b90a-bb4e5f3077eb", "comment": "Malware payload", "value": "338f5e5a86cd3ffbc8e0cdb22ec6678665544ee5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013413, "uuid": "0968b2b3-4662-438e-8eea-578284ddd241", "comment": "Malware payload", "value": "dd9f2e9b412dbd15cc709a63258a03f5bda5a28f49daeb2bc327a7da7eb7269655713db5f507116a29aa87e6b0d6da7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013413, "uuid": "e3a5c512-4ea9-4694-b5f9-ad2d4cc5b02a", "value": "T1728412A031B580D3FC6A4B72166E1E015BA25C2660F88F9B63D6FECEB735742950D732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013413, "uuid": "ff301b98-cda1-455c-a279-98b0b8874a33", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013413, "uuid": "8b3358ba-c8c0-4fc8-88f2-6e95c881fe06", "value": "6144:ZYa6dlBwNpoHGp7FQLcZmMQXAn+Fu2lW1NCLgv6pvIdmfhpJPTSs6TheEq:ZYbQuGh2gzt+FuPNC7tImZTr76A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013413, "uuid": "e0b6cade-89b2-45da-a8d3-973eeb0efcaa", "value": 376061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013413, "uuid": "c11ce55d-951b-4266-90ea-5fa308451bf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013413, "uuid": "bab07789-5232-4f5e-bfe6-aa6e5c287f02", "value": "Quotation_copy_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bbb313-e8d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Nitol)", "timestamp": 1683023734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023734, "uuid": "ce65c6dd-4fb9-4e2b-b74f-cac4aa735511", "comment": "Malware payload (Nitol)", "value": "50210db3a13937913fc066021c065f34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023734, "uuid": "a9072a05-3a5a-4edd-ae85-b4e488e5b082", "comment": "Malware payload (Nitol)", "value": "8bcf50ddb7b9111ab736330617fd4751ceb194ba915bd3165648103241d3c708", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023734, "uuid": "d50eb8c9-1f01-4deb-8f1c-68582e09f03d", "comment": "Malware payload (Nitol)", "value": "91087d39cdaaa7b48c49f1752851b359c98298c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023734, "uuid": "019ba8ce-fcc6-4cd3-9875-6f8d27d2b0d7", "comment": "Malware payload (Nitol)", "value": "cfd59a05f2146b0f3db3f1b5c20116954665bd18a2daf21ea8a29cea4ea8e9dc08cb391cf7083a2f9c82bc38bd5bb4cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023734, "uuid": "fb52650e-fff2-49c8-8eaf-be580f336f77", "value": "T17D1523519AFB2B94EBB61EBA095152227EB7FC100B050636C3DA964DAC737C47D3092F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023734, "uuid": "ae352a97-0de0-4cc8-9ed9-d004cd612c29", "value": "11cc54a9a29ceae337a5d3a9518624c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023734, "uuid": "6deea732-2b9d-407c-b37d-b8e7be333831", "value": "24576:x3ynruNDxxo0NrVqKmpKLllBLVQNigXbOp3F3SJpR:x3UUWSLENXbOZ1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683023734, "uuid": "e78adb87-1443-4c82-bf40-23b68469f13d", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683023734, "uuid": "f502a827-2f99-455b-8c35-bfb0977f446c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023734, "uuid": "7f92d6d8-1cd4-4739-b746-ab02ae462b63", "value": "50210db3a13937913fc066021c065f34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad1de01-e8d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683023454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023454, "uuid": "b190b527-8934-4aac-9dd5-da82a6bdc7e6", "comment": "Malware payload", "value": "c1ccc4333a6078f65db75bd5251ae00b", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023454, "uuid": "c97f379b-91af-47d8-b4b8-6b56b8846a1c", "comment": "Malware payload", "value": "8c0a544d8c38511853bfaa56ddec37097b48faf2e65ab73bd4f1c8ee36cec9e7", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023454, "uuid": "a46f10ed-581f-4682-8b96-be57552eecc6", "comment": "Malware payload", "value": "157b222e411455d9247e61a3c755b097c6c9e5e5", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023454, "uuid": "55c9716c-8796-4d95-bcd5-ca419a7645ce", "comment": "Malware payload", "value": "50c5eadb8be09d630de8d5eb76579a60f3a668fdc03d33472a9e61259c68673488a8de5cc7f2aab61514477bb9d39864", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023454, "uuid": "0a655fcb-83d0-410f-9651-d0358ab6b584", "value": "T16F54E0537100CF97E055C7B57F878E9A8B0ABF069A8274EB30957B8F3F34641598A22D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023454, "uuid": "1641886a-2460-49e7-ae4e-2a72290bc15e", "value": "6144:OpaFJkKXiDU7w5XO4v5mXrmYJvzmqa1AA59glZ6OLyK0NcP/wm:OpaFiKXK1mRJqq3A59S6OfUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683023454, "uuid": "9c0f18bd-a4c0-4ac4-93a5-eda24b443bcd", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683023454, "uuid": "21982440-6f38-4692-8ba1-f92c9ba19973", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023454, "uuid": "793e04db-da26-4a7d-874c-5f87161922a2", "value": "Order Inquiry RFQ_105023_KTC.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa63d0f-e8dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683026970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026970, "uuid": "42044d60-3fbc-48de-a004-cbb7231b228d", "comment": "Malware payload (Formbook)", "value": "ad5bb0335bbe8103b8d328d87bfabff5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026970, "uuid": "afdcae6e-ffc0-4771-9f26-e22f0e7565ec", "comment": "Malware payload (Formbook)", "value": "8d82a0a70b5e08f94c099d225990c4725f14f85b35b6b8d0c93e801b43553a7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026970, "uuid": "f343e326-60ef-4385-846d-030e65607b31", "comment": "Malware payload (Formbook)", "value": "7fbba6bb27897dd6a53a7784d0b764d49af23fc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026970, "uuid": "b4b90e60-eb95-428c-bf31-6766a9bcdb64", "comment": "Malware payload (Formbook)", "value": "41a1e24315350414c1d916f4b9ad42e6dfd3f399136d98ba9cc94a14c5339d972cd5e3769cce3e188e89cd966f72f6b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026970, "uuid": "a95f9331-7986-4cf1-b36e-e0c2b85339a2", "value": "T1B2F48E53A2B08A77E04B1AB8481BC7BC8CE57D203535AC4BB7E07D8CDFB57416A19693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026970, "uuid": "5768018a-7f38-48f4-985c-2fd4c7666314", "value": "3315fbaa0073c4f3592d7e54ba056c9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026970, "uuid": "ecdc66a9-4e83-470d-b166-9c8ff4f151e6", "value": "12288:Hu+e4v0ma0dwwcQNHRh+ZXiwBdbPmWNahnBMQfhxN2rn4PhWu7:HuRQq0iwcmhEffeWszhxN2rn4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683026970, "uuid": "73981d1b-a781-4041-b618-a168ca93eba2", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683026970, "uuid": "c99454e4-6500-45e7-8a0f-e5152a1d76cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026970, "uuid": "144d4dee-e50e-4adb-8c26-208c32f87c94", "value": "Siparis onayi eklendi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24463a1-e8b9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683012004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683012004, "uuid": "b9bb91ae-e359-4a31-90f8-33d614cd42d0", "comment": "Malware payload (Loki)", "value": "133567244c92e6e3cebb0da1406e7382", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683012004, "uuid": "6ad5a42f-897d-4116-8d61-e24f109f7256", "comment": "Malware payload (Loki)", "value": "8e4659058cf19a19310b7cd350b10c2a085650bd2f0cc196cd7001f754ed798d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683012004, "uuid": "3d379cc7-a745-4b74-80f3-4df6cdf9b924", "comment": "Malware payload (Loki)", "value": "7b33305db973a3fdfc0c37e1a527e15ecc4c00fb", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683012004, "uuid": "95a458e7-ce51-4c5f-b7ac-2a0c31c71143", "comment": "Malware payload (Loki)", "value": "07ae40c8a1e8dffd7df587fb549bcf6796c6f42e1acba55268a9cc9d68f309dd927a420d54586e72b4ab654df3e3c38f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683012004, "uuid": "46bcf0df-3b08-40b2-aa40-c93b9c4ddb02", "value": "T12CE3123D4D0B60961AF3481E955EB15E85E74D22D02B736E098B0E313F6D78D3B7E982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683012004, "uuid": "cc1ef096-dc13-4552-b680-d3eb2eeda8e5", "value": "3072:Wi+viWArAoPvbuOiftgwix75c865AObeuVID4S2Z5xwhLadRxL7gMY2v:LfWEvyOiftgwi1y86VVIMH5xqq4M/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683012004, "uuid": "0d9507d7-8ae4-428d-a279-f740ab0eaf8d", "value": 152643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683012004, "uuid": "bcec4a04-d0a7-4e50-a1a5-feacd3f0909a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683012004, "uuid": "5d999de2-a2bf-4f7b-b83f-23f066dadfc4", "value": "Signed Proposal.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f979906-e8dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683026951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026951, "uuid": "7fbb8009-a129-4733-a2da-88c674b0db21", "comment": "Malware payload (Formbook)", "value": "6f8fd294150a9e3bbeb0e5e796ff935a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026951, "uuid": "94e64c1a-02bd-4a30-9bbe-b6e74a12e2a8", "comment": "Malware payload (Formbook)", "value": "8f4ac34c7cf2cc81beb02355c6f455fb4e3d6f1960130811079b1ae5ddd303ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026951, "uuid": "0574e714-f2bc-4578-88ad-80795181c318", "comment": "Malware payload (Formbook)", "value": "b5522e2c5a92cf28575b50ae6b9472993f999491", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026951, "uuid": "42fdcaa8-df25-4df5-a669-c3e55e83da56", "comment": "Malware payload (Formbook)", "value": "90f6750e25077ea0bcc4a8ecbe90468c68467dcd1b7ab53e23c8e97bbbcabf5b87415a35fabb53156f70432da78a538b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026951, "uuid": "a5b68128-ba60-4a82-90c0-db5e3b8fe4f0", "value": "T1E05401223E00E95FC97501F33872DA75875AAED0280596176BF47EABFDB32416D0E263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026951, "uuid": "b7017ce6-89c2-4273-9437-299103990cad", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026951, "uuid": "ceb00c05-1adc-424d-88d3-d24ef5759f9b", "value": "6144:V7ewS6CxHubDnSkvapvrx6mcv3zVbF3Xo7MybRG54uoW7j:5VC4Dv0rvcv3zLSRG5OW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683026951, "uuid": "88d59321-e219-4f69-ad71-7bd9482dec07", "value": 303097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683026951, "uuid": "4e968337-6eab-4464-8109-9267c849d57c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026951, "uuid": "90ff8e3a-45e1-48f5-8124-130da03011f5", "value": "Sipari\u015f MGE-WJO 90065, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ee22b6-e8de-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683027683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027683, "uuid": "e64367d2-df24-4158-a16c-ce131c3e2d7d", "comment": "Malware payload (AgentTesla)", "value": "6aa31145c54f003cd27fe50484d2771d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027683, "uuid": "31c18e3b-dde8-4005-8a9d-6ee983b402ac", "comment": "Malware payload (AgentTesla)", "value": "90fb63402e42d02695cf388e248f6001e7ac20242837387df1fa8757c827cad7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027683, "uuid": "6e845e6a-a36b-4dea-9451-e99dbb458308", "comment": "Malware payload (AgentTesla)", "value": "545c2a63718b5a3086ec4fb8d5df732d5b762796", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027683, "uuid": "26f0e718-1156-46eb-be1c-7eee66b194b7", "comment": "Malware payload (AgentTesla)", "value": "f1d6a0231f3d44630db0c02512a65a6e3b7e2a79ee90863ba31f83b5c03f4cb28edfc3da1388829067c62cebb43bb11a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027683, "uuid": "0e398f57-8a1c-4119-84ec-15eed4fd1f5f", "value": "T17015F1026019C98AFD1E9734D474FBF462B5BCB3E8D5952327BA3C84F9F6B02094865B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027683, "uuid": "fc15de40-7704-4c5a-b926-35c2aa4a820b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027683, "uuid": "2bc91405-4f77-477a-a868-f2f8e790cb2d", "value": "12288:N1db3j8AJQWTS9a2jUaNEa2/ShrTDt3wj0zdh93pZ2vkpAIu:RDj8AJQW+9aGU3h0m0z7d7ccy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027683, "uuid": "8c1939e6-a7ea-492d-a84d-ea97ca909a4a", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027683, "uuid": "fe057580-621c-4a43-b2dc-3d3ca1d98b51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027683, "uuid": "01cb9f75-77df-48c2-980d-2675c40387c5", "value": "Request for Quotation \u2013 Supply & Delivery of Construction Equipments Fittings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936b6318-e8e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683031253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683031253, "uuid": "839b808c-af1f-4e09-bf19-71eaf386f7df", "comment": "Malware payload (RedLineStealer)", "value": "5ac9a7b0184df38cf626b7e82ff46262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683031253, "uuid": "c5a48bc6-262c-4d0a-bad6-88b0fe602327", "comment": "Malware payload (RedLineStealer)", "value": "9137d085ff8eda9ce0b2723cfd5e2b159921e0d6e1b227195a7df315ea8fe7e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683031253, "uuid": "470de13c-cea4-4bf1-8254-8f017d2ccb12", "comment": "Malware payload (RedLineStealer)", "value": "44e40a8e2e98b755865689f1abfd91c477ced998", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683031253, "uuid": "513598d6-7d84-4ea9-8b31-de8c107dc33d", "comment": "Malware payload (RedLineStealer)", "value": "125befc71988c233a0aa9b6bc515000d62bcf98424ae5c023f66f594f9329d153abf97669fae327a353bdf415f31bed1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683031253, "uuid": "fab07e0b-28e8-45f3-a0c2-e8041f6762e0", "value": "T136747D03530EC9BEDE9BB0B9FCC882A56B5890B87B5FA287ABD41E14453F1D0765072D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683031253, "uuid": "8401e4f3-2dcb-4746-8181-2af1594ab7ac", "value": "d03a32a9d6119786dea4a25b734d4a33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683031253, "uuid": "3e8946f5-878a-4eac-b2f2-dee30a2d2ba9", "value": "6144:ozrVc55Hpoh9QHBSxYRb98qyFFj4nG+WjhIzAP:OrV25HIuHgYRRmH4G+Wjht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683031253, "uuid": "1d908784-1b04-441a-b04d-95f4763c8a32", "value": 349520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683031253, "uuid": "ffdd1688-5f3c-423c-a625-8ac4d768a501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683031253, "uuid": "82278ad4-c04b-4b7b-896c-dd4a2fd0095b", "value": "modest-menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e6cf3d-e91d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683054740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054740, "uuid": "0946fb03-f1f8-4853-84da-7c7bcca85018", "comment": "Malware payload", "value": "9f9d2eeb4c55962e4771fed02a66ac89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054740, "uuid": "3c834fed-03d9-4bd5-bf7b-5b5a8d31ef3b", "comment": "Malware payload", "value": "91af5b7dfb0cba2f5a7b77d317adb7fac20692d9f759127ecbd780e23fc4673d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054740, "uuid": "68f19b6c-fa4c-4094-b57e-6802bddf7a99", "comment": "Malware payload", "value": "1fc000f01ad7c8c55883aaeaceab5bbc5ef3fd77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054740, "uuid": "7e659c8a-7b75-48b2-a59e-535ae4e1e0a1", "comment": "Malware payload", "value": "2d528a992260da3cf72a0c93e6c268281c801f12497fea2f81413967132a0267e8585d2d11de93b4ced5c66c4fc8f0a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054740, "uuid": "1063d658-c5dd-48a1-bbb4-ed1935ef472d", "value": "T168056A28E76B0B62DC35DF73E2666896B2E4B91FBE9DCD383CD61484051390361B227D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054740, "uuid": "6f287787-f5ac-40f5-b5ad-401b492cae5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054740, "uuid": "a37b16e2-1a1f-4c53-8a69-e8d7d06ca0cf", "value": "12288:DC9PC6YN1Pg+70pKXQlIj5g15BL980v/J11paGdyAwFqJATUR5AzFu9:b5g1z98qZpaGIAAqApu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683054740, "uuid": "2a8e4389-0faa-4c89-a840-ac29d38faed7", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683054740, "uuid": "bb7590d8-26a7-445d-8260-7b4c6768af9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054740, "uuid": "9b1ff6a1-871c-4baf-a0e4-615cbe83d473", "value": "INS Rem CrdT TT copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3cdf97-e8de-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683027642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027642, "uuid": "d5fe078f-ecd8-4dbb-a066-3b80aebd5528", "comment": "Malware payload (AgentTesla)", "value": "553b4d897da4c3da7216ad4e24b96b5c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027642, "uuid": "5d63b3b3-01c7-4a57-91f4-a14b094aa7f3", "comment": "Malware payload (AgentTesla)", "value": "927d3a3220ea7299db6e08a1f1200c2c0c5997ae29a658d1ca8136acaa92153f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027642, "uuid": "5441bdfa-d386-47e9-b245-dd2f1f1f1da8", "comment": "Malware payload (AgentTesla)", "value": "7d01649c80654ddcd7ffd7fd91c8c004acad0802", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027642, "uuid": "80658f2b-12a3-4776-9f3b-67f221d42645", "comment": "Malware payload (AgentTesla)", "value": "4853488592c0a4c49305650516fd1ca836de4c4a92727704a2214216b8581fe0b19d16a5a11480ba87caa840ad51bf11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027642, "uuid": "b9a555b4-6c13-4495-8d99-affe6265ecd9", "value": "T1F242D62073518948E5518E328CA397980237F913887EAF5D37CC5E2F6F33A998932766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027642, "uuid": "68900582-a346-4780-9f7a-afb0ef3ff2e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027642, "uuid": "5133f176-02ff-4a90-b5cb-e36c414cdb22", "value": "192:ea1EDKLISAzYfL4QzeRIj/NeTR32NeT4+vDqdwj4ZhAN2M:evDKLISAz3QzeibNekNek+vDwwkZhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027642, "uuid": "0ca038ca-178e-431a-9974-ae50fd7dcaa5", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027642, "uuid": "1350c37d-c6a0-4970-8a39-a1e842804171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027642, "uuid": "d36ce3a0-5697-413a-8831-dd89d9ae735a", "value": "Medline Request For Quotation_211436 XLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20e3171-e8d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683022822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022822, "uuid": "2b6533c3-37d2-4516-9cd5-2367612be477", "comment": "Malware payload (AsyncRAT)", "value": "b25177d94eb0b6b5c575ae36be7b75ed", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022822, "uuid": "36ce1d46-53eb-40d5-a8a2-dcf51280dc62", "comment": "Malware payload (AsyncRAT)", "value": "9345d562f0d76585ff120cffb66d4798bbc828f4ed9156bb79f283cfc0bc7da7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022822, "uuid": "ce3d0a73-1722-48a8-b872-829ed1662930", "comment": "Malware payload (AsyncRAT)", "value": "8590f116464550fbb32490fc183220ae395699fb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022822, "uuid": "e0d7d53d-fa83-4a5f-b32c-8b295bde5688", "comment": "Malware payload (AsyncRAT)", "value": "99a38f767fd8a73dc75dabab0bf2e9ede860c7584e5fbd6f273bb03b47931a446496c5095383910ba57815e4e65442ff", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022822, "uuid": "e1092b46-54d6-40d4-8f01-9f0ae0cead64", "value": "T1EF232B103BE9812BF2BE4F74A8F32255867AF2633603D94D2CC452975713BC696426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022822, "uuid": "ae4f28d1-bc91-43cb-a609-97a2e491f3e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022822, "uuid": "e2a0a504-2e1e-430d-88d4-78fda4b4787d", "value": "768:7u6XdTvER+SWUkzP4mo2qb0wAJcVrPIMYVPINBk0b0nSk/Tlmghgej4qMJwBDZkx:7u6XdTv2V2lwSceMYVwXHb0h/xmWaOdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683022822, "uuid": "e6663be3-b9ed-465b-88f4-fc00f3f4c19e", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683022822, "uuid": "7f8976e9-e473-4e5d-b564-0532b29aa749", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022822, "uuid": "fdc92536-0f1a-4d9e-910e-ca19e1e1c171", "value": "9345D562F0D76585FF120CFFB66D4798BBC828F4ED915.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1dc241-e8e2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683029707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029707, "uuid": "9fcd7193-19df-4f83-ad36-500310114dc3", "comment": "Malware payload (AgentTesla)", "value": "8d361274685c6e905923e1743cff08e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029707, "uuid": "1c859be4-a0bf-4ada-8967-972e291071e6", "comment": "Malware payload (AgentTesla)", "value": "9356d56bc50ab9c3138c1508dde0c7f91732aa2a49ba0dc047777c33dc4ad7d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029707, "uuid": "4d6d1a01-5955-4192-9170-9e87a46de847", "comment": "Malware payload (AgentTesla)", "value": "c24c935d442e531a18cdf4c5cff3b92feda8d008", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029707, "uuid": "3be44f5b-d84c-4791-8118-9f5d0f6538dc", "comment": "Malware payload (AgentTesla)", "value": "ebfbeb5c40ddffc14c35334b11e440acfcc46223773da44d229073ca1ca189df9656dbc7a85746cdec316681a0db16df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029707, "uuid": "1465a80d-9ae2-4c4a-b5b2-e2ede3bf016a", "value": "T15C32927193D9C636D5B3473EDB32D6B68273EEC058228B1E64C07D1B7A327D10926A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029707, "uuid": "9dc80417-18cb-4371-a076-e90936defe5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029707, "uuid": "afc28dcc-8657-43c0-8da1-baee0821c0aa", "value": "96:Zgd9i15VpHbKNK8Zwr0jE9yv1Kxv+FTIPcZhLCzjDwIv8+yU0Qb7DzNt:lpHwKG49ydK1+FEcZhiYSNyIbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683029707, "uuid": "1fbbde36-1abd-410b-91fd-a8bad911a019", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683029707, "uuid": "bfad094e-d5ef-4caf-b9ac-3693c11e8c1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029707, "uuid": "03c8655e-08c2-4e03-8621-4b9e973807a8", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035ff9d2-e8ce-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683020703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020703, "uuid": "3abb326d-25ed-460d-a68a-1955cf915afb", "comment": "Malware payload (Vidar)", "value": "317770e0325f5ab8b8cb64f332408c51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020703, "uuid": "a80ddb99-21e5-44a0-b79c-0a04a69268aa", "comment": "Malware payload (Vidar)", "value": "938838df2c9cd3f4bc874fccdd0a7a539e570b1983b3c0db816b77e5a7f209c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020703, "uuid": "572397be-59b0-439b-9933-2eb59eb74fd0", "comment": "Malware payload (Vidar)", "value": "94b6cfd2f271ab9f9b4605c866e8f01e5f83d4b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020703, "uuid": "85bf8f8c-9eda-4724-93fd-86415259ae53", "comment": "Malware payload (Vidar)", "value": "06e7ef57377a21fc9fb3f5f0497bd075da6c7e118add5a9be495c358fd5aaebf5221bbe6871df6a80c30c39367930aba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020703, "uuid": "e4b5fa6c-e5c7-42b7-bb0e-c781f615ce43", "value": "T1CEE49E9C726072DFC867D472DEA85C68FB61787B931F4207A02716AD9A4D88BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020703, "uuid": "456726a8-706a-4e27-b6ec-28e8a49ce0c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020703, "uuid": "356a70f8-fd00-47e9-b466-3df4bb574302", "value": "12288:KX2tMJUAnGWfH7xg+vizwnenxqcBIhAWWjsRqUpmW2/shW0iSCaMnw+TajueXLvs:KXWAnlfHdTJwxpBItRzpR2//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683020703, "uuid": "069963bf-6d50-4d18-91b6-f10ec9e2d126", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683020703, "uuid": "849c495a-b999-4917-b19f-fd2ba4bb46cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020703, "uuid": "304b7341-2e65-4d79-a86b-d12959924d61", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d666591b-e8dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BluStealer)", "timestamp": 1683027070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027070, "uuid": "35bbea84-4e85-4435-820f-b161c0af8e29", "comment": "Malware payload (BluStealer)", "value": "5c435b912ff7ec3f5b147ff71a9ccf6f", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027070, "uuid": "5c538d55-fc9a-4a60-9726-8d5d7e5fea4a", "comment": "Malware payload (BluStealer)", "value": "94f51a2fef39412213639a0070d29e97a2f744dfb9bfdb8f4dea5f46052e8dda", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027070, "uuid": "17019871-d182-42a9-9514-97b27448b5af", "comment": "Malware payload (BluStealer)", "value": "da5f7424d4deef782190852f654b94dc9295afc1", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027070, "uuid": "c52d7107-66b9-4da5-9537-203ba2810a0a", "comment": "Malware payload (BluStealer)", "value": "fbf2fe44853240d51085f3470e3ade88955c16e0100dc7c010202caaacec46f32a9b7a0bd164e87032e759075d330da6", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027070, "uuid": "ea0ed9e9-b113-4ad6-8388-ba874f152c73", "value": "T12DE4128073B5A560CB49BB75E47040590633E7837C93EF977998232D0F967D8BF824AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027070, "uuid": "c3c94ba3-35d9-431b-98d6-2ca31c2345d0", "value": "12288:OrgmRp27goQV8bpxYHsntfwNM2wzO5j1tAilPTz8vf2ZeozmpgUMnGWIUP9c:OrgmR18b4MNwNMFzuTdJTufIW7WdP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027070, "uuid": "b56956b1-1a05-49bd-897e-786f27a97696", "value": 707656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027070, "uuid": "289ab139-a6e6-42da-af55-940e7d5ce97f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027070, "uuid": "79d97048-da02-4ea9-a947-fae3f42006c2", "value": "PEDIDO_02-05-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a969223-e8e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1683032446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032446, "uuid": "99fa429c-3eac-4799-8c6b-c18e708b3642", "comment": "Malware payload (ModiLoader)", "value": "eae3bd76ec42b738462cb746206550bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032446, "uuid": "42389532-b94c-45a3-b3ea-5d63b38f9b13", "comment": "Malware payload (ModiLoader)", "value": "969af9f6016a316693a0d710460a4b6576185a2907c999985f2642ef26889584", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032446, "uuid": "bc0a07fc-bdcd-4951-b66c-81828d33d1ce", "comment": "Malware payload (ModiLoader)", "value": "8f071fc96b3f464cd1fa1c63624c4e62270e22dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032446, "uuid": "aa78a92b-948c-4622-b22d-9da82b1c2e15", "comment": "Malware payload (ModiLoader)", "value": "61a70167a07164b69589a7a483bb16f819e603088ff9d72b6d5be92fe49ec6e04092f77200033f599a4dda1c61674e5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032446, "uuid": "1d864f4a-45db-4d24-b2fc-7eb8d5ff8393", "value": "T12EF49E12A1E1D832C15156384C9B9B699839FE203936AC477BEF3D0C5E7BEC1352B94B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032446, "uuid": "7b2beded-44b0-4883-8ce3-51895e06a6af", "value": "73e14b82fb329e8b569b595dcdd36b19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032446, "uuid": "947a4202-30c6-4d0c-85f8-7794ae0fe09a", "value": "12288:v5l9W77bOltPah+3EwFE4303gWWAAT6JlK0Xh:vHcOAIy2T6FXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683032446, "uuid": "4fd75b15-bf47-4b6a-8865-eb74bccf2a78", "value": 735456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683032446, "uuid": "87a8e89e-9c4c-4f82-a990-80609eedcf95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032446, "uuid": "dd3977e3-a6db-4c1a-8c13-d01dbf134856", "value": "Re Porforma Invoice 60 downpayment - PT Era F1909003 Project Kupang.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6a6265-e8c1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1683015402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015402, "uuid": "921e0f8c-f2f9-4232-b97e-f79f03bce7ba", "comment": "Malware payload (LgoogLoader)", "value": "48da9a5f3823e586e23a623f62b0e3f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015402, "uuid": "ea1ebd9a-d92c-462a-a4bc-b1adcfa60887", "comment": "Malware payload (LgoogLoader)", "value": "972f192ffc2be333bb6df62d1665aa7d08d325978896464902910a6b73d5b880", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015402, "uuid": "817ff9b7-811d-467c-acac-913375fdab35", "comment": "Malware payload (LgoogLoader)", "value": "64511c9fe053e5117001db40b0e882a3d9d97eb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015402, "uuid": "08b36d8e-cfd9-4cae-9b09-5ce3ce21e6e5", "comment": "Malware payload (LgoogLoader)", "value": "1a31c3b1c234fa5c64a2b927b9aa4ec9fd7a597e6dee2d931892abd99d4e63b5f336f46dc85a34d2f6751ab8e79fc6f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015402, "uuid": "79d79e84-be60-4f99-94bf-aeed4dff8a83", "value": "T105656A3439EA5029F173FF7A9FE874DADA6EB6733B07645A1090038A0723A41DDD153A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015402, "uuid": "690e5683-0a6f-4992-a8ac-f9c2596ea592", "value": "12288:NgfXbDaclxfmy+OpCdO7sqgOr9KHLCnUbV9xI0HbsPw7Y7Uipp+L6CRL120v8/s7:NA34kgPtH40RdAA7QS1Wf6CDruxp6/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683015402, "uuid": "75eb18c3-0e4b-4312-be2d-b3a641e4e418", "value": 1530752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683015402, "uuid": "04585b9e-40cd-4610-8106-7d9ec61c8fcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015402, "uuid": "05951552-d47a-434c-9d57-2766cb104734", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a04dc0-e8d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683024123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683024123, "uuid": "13aa546d-5f2f-4c39-bb98-75a6d4e84564", "comment": "Malware payload (Formbook)", "value": "2e427acc9f3e4ff7127a125a953a0909", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683024123, "uuid": "c7223b57-1099-473d-a518-5defdb627e53", "comment": "Malware payload (Formbook)", "value": "97e21d286bfa20d9d8af4d186c35c7af9e7cddd424459eab7c998d82f830e531", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683024123, "uuid": "56d15d4b-cd88-4221-a32d-50aa060002f4", "comment": "Malware payload (Formbook)", "value": "49d8de80063c75334701b10e142e30e7c9eafda7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683024123, "uuid": "2c6a7cd2-a795-4714-b779-e85c28ae889f", "comment": "Malware payload (Formbook)", "value": "747cdaa3ba48e934cc976c5ac88000eaf929c1a20a77c3e2616e438c5b01c59fb788179d6b0bccde178fcc7a9acad4a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683024123, "uuid": "8e7cf5b0-14cc-458c-9106-7817b445d520", "value": "T16454F10AAE04E8ABC87506BB3873E779D7922CD12825960767F17C2FFC715215D0E2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683024123, "uuid": "02c18b96-7818-43eb-b099-350a9dc58d72", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683024123, "uuid": "0c099a93-582f-4313-a64d-e5bb2d06830d", "value": "6144:V7ewrGFEEcCQ8DVbE/A/j30wrmMAjUNi9bsYuWVs3lAD2:5VrGFExR8DG/Ar0w6A49IlM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683024123, "uuid": "32706dd9-93c4-4f09-9e0a-763015b99c0d", "value": 304255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683024123, "uuid": "9519e6c8-2115-47af-8628-62f8ae40a5fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683024123, "uuid": "4db016d3-787c-45c1-9cfa-231570aa14de", "value": "DHL_2017128 Receipt Document,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ddb617-e8e8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1683031955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683031955, "uuid": "1dbaf9e3-8983-42a6-8e5a-6becf74bd369", "comment": "Malware payload (RecordBreaker)", "value": "028c97f3d802960a524da537c38e0b7b", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683031955, "uuid": "d0d084e1-1619-4113-9cf4-bfe2eee131fe", "comment": "Malware payload (RecordBreaker)", "value": "9916f3a5ce235c279c5619f4fe8566bb523fcf5f67194e098ab6d0dd8e98f53b", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683031955, "uuid": "2a00a3d2-2749-4947-b3b7-d403210a5f45", "comment": "Malware payload (RecordBreaker)", "value": "893d75dbe322f5fe55620f7f06ed6d74843d6036", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683031955, "uuid": "0f8c28e5-8011-4928-88f0-7cd988dede2b", "comment": "Malware payload (RecordBreaker)", "value": "d2f18d8d5aefb70d3dd3f699fb709917e712554b895d8697c45aece3601f827a934aee18e48ec8371f1c405482d822ba", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683031955, "uuid": "8e549161-f5cf-4be3-a46c-48f0983c2ee3", "value": "T140E633AD4F0665199C9C14DD4682EAF03D9F073201249E0D1B43B6E6DCD1AD8B9FCB6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683031955, "uuid": "29b1fb32-ad27-48c9-9119-34938815f6ab", "value": "196608:CvrHtHfe3D5ZjqDN7HnL2A1D1X1jGNV4h6Vl4ipVoWtaXgSqoun84kZnXNczapM8:yHtWfQp6cJ1j5UV6uIu+ndcBfyqIEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683031955, "uuid": "cf68dfa5-c991-4bbe-bf97-80b779f9ff79", "value": 14630926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683031955, "uuid": "04067b33-62c3-4c30-904a-bb3e24420fb7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683031955, "uuid": "49f1a549-1873-4f6d-a1f1-104d64b3401e", "value": "Setu\u0440.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07f8287-e8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1683019732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019732, "uuid": "01ead70f-7404-49d5-bc09-8129a3b110b7", "comment": "Malware payload (GCleaner)", "value": "c1e7e8224639e6e6633e0e30a6ddbc75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019732, "uuid": "a11ad291-42e0-40db-9db7-f923e04fd998", "comment": "Malware payload (GCleaner)", "value": "994d15b466bf1945ab533e3a680e4c0fcfc09d8bc9edda5a24b8c1c70827c29e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019732, "uuid": "f0560080-76e3-4c5f-99a1-af54e9bc1a31", "comment": "Malware payload (GCleaner)", "value": "c161f2efd4941a66e8dbbea3049547016d3f6b0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019732, "uuid": "ca2ba28c-a156-417d-9e8d-67e8aa5c59cf", "comment": "Malware payload (GCleaner)", "value": "cf8af2506dc7f62c520403f85428a2aca12308f3bba27e2af67fe9f283d26dcb977e4afbedb6ce4520c0ac5cdb702e58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019732, "uuid": "d4dd80dd-9705-4311-8885-cf3d851b46ff", "value": "T1EF85CF3FF268A13EC46A1B3245B39310997BBA61B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019732, "uuid": "c292198c-2b55-4124-8b98-997d3ea45149", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019732, "uuid": "4e686576-1bdc-4f13-90fd-d31ef3bc2654", "value": "24576:s7FUDowAyrTVE3U5F/+GqKBKic6QL3E2vVsjECUAQT45deRV9Rz:sBuZrEU7nKIy029s4C1eH9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019732, "uuid": "d944fcc0-9a37-453a-8512-0601a2a72300", "value": 1766604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019732, "uuid": "11b1bc5b-35ba-4785-a09c-4261ba7d005a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019732, "uuid": "0665a58f-d0fa-43ff-8d4b-89c777798c38", "value": "c1e7e8224639e6e6633e0e30a6ddbc75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86385f0a-e939-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683066879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683066879, "uuid": "afe269b0-de9d-40ca-bacf-b00b8b6c4e9c", "comment": "Malware payload (AgentTesla)", "value": "4b4924f0445bdfd1a135d3b0b9849c06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683066879, "uuid": "7cb953bb-109c-4b50-b16f-1f03bd4533dc", "comment": "Malware payload (AgentTesla)", "value": "99ab8536c0da1f4eb60edc3b8b848de23de618127baafcaa76ff80ab9b9ebf59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683066879, "uuid": "87d42515-0c9b-414c-bbdd-83e1c900067d", "comment": "Malware payload (AgentTesla)", "value": "ce92bf3853211136b390f22efc01eda1a5089457", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683066879, "uuid": "de3d067e-cfb8-4c8e-a823-6e3978338808", "comment": "Malware payload (AgentTesla)", "value": "d7f3cfd4d03c93e5d7d619177e94e468778c8e5da19b8e4368d0ff030973bdb25e2df56c6d62a645df6888fef3587ddf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683066879, "uuid": "97ccd754-080c-4900-9a0f-257aea355664", "value": "T19FD4DF0261A9CF5BFD3997F194A4FB8027F1B17798E0D1252EF610C9DAA5F010B4CA6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683066879, "uuid": "43a5480b-e5bf-4047-a500-0b3b103643a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683066879, "uuid": "030d2c67-898c-4a68-b1d4-9c64d19397e9", "value": "12288:Pzm1BbpDOioQIkHE7lohDSDVXKm0eAZjznvyon4:7m1Bbp4WE5ohuDc/1zU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683066879, "uuid": "ec91b928-5398-4763-bb6d-806fccc9b968", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683066879, "uuid": "ada3ab1b-850d-4bda-af4e-ed5e0d4afd62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683066879, "uuid": "7ddc89aa-94f3-442b-a1b9-9d8ff50a3b00", "value": "NOTICE OF ARRIVAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7fd47c-e92c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683061177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683061177, "uuid": "22c1b34e-74af-460f-ba11-b110e6534a9b", "comment": "Malware payload (AgentTesla)", "value": "9e21a2e30036cf2d5e4a58043af58664", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683061177, "uuid": "db3a80a7-5a7f-4c2b-a2ab-2f7e30e6c384", "comment": "Malware payload (AgentTesla)", "value": "99c2def0a7fd6901623dd3745abbf1330c38fa1f0a0b25280f46b4fcc6ae4ff7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683061177, "uuid": "be9be947-2635-44cf-9caf-91256aa59f0b", "comment": "Malware payload (AgentTesla)", "value": "f9c4448aa1d7eda7db70547f146397277809f859", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683061177, "uuid": "179bb1c9-c678-4f06-aa3e-b177eab31653", "comment": "Malware payload (AgentTesla)", "value": "401a94c72d3a5bfc05047492478dfcf97696339d912a8aa697e8db585e749c5f7d84ae4005f342a037a09cbb42693a33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683061177, "uuid": "0fd8dca0-066e-4c91-9307-35d110719eec", "value": "T18CC4DF1A51A4CB5BFD768BF09434FF8063F0B07754E4E2382FBA21C6D966F151A48A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683061177, "uuid": "d50a5769-ccd3-4401-919e-c837bc4538b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683061177, "uuid": "8ccaf969-7fb5-4884-9ee2-d271d031f929", "value": "12288:BakJqt9EUZJpSUdWO6sAafXnUYGL7X16bl8wGQUFFN9v/XSV:OrEy/9V6OXUYUX8bKt9nXSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683061177, "uuid": "03be6d76-70d9-4305-9d56-75c997980b71", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683061177, "uuid": "27dac478-8b8b-436f-8c98-50421b3446bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683061177, "uuid": "4134cdac-7283-49e0-bd31-e9a119b984ee", "value": "Avaliabil Account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81bde355-e910-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683049262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683049262, "uuid": "429b76b6-4714-474b-816c-b5bbee2a6ff8", "comment": "Malware payload", "value": "2d1014e80be261169992a62239d9bb72", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683049262, "uuid": "869905d2-48cc-4a47-b6ce-78c1e50d6de2", "comment": "Malware payload", "value": "9a0db4942b01135f86a637cff90a88334b57755360706ebcef7f2c19b85c5912", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683049262, "uuid": "d4ded3e0-2d33-44c8-9c60-f52b36e5bb97", "comment": "Malware payload", "value": "9b8973171a3ab23de74001a32499c6e46880388d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683049262, "uuid": "ce2e078b-947a-4ea6-b1e5-f2375de1046e", "comment": "Malware payload", "value": "7577ac06a1be3dcbb214ed226f886016664136d0d6940d987e91fd4fc50bba18fd0559970bd309d4ad1014ebd4ec39ad", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683049262, "uuid": "fbe55482-f6be-4d89-9b46-c246f51917ea", "value": "T1D472E1B415FF216CCAEB423FA9EBB3C801A7E0BD020FFC5854889A0A4C779749076047", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683049262, "uuid": "803a024b-e515-4468-ab85-8fc98ca04422", "value": "384:T0RmOTzitLtIMjJC6ZjTRwUV+0nw3NijL+vRWO1+EkvlHJMv:1AzgLtIMFC6Zjaaj+vRWO1WHJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683049262, "uuid": "c471d691-fc6a-441f-80c5-b7732b78cb01", "value": 17146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683049262, "uuid": "3207e8b4-453c-47a4-b3c6-de6aac9b5a53", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683049262, "uuid": "c4bfe00c-c693-483f-b431-68f7711b5101", "value": "B025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d555037-e8c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683016908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016908, "uuid": "43517d2c-7888-4f21-8b82-fe4a707dba61", "comment": "Malware payload (AgentTesla)", "value": "8a63588da706afe6ad891cc6b61cd9d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016908, "uuid": "c9589b55-ab80-4678-a4a8-5b7c3c397904", "comment": "Malware payload (AgentTesla)", "value": "9b2e92b05465f404ace0d2cf39af763b97c3a453ff9e88d4d4f689566d069ea6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016908, "uuid": "d38fca20-7639-4e6f-ab1e-4652e99a50b3", "comment": "Malware payload (AgentTesla)", "value": "a2d3a8385a705e836f2b137a2e86aab1727fa364", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016908, "uuid": "fffa886c-adfc-4dd4-84e4-f8f9279ad7ae", "comment": "Malware payload (AgentTesla)", "value": "9258fa77121271a3684615a7d5089a78f06021fbcaa6200fbdc813b3b19e3c88c9513da29d0e6ecf31e88bed805e22de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016908, "uuid": "e0e17c88-798f-4f8f-8711-ca852593cf08", "value": "T12664126523608577EF8B6F3261B0A72BD3FFEE9014818A0F57348DF62DA27919E164D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016908, "uuid": "4fd74425-31ea-4670-b479-5dd1c5651628", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016908, "uuid": "0816931a-e021-4ca9-8e5f-051e946d2f2f", "value": "6144:892neaPl4MQwlZuub60q2tBzssNBk4V7lmhND6YNVsSku/ciPNqIg:9ea94MQA1b60qYxs6GMwbxJc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683016908, "uuid": "0434def2-a64b-44b6-8523-31d91f7e5318", "value": 308400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683016908, "uuid": "fd0e0f1c-fd93-4901-9a69-1a676e412423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016908, "uuid": "a39ded6f-142b-4b12-9387-df6e2c6d9a81", "value": "008s06523610054680b601137503006202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e22e54-e8e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683029888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029888, "uuid": "508992fb-e37d-48b8-a6b9-db338d177547", "comment": "Malware payload (Formbook)", "value": "5bc95f5d8d3bf878098d8527bc679545", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029888, "uuid": "8f07c391-ab6d-4c08-b62f-8165ac942ef9", "comment": "Malware payload (Formbook)", "value": "9c3d5704da83029f78ee8cf532c746cd04834f5375a698f21c50040ade6c5a09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029888, "uuid": "c8f2965f-3b95-4169-9ecd-21b56a3a9a97", "comment": "Malware payload (Formbook)", "value": "88611ceeb815ac8f33599a2b6ab8ac6259621260", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029888, "uuid": "b04967c2-e119-4f07-aa92-34a50f9df2d4", "comment": "Malware payload (Formbook)", "value": "26ecdd70859382fa48e8ea1e744bd708fc2bc514e90c85355d42ef1781e4a539b2fd23b26d1dc10aeda8317352803b3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029888, "uuid": "bbe3c301-29a3-4454-908f-72d3b33e7cd8", "value": "T169E4E0132028C99AFD2DC774D478FBF421B8BCB3E4E5952327767D49F9B6B01190825A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029888, "uuid": "cd3456b8-98a4-4275-9524-1889fbe49e06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029888, "uuid": "46e4217f-23bf-4071-b38c-ab05d2110adc", "value": "12288:LBdsgj8Qph9X8ADOlBRUP+FKfY+EMlwpk5n5Hnll:HBj8G38Jr6cx+yWLnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683029888, "uuid": "a03f25c6-b0fe-4bc9-8d83-15f43b53241b", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683029888, "uuid": "9b3283b3-ee95-4992-b61b-70c91cdf61b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029888, "uuid": "f8fe69b9-2c01-4978-9748-c08588aab58e", "value": "5bc95f5d8d3bf878098d8527bc679545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61753385-e8d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683023438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023438, "uuid": "266af7ff-11b8-4179-9e65-5d023696ab85", "comment": "Malware payload", "value": "5e774eef4e31094fb348e5e9a1f2d65e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023438, "uuid": "aac0f976-e348-4d42-baa8-a3e0290e1357", "comment": "Malware payload", "value": "9d2bb6c6f36d4e4c4f11a69eb1d7fb2ac328e603bfe82b8dea36e384eec439b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023438, "uuid": "191fdd33-f386-434c-8558-5ffa5143e2ab", "comment": "Malware payload", "value": "3616a3ac9992b50224d356c99e3516695f630445", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023438, "uuid": "982d1797-38c1-4e45-aef2-71c9e582bcbb", "comment": "Malware payload", "value": "ec8b958a2ae1aca5a18df85a7c670af25f1c03b21c21e8ba5683f9f19fabcfbe767c6d06f1643ee2e4b17f5ea360e107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023438, "uuid": "057c9367-8527-4404-b7ad-907a1f9178e3", "value": "T1C5236C0276E1C431E4A303701AB8D6625BBF7D629B74819B3B9C065D5FB13D05A3D397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023438, "uuid": "0339f5d9-333c-4617-aea8-041d302ac91c", "value": "b79142f1df6c12c1bc1cb268b4f995de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023438, "uuid": "d8c70fbb-bab9-4bc6-9473-cc897864b63c", "value": "768:56nhkHDSYGd1jwqrcTybYGfEM/tPNK9W04xxmVs//:56hQ+veqrcSV+4+y/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683023438, "uuid": "3870cb75-a305-449e-bdb6-9b7f7690273b", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683023438, "uuid": "5ea98176-5451-49d7-9c51-3f7019f34e45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023438, "uuid": "d722e547-a555-444a-8904-90cab640dad6", "value": "SecuriteInfo.com.Variant.Fragtor.273750.29364.6434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f059f444-e89d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683000055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683000055, "uuid": "f7fd7aac-0d27-4210-a16c-661ddd21e54b", "comment": "Malware payload (Mirai)", "value": "0e059b730fed0d84e4acc901cf377b54", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683000055, "uuid": "639ea5a1-d5b7-41a8-b4cf-9c0a3381941f", "comment": "Malware payload (Mirai)", "value": "9d41d1b5c7d5951fc8308c4d420418eb40d82e22fdc60ed6275522bff8944c1f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683000055, "uuid": "e1990040-b407-420d-a9ee-aca9b8af7e0c", "comment": "Malware payload (Mirai)", "value": "3c970c1ee2b58b88acf19ada8c903fb2eefaf508", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683000055, "uuid": "54885579-12e7-4ab6-9239-f658a822e9a9", "comment": "Malware payload (Mirai)", "value": "f75dce344c73c3cc08e21a50e7e076889300b9fea370eb7193adb08ae78611f3afb1d15b17be67d36ef08f11192c31b0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683000055, "uuid": "6cdfab57-acb1-4a88-99b5-7b542b695f46", "value": "T1FEA2E148C43D84BFF446027E9D0501B778BB661107878DD7A918E79B2ED2439C179FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683000055, "uuid": "15bc5069-8fda-4b61-94e1-e4af35c184d6", "value": "384:IZRb4hXnbGjJHxtbHHg1A+giifPCHJjWkiaIuIejsCPzUoMPotiBHdcliFqcJT:IZRUbGjJrM1U1CH5BItY4oMtHd8s5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683000055, "uuid": "4b93b5d3-3837-4392-859c-4a80498e4cde", "value": 23084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683000055, "uuid": "ba4de0ff-03f3-42d1-8996-721621897e9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683000055, "uuid": "cac8f0b9-e4dc-4045-87e7-9ecca72d14a8", "value": "0e059b730fed0d84e4acc901cf377b54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80c3317-e8d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683023234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023234, "uuid": "d8622460-42dd-44ed-a75d-3c1fba501c84", "comment": "Malware payload (Loki)", "value": "c4061484a7e793eb92b7aec1b769dbc4", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023234, "uuid": "60453994-9466-4e48-b542-78d01e33be75", "comment": "Malware payload (Loki)", "value": "9e7790d4954d3c4177c1cf3ca052e312d8cc72e9d49266ada264c99097d6538b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023234, "uuid": "55badc3b-abfd-493e-bd6e-003624a2933d", "comment": "Malware payload (Loki)", "value": "b82fd526d6f7d44276d554d28826b628f9a12f71", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023234, "uuid": "b2b63427-285b-441f-a662-04381e374780", "comment": "Malware payload (Loki)", "value": "e12b1625f95fb1850ed80cd5c67644edfd6aed973b556cb72526e1968b945d503c497f0a66b9616fe16d96d70222496d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023234, "uuid": "94d38dff-614c-4083-b7f2-115e45288530", "value": "T13A45E013E3408DABE89187717F1799DA121A7D513E86F8833082B35F7A32F52AD63749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023234, "uuid": "243694ea-e0ed-4fa0-b1a8-d5eb3940fb47", "value": "24576:6LK1zI0xu9Vlxu9VxJu9Vau9VgdqB1v5rYnhbXylSWPbqjPSyQ:6LK3uvunuSuQqB1xrYhruRPejxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683023234, "uuid": "e12a29af-79e3-47d3-bd1e-80a05bb2f9e5", "value": 1199616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683023234, "uuid": "30d18369-063a-4418-bab5-9447c67a31e0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023234, "uuid": "cdfea349-5466-43bb-9371-6c4d398a4528", "value": "PO M01672.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b54f06-e91d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683054790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054790, "uuid": "f430a753-31bf-43ce-8924-f470e52b9ccd", "comment": "Malware payload (AgentTesla)", "value": "719db535617887ab0338a39339ff5cab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054790, "uuid": "0093dd02-77d3-44cf-ac9c-b7638aa208c5", "comment": "Malware payload (AgentTesla)", "value": "9eca24527414a8c5711c376502863053d89c0d82525cfd1dc98a6364975107bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054790, "uuid": "2b55f98d-c0df-4290-8dc2-686224831956", "comment": "Malware payload (AgentTesla)", "value": "82dd2849cfd33a4a5a11be204a991b6cc3ecc9e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054790, "uuid": "f5063af0-765c-4e57-94b5-60830ed512be", "comment": "Malware payload (AgentTesla)", "value": "0f8f5ee3dce0c94c1050f930358cf66f80cc18acaf82c5530340ec26ed45202a23ab43d8e71f94c8b54d391facb1bc32", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054790, "uuid": "cac63f72-3e78-4d1a-8423-c7264a39184f", "value": "T125F48C3D277B1B62DC34D6B7D728D436B2A1BD5B721DCD2828C62D87352381326A326D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054790, "uuid": "fc9da015-5d68-40e5-8781-511185199ae7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054790, "uuid": "5ffaa8ea-2bf4-4b9d-ad57-08f4cb74fc00", "value": "12288:aeEC6YN1PZGEDUuAapisYH7ew3P8HjuiiZU8dW3ujrDLfUYgAVuQYX2:3LuappYHb3PauiiZUd+jLfUYg6uVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683054790, "uuid": "ddf3b82c-d8ee-49d8-8419-1c3a1542cbda", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683054790, "uuid": "7c62c22e-27cf-42c5-8f17-df8ed642bf21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054790, "uuid": "d40bacc8-4604-4a89-9267-f1d72baab8a9", "value": "Int Remit TT copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ac39b1-e8b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683009277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009277, "uuid": "cacc5e75-332a-4fe3-87a9-3defb7753407", "comment": "Malware payload (RemcosRAT)", "value": "081dc244c8591f618d3fc227e86a4abc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009277, "uuid": "8b56c064-3f60-4f6e-adbd-aef6f8d598df", "comment": "Malware payload (RemcosRAT)", "value": "a010744d195f820dbcea6d952671974bc2c6e3728b5d09b19961fbf380553df6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009277, "uuid": "2a72e6d9-3e10-4f0d-9c8e-6f577ede442a", "comment": "Malware payload (RemcosRAT)", "value": "d3404fc84a46ff673816c696a66be96e797d5de3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009277, "uuid": "8861253f-6c50-4064-b518-9ba568cdd722", "comment": "Malware payload (RemcosRAT)", "value": "d4367ded701387dce5273e4ed654ed422089181906cda147738008a89ef97b0c7db233ad3a03339a2af6375c46d174cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009277, "uuid": "0a7fc414-09dc-4274-b753-1b9d7a4722ea", "value": "T11EA4B001BAC2C072D57664300D3AE726DAB8F9212935597B73DA0D5EEE70190F73A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009277, "uuid": "341ee301-910c-4d46-aaad-f226f8b34e8f", "value": "b1c8f7572a6db205362528e88fd3ff32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009277, "uuid": "5fe07f1a-f36c-4987-8b90-60118c4956cc", "value": "6144:hXVUvr+eNVx6JuGD5To83sRnymABKtqulRwOJfZJEfcZdC48hAj+WsAOZZ8RX7mT:hX8/Vx65HCnDAByqulR1fZJQes/Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683009277, "uuid": "8b5af47a-a431-4a88-981f-298ab5a0ded3", "value": 473088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683009277, "uuid": "3305e5f8-8f0d-491e-94db-0f42d5235934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009277, "uuid": "7c60d28a-80c5-49c9-a2c3-08df255f1d43", "value": "081dc244c8591f618d3fc227e86a4abc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2a954b-e8ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683006570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006570, "uuid": "53ec89a0-34d2-48bd-a77f-505f788641e5", "comment": "Malware payload (SnakeKeylogger)", "value": "d56b5825767c11b91408069481007a40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006570, "uuid": "dede5e0a-3fbe-4830-9aa9-bf9df7df44fa", "comment": "Malware payload (SnakeKeylogger)", "value": "a158e9d32de440383597798db8deae678b54f6d0378a9788ff1a87a1e239f2f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006570, "uuid": "f7563bdb-c995-4818-8ade-6a9133dbdf39", "comment": "Malware payload (SnakeKeylogger)", "value": "f448108c0e83fe0ea6f7ece79c98f1d5527d673c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006570, "uuid": "72edb256-fb1c-4f0a-a1ab-dd8603c0a6d8", "comment": "Malware payload (SnakeKeylogger)", "value": "600e853e31b71390747eae98076ec5efe81998226038e70bacc8e55589fde9a5d392dc4cb7c3340d08920e78924ddfc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006570, "uuid": "b9d8393a-9cae-4cec-9886-d3e0443548e8", "value": "T147E4BF4736468658DEBD5BFAA217800023A6DEBFD515D30D6FC432DB6EE2F92081271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006570, "uuid": "4da31f09-0a3c-4c07-918d-e7e93d221584", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006570, "uuid": "09573e94-5b23-4850-84ed-313d4b70fea2", "value": "12288:uZo/arWBv6pOw5XxzwvJLyQ+o5v6nnjqKoe:LarWN6pOgBzwhL8op6nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683006570, "uuid": "5c31bd7b-a7c4-434d-849a-504c6d414976", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683006570, "uuid": "58b187fa-4b31-4422-a257-1afa950627bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006570, "uuid": "42841bab-b4a1-4d66-9318-04706d3423ab", "value": "A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc5bf6e-e8aa-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683005661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005661, "uuid": "5df1ac82-92cb-43f0-b330-9a4dffdfde8a", "comment": "Malware payload", "value": "3562461f8f49f7997fa3d1d1002a62c2", "object_relation": "md5", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005661, "uuid": "59b0e1bd-d5d1-42d4-91f8-e13090eb9307", "comment": "Malware payload", "value": "a16a44c2c1e2fe462f2822bf35f8cbae8ef5fde920c9c3412dd764065b8900ec", "object_relation": "sha256", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005661, "uuid": "68482316-859d-4e2a-ab95-3358fa127514", "comment": "Malware payload", "value": "2f2e45dd3d79ed21d5b36dfeef2c2458f582e07b", "object_relation": "sha1", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005661, "uuid": "b503fc6e-0a14-4070-8d7d-4789f74da38e", "comment": "Malware payload", "value": "5f005c36f80b2f8dfe6ec8c124971663085dd407ac51e2943ee30ff29e8e18d4efc6946e46d5fb196ff72c92ee0b1cc0", "object_relation": "sha3-384", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005661, "uuid": "65556617-7d27-4f56-a7bb-b2a9998c8f33", "value": "T18C44233103B91D9C80A7BCF2F4DE52B7BD5D5DAC91B1A113E9E41216BB80203AF22876", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005661, "uuid": "995188d7-1320-4d95-8c75-f61885290c4b", "value": "6144:y1TJWyGN+b2VDQauXwXKcfONarYSGU9CZAYMGwKq6+Ots:UJWya+2qFeoU9CZ5MGUOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683005661, "uuid": "7ddd788c-7c6b-4e9b-bf83-1b4885c5b032", "value": 277884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683005661, "uuid": "ecee6849-fbf4-4673-a386-a011e1b44747", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005661, "uuid": "88cc2b99-245e-4e48-b7f1-fa4264f2e0ab", "value": "SWIFT COPY-345655445566544556_pdf.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e48cc0d-e8e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683029875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029875, "uuid": "eaa9aefe-8f18-4700-abfe-f948c575f7a8", "comment": "Malware payload (SnakeKeylogger)", "value": "0d4950c69afb9b3c9b2d52b7b5ae9d41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029875, "uuid": "8bcf1ae1-49f9-4558-acca-4cccdccff1eb", "comment": "Malware payload (SnakeKeylogger)", "value": "a3e34d9df2e5ed18ecb2236c44428ecb068bf476767eb482e0812eeb761071fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029875, "uuid": "6061463c-95e8-4315-86f5-a10bf60f2cfc", "comment": "Malware payload (SnakeKeylogger)", "value": "83d808fb0f8b8e35fc9ffa92fa0ff6e90bb55da0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029875, "uuid": "2c7d5a78-4ba9-431d-827c-eac680616618", "comment": "Malware payload (SnakeKeylogger)", "value": "812796f9768f442fc63703565be2d2a555c4f1c68318deb32d0e8f7f6abda7baf26bd8139377213da0261abc3b148d5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029875, "uuid": "6cf63485-871c-4ff7-bd0b-0a49f219726a", "value": "T1DAC4D01A6164CF0BFD3A8BF09478FF8463F0B07760E4D1242EBA60D5DAA6F101E5865B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029875, "uuid": "f332fde7-c50e-4c46-b631-f870c3b74213", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029875, "uuid": "767ff477-e238-4ef9-9a4c-642a3b73f70f", "value": "12288:7LalT62iZFFmfaG/I2U7ttsqbEvxA9RDM6uARdWzMM:qY2uFmfaG/I2ULBb2A/DM6dEYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683029875, "uuid": "e1408e6d-c77e-4d0b-a221-3c12730ac6f5", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683029875, "uuid": "fad1ffd3-e497-4fa5-a78d-9aac89c1f437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029875, "uuid": "835f9f72-b568-4517-b8c5-7bf96cc7eee0", "value": "0d4950c69afb9b3c9b2d52b7b5ae9d41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6189d10b-e90e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683048349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683048349, "uuid": "45de15db-702d-4b0e-b46e-dac05d277d9c", "comment": "Malware payload", "value": "57cb8dcbb6c224295c17459cedfdd57d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683048349, "uuid": "b80546d9-6306-4d32-a484-df950133435b", "comment": "Malware payload", "value": "a42bbf71beca5218346126f2fe9fc4c9b6fe6cde38844c0385291791851430e1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683048349, "uuid": "5ca33e11-9243-4c66-aecc-2d660b7c606e", "comment": "Malware payload", "value": "8d2e08a2476cc220e8c4ea509acb755db9a9589a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683048349, "uuid": "27e7a1fc-9f5a-4099-a9f5-69107fcfa6c3", "comment": "Malware payload", "value": "1641dd45e8f628a3df386bfd8460a9d4b0c7def60522f59e00cd3c0fee975fadbbfddfcdabab988f694e64fff1aaf344", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683048349, "uuid": "96209d1e-82a8-4f43-a86d-bfe70fb475d7", "value": "T14F573332B9C9CA3AD92D1DB0226EC76D04D93D65636184D303D4BC3A06E36D2D778E9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683048349, "uuid": "84a4d5d4-2468-4ef0-aa71-a88c5971fdd0", "value": "786432:3rIe2GRrz0+5Hl0pl1KFMjx/fEtyeEs6rX:3rIDGCJlAiEtXELX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683048349, "uuid": "4d3c98d4-dc4c-4941-b7f0-59191bf6df60", "value": 27568128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683048349, "uuid": "99447925-ee44-475e-a9f6-19481f6dcf54", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683048349, "uuid": "863d5856-cd52-4bc3-bb40-37c6ebd2e773", "value": "197136rtsHFN930.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0174941-e906-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CobaltStrike)", "timestamp": 1683045018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683045018, "uuid": "6fd4132d-952b-4451-9663-d677aba867a8", "comment": "Malware payload (CobaltStrike)", "value": "275260b8022d4e85afea5c846d0031b8", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683045018, "uuid": "afa03b2c-5ca6-4021-aa49-bc7023c63495", "comment": "Malware payload (CobaltStrike)", "value": "a4ac7ae499a7d0e74b83983737e372d505ae0eb43578a46930c43024548acafe", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683045018, "uuid": "dd2ac05d-7c38-4163-8d4e-7fda14909517", "comment": "Malware payload (CobaltStrike)", "value": "95b8eac214072f5cfc356dafbfc6bc188506caa9", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683045018, "uuid": "36d144db-4bfe-48e1-931e-936f3dc9db5c", "comment": "Malware payload (CobaltStrike)", "value": "82c1fadd345c2ec3fd19fffa781a55f4c4a5ba9e69e153bf38762e720045e90ea8f5ca12b7d186ba4ffb546a78d1839e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683045018, "uuid": "8fec16f9-8906-4c86-afc1-0cd0db0b667e", "value": "T1D84373D53AD89C9AEA14563C40EAD231623DB6E0D7534B436A3077320F12FE17AD726E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683045018, "uuid": "cbdbf548-a37d-45fe-9b09-a9e8889bf7c3", "value": "a02a9c0961395ca3c1042375292f723b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683045018, "uuid": "5640a047-bb2f-4183-974d-fa12fd92103d", "value": "768:hCH5efqOCccjxKZdR9whXNpok31vSRg0NS3vAb7+E:NfFCuR9whjok3xSRg0UfW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683045018, "uuid": "b98dcb5e-bef3-47d2-968b-91e08d5cf7f5", "value": 56192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683045018, "uuid": "23cb0e1e-d59a-4173-916d-d276e0cddb30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683045018, "uuid": "8eee31c3-556f-4ac7-8c46-26e970935bd4", "value": "275260b8022d4e85afea5c846d0031b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b277f14-e8f6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683038030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683038030, "uuid": "c2e1bc80-68cb-4a36-b13e-204dcc1c5377", "comment": "Malware payload", "value": "d9e11790a7fef40f5776de7d38a65bbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "softonic", "colour": "#033D0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683038030, "uuid": "ca4845a9-9f10-483c-b56b-79d37b3a5bb4", "comment": "Malware payload", "value": "a74f88fa3f6d8c49a9d45c0f838d78d94756ce613f5d810385911c7b03741b11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "softonic", "colour": "#033D0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683038030, "uuid": "5f54aca8-8824-4a82-9738-e17eef606376", "comment": "Malware payload", "value": "c5c62a5807d8876ece11fd31495679fbe25eeb3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "softonic", "colour": "#033D0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683038030, "uuid": "bbfca441-27d2-4c7a-92f9-40843901148b", "comment": "Malware payload", "value": "492330216f9fe04eeba766cadd98b6b78f336dbe47bd3a7a64ebe0433147b3ef97813cc01f41249fa3b1b42163d2ec30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "softonic", "colour": "#033D0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683038030, "uuid": "ce606935-3035-4293-ac56-5c37771ef861", "value": "T17F85CF3FF2A8A13EC46A1B3245738350997B7B61A80A8C1E07FC794DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683038030, "uuid": "1d00e7cb-2641-4b73-8bf3-5f9837b8b1a2", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683038030, "uuid": "a8c4fe17-e40d-47f4-8f95-8109774404a7", "value": "24576:R7FUDowAyrTVE3U5Fmdvpi4PaJPfrT90eKc4cgFLNPfs8duMpmsDx:RBuZrEUqpi4wPH9RHgFLRdp/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683038030, "uuid": "797fbdd3-08a2-410e-abed-1071995785d8", "value": 1800120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683038030, "uuid": "9e6bece1-d3d8-402b-a72a-f605c50486fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683038030, "uuid": "d50af046-4b12-45cb-b461-c7b6f64ffcc7", "value": "balabolka-2.15.0.843-installer_dpz1y-1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61c9e02-e8b9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683012010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683012010, "uuid": "22d641e9-73d8-427a-bef8-340d294517ec", "comment": "Malware payload (Loki)", "value": "c9de85526156e6dc992b59253dfa9fa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683012010, "uuid": "f171faec-6f84-4f6c-84c4-0bb97385c3f7", "comment": "Malware payload (Loki)", "value": "a830c1c0b8b703ae15bdff4894582eebd797645c3ba85cfd1c8574959ebb1f31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683012010, "uuid": "5ab9f7f7-8141-4b94-9829-f70fb5150bac", "comment": "Malware payload (Loki)", "value": "c242f715dcaa9e92920b185d14d80c4676971e3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683012010, "uuid": "394ce35e-d8f9-47a6-925c-935c8c8b8495", "comment": "Malware payload (Loki)", "value": "47a34aeae7818a1b562ba85769f2d81e000a13ba07f704fd3e7b34a5986cc765d46a7c662673ae9ed013ded22b6f3458", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683012010, "uuid": "46d1d475-34fa-4e19-b7b3-189d4200b57e", "value": "T107F302143AE0C473EDF11A720E7B566ADAB7E94118B84B0F33214A8D7D36E95E949333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683012010, "uuid": "28bcbf1a-4254-42d0-b391-4abec5224f68", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683012010, "uuid": "5bfe09d8-effa-486b-b6f4-ce7d3d994a43", "value": "3072:HfY/TU9fE9PEtu9bXNYSssMrx+FBqXWv/WwXsNi6RS0MqGxojK2JV4XQXJ:/Ya6rXNYXLbW35Xqi6RS0uxsKCV4CJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683012010, "uuid": "b3d51086-5a36-4e3a-9dc6-d68d669581fc", "value": 168764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683012010, "uuid": "a62753b4-b448-440e-8fb8-53b986fd70ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683012010, "uuid": "5faa06e9-8f13-4ae0-907d-1e1a4d574787", "value": "Signed Proposal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055c3a6a-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683013405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013405, "uuid": "319a920f-78eb-42df-a279-690fddc0df86", "comment": "Malware payload (RemcosRAT)", "value": "bc02436758ba6a3ec1aaf1dbb108833c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013405, "uuid": "614e2d30-06a6-45b1-8c2f-835b6c965944", "comment": "Malware payload (RemcosRAT)", "value": "a87e9809c1327f158c9fe09cf7674ad200957f1a3446a9f3d6c238d535a4bba3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013405, "uuid": "e30bf6e5-5ba3-49e7-8c85-3fe6ece86898", "comment": "Malware payload (RemcosRAT)", "value": "4b5074b54c5c117564d13aff64601030d87471d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013405, "uuid": "2afd6f7c-50cb-4255-a621-5e6a1394ba2b", "comment": "Malware payload (RemcosRAT)", "value": "623ff0f09bbdd56da67da5e18538e5defeed89f9db2c21d6a6a7ea57844012c10d68cb054d4f808ab5ae5a7a8413a2b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013405, "uuid": "ae783f01-5e44-42b8-a63e-78c1e7537a99", "value": "T1D3040A013BEA47A2F3F697BAECA111005FF8B64AA649EFFD505510EC44A37049A87773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013405, "uuid": "51a25887-6fed-4652-8b8e-0b01577c8f66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013405, "uuid": "990d9410-cc50-49f6-b29f-fd9c85a9db2d", "value": "3072:MRAADPv3IUBIc8gbQQxabIQf1/fDRklOrbwPMDzBT7RY5hT8PIZ7M6hrG:wr3pBz8gbQQDc1/lklOPwPMDVqtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013405, "uuid": "27648864-a60e-400f-be71-1db512ac282e", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013405, "uuid": "a540fd7b-af9b-47f7-96ac-b2541621de94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013405, "uuid": "a2d66455-6e5f-4cf8-b827-995b5fac10c6", "value": "Purchase Inquiry-2023042712510625HD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa81c98-e8c4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683016456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016456, "uuid": "7237149a-8006-4782-9edb-73c1f8c44839", "comment": "Malware payload (RedLineStealer)", "value": "5812c5ec8f81f425d2bc75343e13358d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016456, "uuid": "d8733bcd-2a05-4080-87fc-9ea2c1ee1c36", "comment": "Malware payload (RedLineStealer)", "value": "a8a235ab55e16f8f8e31b70ae3ad1fb1e8ac29f705d0801fec83d1bb66c3c622", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016456, "uuid": "21863c2e-dda7-4f22-9ba2-7d1331f25992", "comment": "Malware payload (RedLineStealer)", "value": "d315ef232ab79f56a8bbd79f867263bb2edf069b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016456, "uuid": "51190bc8-5028-4894-9e66-6edac7faec8c", "comment": "Malware payload (RedLineStealer)", "value": "5cdb7de2522db20cd30e09d055c30dcc5c22e55c011cc362f16053f7d7fafc38cc67ea826d08503bebb0b9166d39437e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016456, "uuid": "b7b2c238-8eae-4775-8238-3a48d234ec2f", "value": "T15D749D26B5B54CB9ED3298B81CF862101F19B0762BAF20FFBF6D11190F452E259B7325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016456, "uuid": "44d4b136-3508-47a4-a36c-582ef491a9a9", "value": "ca51866544cc4f9b57ae23cd5e871b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016456, "uuid": "4e3174fa-0f2e-4228-8b9d-f65733352ffc", "value": "6144:8ga/FSEyeLXFFWxO9QvIdcDkoD7YEWPt4mj5Mgdz3DNOu6H8PI:8djyeuxbvucDkoD5WP/Dz3DNOu6H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683016456, "uuid": "0f1e611b-4a6b-4a58-b289-97bf27684c0e", "value": 360544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683016456, "uuid": "bc0cd3e4-cb6c-4487-8721-d7aa35beca9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016456, "uuid": "33c7bae0-c83b-45c8-875d-bdbd88a3f9de", "value": "SecuriteInfo.com.Variant.Jaik.143490.22464.32309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef623f42-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683013368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013368, "uuid": "b151a91f-5ab6-4eee-bc40-65a06c8f2e8c", "comment": "Malware payload", "value": "4962e756f66ef8d0998c5012a3483c1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013368, "uuid": "6fcfa5d3-d726-42f8-94d1-81d22db886fe", "comment": "Malware payload", "value": "a9916fb09ae9344a0829c19705a3867926e982a8c17bede39fd06ccf994e403f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013368, "uuid": "86c8fdf4-defd-4948-bbb2-5f2a4ae26e77", "comment": "Malware payload", "value": "3114a2a6351873c63909f26d1f0aeddcd58dc9fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013368, "uuid": "1f67189b-306a-47f6-b774-7d04b3a60d34", "comment": "Malware payload", "value": "18662faff0b85aea051fd7cb0f772932d973751e2497a27618d78e24535af0aad105f7f88f37a8f64ebe6ed04f35c537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013368, "uuid": "abdef84a-9dd1-4a16-8b9d-a90298d00ca3", "value": "T12B8306427BE4A074E0F10670697D6230467BBD70AB75C6CFEB018A9B3978B82D934727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013368, "uuid": "39ca432e-efe7-456b-b301-c261eb3143a8", "value": "1536:9hvycU5ThtlMTG6TNbCN0pPDusEA6zJeRqHjRciU3:99ycU5ThtiTG6DpPSdJgqHVcik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013368, "uuid": "73d6b480-c546-45fe-95b3-c1a3ae361418", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013368, "uuid": "e5f2c731-16e0-40eb-af18-910c4b82057f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013368, "uuid": "ddf2bc70-b577-48c7-9d3d-b543042a6aad", "value": "a9916fb09ae9344a0829c19705a3867926e982a8c17bede39fd06ccf994e403f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ee4e30-e8db-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683026445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026445, "uuid": "5c35c20c-1c66-4d10-984b-66f24fb10f31", "comment": "Malware payload (Formbook)", "value": "fc01e8909cd645434c82378c485c6aa7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026445, "uuid": "8e790901-491f-4aec-90a0-0873569a85b9", "comment": "Malware payload (Formbook)", "value": "a9ef7d016c5480becf56f2ef7527d97e0890b42fbe32ee59e5ef6eee14613a66", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026445, "uuid": "5dbb1356-ed4e-4de2-8c4c-320194bd811b", "comment": "Malware payload (Formbook)", "value": "733ba26263f78e8336ddcaf56259eb866af4f72c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026445, "uuid": "ad1bdff2-e1be-4e79-8ba6-9b2618f6f9fc", "comment": "Malware payload (Formbook)", "value": "733fe0430ebef4be10a805a52b916ecf52a6a2bfa230c917b2a113e5d910072d4a0689f968849a89461cb47d70e203de", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026445, "uuid": "bb5bbee3-05af-40ec-b432-6e69193c446b", "value": "T187C238555B8C4C61E36AF8BB864DE00E09BCF22A31C215D4BD9CE6743B7D14E0B6B1B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026445, "uuid": "58a6e7f3-b819-4932-9577-9946bf5a9a18", "value": "768:gKgykvu3gEsgY+bBTK9yeE/0Jl8sZPI5FtlfnhqG43GwmDg+:/VYiBO9y9KZQ5FtFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683026445, "uuid": "6038c71f-5783-4a83-a154-82ddf14f37bd", "value": 26760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683026445, "uuid": "ae10b935-a4ce-483c-bdbc-a27ecdb98bd7", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026445, "uuid": "9366ec9c-67be-4dae-aa21-80a5a161e6a5", "value": "fc01e8909cd645434c82378c485c6aa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87fe74a0-e8ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683005893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005893, "uuid": "33f84af9-afcf-4e5c-b8f3-55b1c4c6c7e8", "comment": "Malware payload (Loki)", "value": "f1674ed05c13b5833fcdb769c1b1ed89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005893, "uuid": "9671c796-219f-42d6-ab64-86f5cc68ddac", "comment": "Malware payload (Loki)", "value": "ac39c17f070f097e41f41579a26b8e381963fbd103e56cbdfdf5d25205c2e167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005893, "uuid": "b728dfaa-aaf8-4855-90b4-240e1f887d4d", "comment": "Malware payload (Loki)", "value": "0b61936edf30ccd23f6b70ee6cd79cc61fc712c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005893, "uuid": "434067d2-94e7-4187-97ac-2fe35d8da4ae", "comment": "Malware payload (Loki)", "value": "40c258d750891dc72bf4523822ad84620b7018003a45fc6b973c3280920f83e95f96faeed016f3ed9f153f24664fdc59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005893, "uuid": "62cfff72-8e20-4363-b59e-791cfa7911b9", "value": "T178059D917174CE9FF87597F04C59F90023F2B86B90E0D11D2DA67ADAE8B2B02055AB4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005893, "uuid": "3e364e6b-c38d-4e91-8663-043e7a944522", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005893, "uuid": "07eae9dc-5068-4de1-b054-3dfa2c89b018", "value": "12288:WWK2iNvMAdT8DDItkBIe/5uUgIZd/DtfLh5:E1tVT8DDXWeA7IZd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683005893, "uuid": "69abd1bd-d25b-4bf1-941b-2f5e0172c7e6", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683005893, "uuid": "505e61cf-580f-4d3d-a706-7b0bff369a2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005893, "uuid": "b7a64806-e4ff-4149-97ab-58ebba125cf6", "value": "SalesContract_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7fb16f-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683013390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013390, "uuid": "c8ba8f81-0c94-4b10-9778-e97a38745eb1", "comment": "Malware payload (AgentTesla)", "value": "967011b836630a3b2674e6a494f25b3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013390, "uuid": "47ff9278-5f7a-48ad-902d-f523a52d1675", "comment": "Malware payload (AgentTesla)", "value": "adcf78e908fd198c552a3fa93c0e1622b9b8d7a3960d9e6049b21398a6e79810", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013390, "uuid": "eca9bb19-b865-42bf-9234-9754cbc9b880", "comment": "Malware payload (AgentTesla)", "value": "f3759af80501bd863c41b26ddca314066815d367", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013390, "uuid": "f3e98c41-fdc7-4c92-8203-7381a6b8be68", "comment": "Malware payload (AgentTesla)", "value": "bd728ad6dbf61bde451d278bea2bae7c3555935669ac21b9c74255abf26d62c8df1f97a26821373b8a48075630488069", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013390, "uuid": "43e8c956-8db8-4054-9d71-e32d45c86ec3", "value": "T151E4053C09BDE23B91B8D6A58FE5842BF700D4AB3115AEE6ACD747558316E1234C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013390, "uuid": "565d63bc-1196-4ce7-a9c2-79f7ab9df1c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013390, "uuid": "f6773e9e-fee4-4763-b388-397724560733", "value": "12288:kxDoU0ard0lNQyHbrdY7xB2oXgCrIlZU9fGKtU:k3IQy/iFB2od0M9fGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013390, "uuid": "0fa19d8b-e77c-4d8f-b652-c0504865ae67", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013390, "uuid": "1f4acf28-5f74-4cc6-b446-28ae5b7fb1e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013390, "uuid": "76e49425-4965-4b34-bfe8-5b3145046232", "value": "invoice 158 and 1579.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd28090-e93a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683067509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067509, "uuid": "c295d263-b9d0-4539-80e7-556faa85155d", "comment": "Malware payload", "value": "570e635e06f3dc985b153bf1ed92b17b", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067509, "uuid": "596de424-6fac-49fe-8740-d31986f9149a", "comment": "Malware payload", "value": "afcdaa5f4dbaf3b50b66e64e1a6d9859e73b87ebc62ede17c6f3706eaab41105", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067509, "uuid": "578246e2-bb89-41ef-9aff-625071ec2b13", "comment": "Malware payload", "value": "85ce0baa70cc105a1c200e2c6da2edb79fb533ed", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067509, "uuid": "7d118e82-8cce-40d6-97fb-f939ec680de6", "comment": "Malware payload", "value": "b7974ce1a83727cc81ff2872b8cf52ae57a14a0f8b5085192294af65d2f57d6a42a2c8aa69478e0322750a61d277ce29", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683067509, "uuid": "5015a1c2-2a8c-487d-9b8b-58793aa7884d", "value": "T16562C078AD5CD4EFFD438D04C81A3656839D311306C97970C6248B85F944DEAFAA2E5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683067509, "uuid": "1367d83b-12a3-4d50-bdd6-b161b4c24253", "value": "384:ifnK6MHK9EH8vDtWT23u1QYa+agF8sLvAcPSP/PK15u181:ifnKzK9mqDtWrQj+agasLvAuA/AuG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683067509, "uuid": "defbea4b-7dde-4eda-bb0d-384b7ba9a93a", "value": 14993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683067509, "uuid": "36d4a348-ec74-4270-8368-61430eabe45b", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683067509, "uuid": "172fdeb0-3aed-4edd-b985-110be4876e92", "value": "Aut.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b1948c-e8ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683042022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683042022, "uuid": "2c2a1fd9-aa63-4621-8838-8c5efc01cfdb", "comment": "Malware payload (RedLineStealer)", "value": "bbdcb03822862fc1cfc70ca025507a9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683042022, "uuid": "4039d21c-d688-4111-bb27-857abb960b62", "comment": "Malware payload (RedLineStealer)", "value": "b0515e24c427882aa4c0b0ffba2f5dd3443b849a0a72e92745d7ed44ca05f3d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683042022, "uuid": "b12e9576-9197-4b54-8792-7d7f64d97aac", "comment": "Malware payload (RedLineStealer)", "value": "9877c0087076f90fafddbf9a5d5ea2f81b64d295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683042022, "uuid": "40f00cf6-1dfb-47d2-8ddb-6faff7bfc248", "comment": "Malware payload (RedLineStealer)", "value": "099933c446472af3440d3910bfe40c840d8a49004302ec25d8b2b7503b48f64c50674016eeeb411ee2f1b6994baaccad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683042022, "uuid": "d9743ab1-81b9-4420-94a9-77fb9be30f67", "value": "T17694C803471FCADEDE5F75B9F9C883963E40D0A8BB2F934AA7E05D1045AE158B690B1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683042022, "uuid": "ceeccff5-ed86-4050-b1b8-ffc2a826d0c6", "value": "d03a32a9d6119786dea4a25b734d4a33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683042022, "uuid": "98369bca-3ba9-4c0e-bce2-2759184063ea", "value": "3072:Zv8hEjNp51JI1h3jDn7fltbnoHqwKiy+5TzLR+p5gjzWmpkSSbPnUQ5/WoG9e1Ph:Z151JIX/n5Kl5nLZFSxlW79e1Hs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683042022, "uuid": "b7635797-06dd-4c1c-b2b1-a92849c93b52", "value": 436560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683042022, "uuid": "77032c4f-a361-47fe-80f4-94bf907b2653", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683042022, "uuid": "313915b6-245a-4584-84f3-c7fa782d8cf3", "value": "bbdcb03822862fc1cfc70ca025507a9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0692bc9a-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683013407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013407, "uuid": "c09c216e-37dd-4775-90a5-9e5606aa2a6a", "comment": "Malware payload (AgentTesla)", "value": "475166f8b8419d60b0054d7b7332d75b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013407, "uuid": "5b6583ee-9967-40b2-9892-1646c045fa3c", "comment": "Malware payload (AgentTesla)", "value": "b08291dfdb766139150a65ebf9e895dea34436f76123a52116e0d03944e1a4e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013407, "uuid": "13be5ae9-ede1-4eaf-ab2c-3d89f17d5c47", "comment": "Malware payload (AgentTesla)", "value": "a01993bc25df682700e3ca535ddc13362b509257", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013407, "uuid": "ccc9bf3a-5f81-4359-b7ba-638b08085a53", "comment": "Malware payload (AgentTesla)", "value": "057aec2ff305db1a0ba184acd7b7f1d15e628fc0d3ac88b4d861415dfdf7263f11a327a35737f6026f6de7e8c66a083a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013407, "uuid": "761b48a2-efe5-402b-8108-53da1c20c131", "value": "T192E49D575065CD0FFE6ADBB094B4FF45A6F1F07324E190242BB921C9CAA9F021E8D52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013407, "uuid": "9570ffd9-0617-442d-9293-f6b97627330b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013407, "uuid": "da18edc6-b612-4401-80ce-8f4697c88508", "value": "12288:+WN0WPAIJU1eadlq3Jks5oWJTlUpU5VbHxz4egQVt:+EIIJU1RSZksOGRYsxHxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013407, "uuid": "d9237b4c-0a5f-438f-9c89-46192b5e1acd", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013407, "uuid": "c224ff36-0ace-4176-9f29-d312f18b520c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013407, "uuid": "ebbc12a3-db49-48e6-a46a-f3ead9cf29bc", "value": "Purchase Order 5501097310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a711a1-e8e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683028973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028973, "uuid": "1bf384aa-53dd-45fa-ba51-47692e40d687", "comment": "Malware payload (Amadey)", "value": "70e5ccf5f97fb161dd40dcabd7706170", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028973, "uuid": "e3e20d95-d84b-4611-af98-2a30d6aaf852", "comment": "Malware payload (Amadey)", "value": "b2915131a88c812aa5996772388c8b91df69d975303f400aa314e606d1b69d45", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028973, "uuid": "c30492cb-ebd7-4a81-99d7-e8aad2efb510", "comment": "Malware payload (Amadey)", "value": "97e3398a2929313c36bd5f2a67936947adebbcdf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028973, "uuid": "8ee424e7-48d7-4b6c-b6b3-3ef239f597df", "comment": "Malware payload (Amadey)", "value": "51598996e249fa5a1b39024a606fd3094006b356c2f4fc6364876f14474378ce6f847b3f9aefa954e43e343d45b00a94", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028973, "uuid": "e9c1fab3-e76d-4b88-90a0-3c7da28bc5c8", "value": "T14E6523437FDA9437DDB2333166FA16830F33BC518619AAC76386A50610636D0593BBBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028973, "uuid": "ca1f4cbb-295d-4c8b-befc-92817645140e", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028973, "uuid": "11b2ab53-080f-47a8-b570-dfccbf5800a1", "value": "24576:2ymsURDNwMevJZtyhG2fAkcjsqC8neA9F/j+O4A0J8oRH67oNmepT/ZRNp:FtURDNw7vvtGfmreASNb9BYcRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683028973, "uuid": "ba6ed48a-b99a-4c9b-ab14-f1371f61270a", "value": 1526272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683028973, "uuid": "85af999a-61bb-4ac3-a9f3-d08fee85c0ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028973, "uuid": "fe33bdc1-ee87-4b46-b43b-ece0fa2d35ad", "value": "70e5ccf5f97fb161dd40dcabd7706170.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a85bc6-e8ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683006379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006379, "uuid": "f939a61d-fcd1-47b9-970e-31ecf7097324", "comment": "Malware payload", "value": "2c22fe7e29b78bd30abda6f9022c421d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006379, "uuid": "49eabae1-2b20-4cf8-8a6c-09cb6bbca3f8", "comment": "Malware payload", "value": "b29a4e1af72c4ff3271012a3ec49526171f60f2934bf173c92d563099f0da3aa", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006379, "uuid": "0b5bc3ea-152c-40d1-a1f3-8512f36815bf", "comment": "Malware payload", "value": "af5dac583e172fbc63f46b3d4155f5e152208d18", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006379, "uuid": "c57a60a7-0c3f-41a2-9aa5-fea4e93998e4", "comment": "Malware payload", "value": "d5761741585ddf5d3d84333e0e329cf512a36dc66effbc0a6ca54d1ec7715ee5e6fa59c45d10c881c29fd6f4b6f0d7ea", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006379, "uuid": "5152e7f3-1260-4712-86e9-7a6f4e044ec0", "value": "T120E0201BA13C3555C37854E0D89C6684B429956A6F467EC133C51525CA0526C41E3C1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006379, "uuid": "e0648daa-8166-47a0-b81b-8c16a3001f53", "value": "6:Q0eoLftLYVJ2/CxVDGGIOyYn7G8GSLh8uWfBNucoyMw4rbSQ98GLgNPSxktjLWZu:QwZYVJ22Vyk7G8pGuYBNLGnSQ98Q6PS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683006379, "uuid": "f2ad4f7c-d0b1-4899-9846-fca50549e7ad", "value": 340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683006379, "uuid": "0fcd76e3-74ca-4ed6-9d95-cfce67ba2342", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006379, "uuid": "fab366d7-b3cf-4932-aaa1-fbdbc2da9dea", "value": "L001-100049680.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27055c9-e91d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683054954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054954, "uuid": "1e91617a-e14a-4de6-9a92-ae30f80fafa3", "comment": "Malware payload (AsyncRAT)", "value": "14840aee4d09f3a7eac95d4bcbdb8ccc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054954, "uuid": "386f2f10-e450-4707-8546-75ba98501912", "comment": "Malware payload (AsyncRAT)", "value": "b2cdc3a3e85a67ca00f8c7898c95132b8e1061576f83249e60a292c3ffb93f3f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054954, "uuid": "bfd9b145-d3f1-435f-9779-9fa13baae765", "comment": "Malware payload (AsyncRAT)", "value": "af8b49054caf2f9972868b10259060fe5ca43a50", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054954, "uuid": "90729496-8361-4bf0-8e5f-1e1e529d1dc4", "comment": "Malware payload (AsyncRAT)", "value": "d6be96207f8654b9c1e55ee1df5577fa5da8159d3b48874ce4b61bb83510e4886bae34994d9348af0b18361cbe62978c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054954, "uuid": "7cc8c024-20f4-402b-934f-c99a76e3be9a", "value": "T1F99423137CE1579A4C7662F477F3D1B941F138D2A6E33E5AE283E20A53C994EC62D890", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054954, "uuid": "9c92d016-38ec-46ee-8eeb-558663e9f617", "value": "12288:+qqIBo3nBTRxgeVY/Ls//iclMoIcjzWmj:nqIQnTieuFH6z7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683054954, "uuid": "ccf34fc3-61db-4e73-ba7e-0553ce2e4df0", "value": 428855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683054954, "uuid": "c01b20a1-69ad-42fc-a818-883344679937", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054954, "uuid": "0df9fa54-61c4-4544-8d4d-834f038a9ba5", "value": "RFQ#0003725812.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08369af-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683013370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013370, "uuid": "1f1a580e-e369-4fc9-a263-501636c3e333", "comment": "Malware payload", "value": "6941d0491229eccc0acbac31c7c6acdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013370, "uuid": "36e31208-c3e4-4415-9fec-51fed261b742", "comment": "Malware payload", "value": "b48d653885df427fc7d611782a01b60ac130d5299b4bb78d28bb296a9f4f71cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013370, "uuid": "f2983ece-a5dd-4c29-9c8b-baa877f2499a", "comment": "Malware payload", "value": "f2e1fb0de03ee0c2a67f3fc84b07135a06a80b60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013370, "uuid": "db124599-2aca-4cdf-afd3-23f7673f0df6", "comment": "Malware payload", "value": "9121abbfad4a0cc158fcf7e65f9e7b8f49b265c5c1b49726a8bebcb5bc3594dcbe79737c9c68ff546c19cf5cf3b31ece", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013370, "uuid": "3662779c-1a0f-4c62-b99e-a3ec5043c547", "value": "T15083070277D0A0A2E4F10B70A97D6230467ABD711B35C1DFE7218AD9BA78BD2D934727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013370, "uuid": "09c1aa05-cbf4-40ea-b282-7a118ccdbbcb", "value": "1536:NFvyUU3TPY6SKWJzAKDbcpJU4DoeqHARciU3:NpyUU3TPY6SKAvd4D5qH8cik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013370, "uuid": "8c6974d0-03ce-4359-97f0-ba437803777d", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013370, "uuid": "81766075-62a5-42c0-8862-10a74d3bf9a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013370, "uuid": "8b1f853c-e370-4560-a57e-80cd18001b12", "value": "b48d653885df427fc7d611782a01b60ac130d5299b4bb78d28bb296a9f4f71cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e73956-e8e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683032597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032597, "uuid": "062e015a-175f-4078-8895-d866b9f08832", "comment": "Malware payload (AgentTesla)", "value": "ffb5ff978b543216e4b1317f7d9f97ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032597, "uuid": "e3c45af2-2650-485a-88e3-f2cc039269b0", "comment": "Malware payload (AgentTesla)", "value": "b58e0980d53aa7891015a450f575a33f08a67c9b5f36674c2684d15ea78194aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032597, "uuid": "7ab51d0a-a082-4245-882b-925d9330f367", "comment": "Malware payload (AgentTesla)", "value": "a220878a48495fd5b4addcbd6553ca782a403277", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032597, "uuid": "d23215b3-351f-41d1-b45e-eea234157963", "comment": "Malware payload (AgentTesla)", "value": "b5178196b65463c202f96a8b2b048b1e6f58c630ce743fa0b1920a84ae2118dec32bb5154576a6b8304d66a691c2547b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032597, "uuid": "3afa3b44-34b1-4d5a-8f5a-d4baa427be95", "value": "T18BC4D01A20A9CF0BFD398BF15474FF4453B0B47355E1E1282EBA61CADA66F014E9C85B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032597, "uuid": "96bc20cf-884d-43e7-893a-c4197e868ea3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032597, "uuid": "2ab15296-5749-4cfd-be85-4946028560f2", "value": "12288:gVdoVVzEig/V8YBCTGReneNbQjJ+mgeoQscaCqNBv:ooVdO/VaG0ObQt+miQs3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683032597, "uuid": "e6c3cd9d-73d6-40e3-97cc-d4b5d753ce8e", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683032597, "uuid": "2b05a091-015c-477a-a0d2-24fa1ebed79f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032597, "uuid": "e0be4c32-1160-44d8-aabb-0f9f45ed7018", "value": "URGENT REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10591f3e-e8e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683029744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029744, "uuid": "614bbd71-9495-42e0-a101-0d221f4bb3e0", "comment": "Malware payload (Formbook)", "value": "48353808819cf7a6d4557da32df96924", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029744, "uuid": "b861be07-8113-43e3-8838-d9c11d8b267f", "comment": "Malware payload (Formbook)", "value": "b5e3575e253ae6811203e02d42fda718a5655baec9545f839ceb4473e5de33bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029744, "uuid": "ce19c38f-fd8e-464b-ba3c-7cb275d7d498", "comment": "Malware payload (Formbook)", "value": "188dea1e06e75391cc42fafe84e16396cafae2c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029744, "uuid": "9bba7f42-c0f2-4045-956f-ba74018f91c3", "comment": "Malware payload (Formbook)", "value": "c6e9c5248d1cbfbc9bbaa7564956b81c8c9775154a4b2726282c6af06e0096c28b80d4b86af9f4679f916b90e8ec1b57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029744, "uuid": "48aedc22-5844-4e52-a118-3f6381859eca", "value": "T186F4CF42A419C899FC18D730D435FEF052A6BCB7E4F0552B2AFA3D5BFABB601090855B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029744, "uuid": "a449c16b-9816-4499-a294-3b5e16666128", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029744, "uuid": "c853fb94-bb29-4cda-9ea5-0158178e41c4", "value": "12288:jBdwsj8LCTdPo7wQbVhc6DTmp2OKlsThMsL9fkFnS:fdj8Lai7/vRDTmYHIMzNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683029744, "uuid": "a840f5a0-55c0-4b73-8939-141fc33b113c", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683029744, "uuid": "31797b34-6778-48e9-a247-fbd23ee32c6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029744, "uuid": "671c098e-f199-4b0f-a8d3-17cc972536b6", "value": "SSCTEC9201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076f2bdf-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683013408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013408, "uuid": "7cfa23aa-2a4c-4e1a-a5b0-65422c0ebda7", "comment": "Malware payload (AgentTesla)", "value": "a153d1df04f2845525b6c95433fb9265", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013408, "uuid": "25abefea-48b5-4608-98b8-77cf984dad77", "comment": "Malware payload (AgentTesla)", "value": "b81b5d7a927299cc54748988d70523c615e82e21482652510a1a95db89b3521d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013408, "uuid": "cd7089c8-be79-451f-8b42-56913b9ed0b9", "comment": "Malware payload (AgentTesla)", "value": "beae49d1d124c2bc2a335c1952c29a44be2124a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013408, "uuid": "7670c980-a5f5-4473-81f5-ff641e76b945", "comment": "Malware payload (AgentTesla)", "value": "0c696f37d24a7f8210257e6db4f5e9f6afa03febb6f83b17e64bc45b1563324640f73d29eadd19eb126d7e547ff6b00e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013408, "uuid": "280e833a-0162-4688-8b0b-f7d7559d74d7", "value": "T154E48C56A024C81FFE16EB70C1B5FFA4A5F0FDB394E5102227793988EAB9F411E8D119", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013408, "uuid": "fd113ed3-86e2-441a-b9bc-529701d1bb89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013408, "uuid": "8ef819f0-284d-44f3-b180-29d2affb7f3d", "value": "12288:qOnKqdxnueUEl/jvxsXxs2egQVtpwtv3E6FxDz6v3z9BN1/tAD63EwHTxxlxXIrX:fd3UEltshsAv3HxDzKj9xGD63fTxx4Z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013408, "uuid": "f2d532ea-5e25-424d-87f2-7149b30370ff", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013408, "uuid": "d9311714-b428-417f-a85a-c921097a7768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013408, "uuid": "3c06094e-2779-481d-972f-0f1708b2d3af", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321b4980-e8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683019493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019493, "uuid": "410ec801-a035-4eef-b346-be49529b785c", "comment": "Malware payload (AgentTesla)", "value": "3f2d4aa93e5fdb922cf9eb23ba939343", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019493, "uuid": "83efce03-a72d-4fcc-99b6-49937322c64d", "comment": "Malware payload (AgentTesla)", "value": "b8f2e3ecf35e329a28c78ee2dac2f766e41d1768cd204e7bf4588535b92ad981", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019493, "uuid": "40a2a1f8-53bc-4ef3-b7ba-6c721a6355ea", "comment": "Malware payload (AgentTesla)", "value": "81c87fe1b73061b886acc8f1eb335390e8f3b476", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019493, "uuid": "cd7596fb-d485-42d7-ae35-9bb1e1fe6483", "comment": "Malware payload (AgentTesla)", "value": "be78d65278a9ce19377957befdd1c98e0edc42407712cb2016cbc41e09784e036efd726510aec425b0f1f2f165a00ffe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019493, "uuid": "0fa747da-3ff3-460a-a773-e0c55b297936", "value": "T1BDD48C535064CD4FFE66DB70D1B4FF55A6F2F07324E190242BB92189CAB9F012E8D62A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019493, "uuid": "e4ab11ec-8c7b-4be3-8d4b-fedc118f7998", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019493, "uuid": "939be764-c3eb-4731-bad6-f14f0b609bcf", "value": "12288:LAJDmegQVtR8cLIPgQMj3VDXEmxaXuvuDn77y3j26:LuDX8WIoTlgYYvK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019493, "uuid": "f958f995-124b-4586-a680-a944eb9ffefb", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019493, "uuid": "432f712b-9974-48e9-a3ac-23f1094679c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019493, "uuid": "912d92f8-ccc3-47ba-9d80-68cdf72f765a", "value": "HALKBANK-DEKONT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6fe496-e8db-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683026438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026438, "uuid": "89eb6432-f562-4176-a38a-e164c63e1572", "comment": "Malware payload (AgentTesla)", "value": "dfe1daa92531bdf7c7f6665de38bcbd6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026438, "uuid": "dcbb4be0-cef5-4f9c-acb4-03a7569505bf", "comment": "Malware payload (AgentTesla)", "value": "ba09d0f8b0d54ea16810d59918556d37ffa61ef3eafd234a54444a59ebf37ba8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026438, "uuid": "16183385-83d3-4e7e-9aed-47627327d69d", "comment": "Malware payload (AgentTesla)", "value": "9b104a913f2c0d01e3f6650491bd9dcd9cd928a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026438, "uuid": "33ede5ea-5a79-4822-b4b0-703a7642369c", "comment": "Malware payload (AgentTesla)", "value": "864be2a41bd1f072a3ae4887df38d3bc807a2b2b3155149bf79aeda07746ae5528cd0a907e049be301f19be98703ded4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026438, "uuid": "9cc236e0-b959-480b-81d4-228b1aca460a", "value": "T1FEC204665B8C4C61F25AE8B7864EE00E49FCF23234C255C4BD9DE2747B2D14E4B6B1B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026438, "uuid": "3a5d9e9d-4496-4cdc-bd0f-f81d93503770", "value": "768:QyU7o/zbBomMlGOIJ84Jb9ze9+7YhCuXPUXupLERT0H:TUuvBoDii4JbJe9+7Yg9ehEJ0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683026438, "uuid": "2975952b-3747-4c83-8482-c15030867608", "value": 25825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683026438, "uuid": "367b3ad0-0ab7-4617-983d-8a80f4505d47", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026438, "uuid": "15d14bcb-f15c-4c0a-935b-9896a079775b", "value": "dfe1daa92531bdf7c7f6665de38bcbd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2505a9f7-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683013029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013029, "uuid": "7845770d-a0d2-47e2-ab30-92a0b6851fbd", "comment": "Malware payload (AgentTesla)", "value": "130c255034916bd7aeb9cfc5856014f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013029, "uuid": "f174e5ea-8853-4a5d-b147-1b94bad80247", "comment": "Malware payload (AgentTesla)", "value": "baa2c58f58547f9490c5f8cfd5b25bd083b2709ebb999833aa26e1cbcb68c280", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013029, "uuid": "d3b84488-5506-4443-a887-4cf69ce362eb", "comment": "Malware payload (AgentTesla)", "value": "462fe1caa69193587be52f8b6911ca1bdada7b37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013029, "uuid": "d7b50398-fd0a-4e31-b776-2457380e1d9a", "comment": "Malware payload (AgentTesla)", "value": "46146f41ef97cc06eb639fc4a3d062da1018346aa276bc4e81322a61bc4aec92fdfe52527e3f66861ceb7ae0e4cfd013", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013029, "uuid": "be97453e-746b-4747-86fa-1cfb6445c439", "value": "T128B42325EA8CCD2769E6CB28FB9F898D0875B7C1F5520D623EE517C472AC1DBCE08121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013029, "uuid": "bcbaf16b-ae81-45d5-a519-e700310f66d7", "value": "12288:DVsNGRMimmK/54d/iDjX44bctxehjAqZocIia8qnD:B+GSi8aqDjIwcCRpocI38qnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013029, "uuid": "1d471a13-005b-4ee7-8175-d0406f4ed93e", "value": 517861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013029, "uuid": "9ad2e228-1693-43a5-87e2-0fbd2b5b2675", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013029, "uuid": "2857ed15-4c61-4ff3-a35d-8bd99918c9c1", "value": "MAY ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109b7c7f-e8cf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683021155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021155, "uuid": "f6cb0f6f-f0b3-470c-b775-3ed45d093fed", "comment": "Malware payload (Vidar)", "value": "05cb03203a9fd9f3ac04b9b3484cb520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021155, "uuid": "2de818f9-0382-4e46-b7d2-55f9bba4aab3", "comment": "Malware payload (Vidar)", "value": "babe6467feb2750f32a113b970674022ff1cf3248b724f69c837df0b55a2337d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021155, "uuid": "8222e6a6-85c8-4cb9-b55e-0e731cbc74a2", "comment": "Malware payload (Vidar)", "value": "2ee4cca24ed369c61d9c43857bc316dd520ff295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021155, "uuid": "932de203-5140-4a40-b2aa-efc4df4e3da1", "comment": "Malware payload (Vidar)", "value": "1761f70cbef262a1109075e1a370a404b4a45a56a019c5b5000e54b44146b463807fad2dea5a9ac69fbe4962b4b4e950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021155, "uuid": "ef9b3f80-5541-4d8a-98c6-cf102ecc9d63", "value": "T1BBA4BE1372F06872E6324A718E6ACBFC665EF8624F65BBDB1354E92F09B11E2C171701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021155, "uuid": "f78b1ca2-8088-466a-9804-a89fe6acd32f", "value": "8e1291b1baddb8fcca0899ad3cc587e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021155, "uuid": "4d5e48b4-da3c-4bd0-924b-8557360b990f", "value": "12288:FxD2Re/IFLzkMDFoWG1oKAIrLEITbDxLR:FNURMeFoV1oefTfxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683021155, "uuid": "ed489e7e-e759-431a-bf16-2b236dc9a0b0", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683021155, "uuid": "8b6df6ac-169a-4b56-9d0e-36453dfc9e2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021155, "uuid": "36027734-78c1-4e85-a337-f61b403a6400", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d48dc2e-e8d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683022626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022626, "uuid": "dba6189d-69d3-4408-8c13-55b4b5500162", "comment": "Malware payload (AgentTesla)", "value": "45130e2ceb12ebb06483e2ede19b5b03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022626, "uuid": "53be7fec-e5e5-4cb3-a5b1-f1de22de2437", "comment": "Malware payload (AgentTesla)", "value": "bb44c4122a54b3dc5c0b0c558747ace2b2048bb089be62dfd3e2dcf250cbd580", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022626, "uuid": "afa03343-d755-4de6-98dc-4b8cb5b3f482", "comment": "Malware payload (AgentTesla)", "value": "17d21e33e36b9287bcf97d8dac0e171d6de79347", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022626, "uuid": "6e127972-6927-45b5-b85b-822a36638200", "comment": "Malware payload (AgentTesla)", "value": "eaeff0b10be7ac3d83e78476a30f8a8f66a5bc13e487b5cf7465d9917e09c7a36502cb197b22e8a7c8d96d0cbe37dc94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022626, "uuid": "09140b6f-3f08-424b-ad4d-c6d1081150eb", "value": "T178542344E5C77FBA4A5A101E884EA2C862976D95E30FF6E34307120D174AF5EDAFE18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022626, "uuid": "204d6210-ed56-4295-9ce9-827d6190b813", "value": "6144:hccfNuiVyytp9Gy/yQRcYHfJMefw78hj1qqoiS:h99tl/yQuqMAw7Vxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683022626, "uuid": "f4d29d77-0dc2-47f8-894b-f4c7fd5b9f99", "value": 291957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683022626, "uuid": "dbd5252d-d35d-4efc-8973-3739ff375e95", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022626, "uuid": "0defbe80-34b2-4da5-9b19-a26bcfc8c3fe", "value": "008s06523610054680b601137503006202_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d688d48-e8b8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683011298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011298, "uuid": "bd009364-1d20-4af1-99da-5e89c01e72cf", "comment": "Malware payload (AgentTesla)", "value": "4c92dfdb8014a72e00b246324b7eab7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011298, "uuid": "f87ce0a3-e8ce-4185-afbe-2e05343b99d7", "comment": "Malware payload (AgentTesla)", "value": "bc2c9a0032b4118b2d862043c73ebbc2627c31f8fb8afb7bd28b8a27be225800", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011298, "uuid": "feb07a63-06df-4100-a50e-d9ca07db784c", "comment": "Malware payload (AgentTesla)", "value": "545b35416b76f8c2141238a34807d50fb4135037", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011298, "uuid": "b9ad043d-fcc2-4239-ab79-7d5ac2897ea9", "comment": "Malware payload (AgentTesla)", "value": "e104541efcd83dfe6f40340f5fe646aac8b3f36bb60a2c0a321102f00f7efb9d545ec6b9a43dcb212dea9714b5624afe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011298, "uuid": "913b6474-ae22-4313-9d13-f9356a25ee06", "value": "T160C4DF1A51A8CF5BF97A87F19074FB8463F0B0B360E0E2281F7A60C6D9A6F150E4C55B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011298, "uuid": "765cddb5-6d02-4a5b-9b0f-3e4f72cad27a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011298, "uuid": "d96c5716-f223-4a9f-b510-c0d16c91340e", "value": "12288:UuRSSGReozVI8t0gPOkqdYGkUWeDP1n5VNeVSwAgfSL5:bozV1t0TkRXenOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683011298, "uuid": "f1750d0b-1a63-4b4d-9bfc-c5644bf9ebc9", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683011298, "uuid": "c675decf-4e22-4c8d-b6ea-df368e4c3a73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011298, "uuid": "42eb9f90-35c8-40c4-9b3a-234d37272e78", "value": "Halkbank_Ekstre_20230501_085144_348375,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f55ca4-e8e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683031143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683031143, "uuid": "67225344-f1c8-428e-954b-7d05b92daf08", "comment": "Malware payload (GuLoader)", "value": "b0d667aad13369585fb9399464927bde", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683031143, "uuid": "5adeaefc-3ddb-4a05-a68d-5dac4af69fc2", "comment": "Malware payload (GuLoader)", "value": "bc31dc9da857aefa9d8865b8045b32e4af5a76f138c89f533c40ce1c662fd89d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683031143, "uuid": "2b0363be-f92f-4cea-8bcb-9a4a81cef32e", "comment": "Malware payload (GuLoader)", "value": "c34036ae5e27f405d2ed874a65e2dc86852b65f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683031143, "uuid": "78706dc6-7dc3-47a8-909c-6ca0a8a934ce", "comment": "Malware payload (GuLoader)", "value": "df6685361562356d0aa0d2b33525b34b1f27f67ea583f76289f56ef951dc11c180d575dfd8932c04d7cb3919e2469b67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683031143, "uuid": "5b66b53a-4996-4f5a-98a2-9872ec1107c8", "value": "T1D254029A25E14413D7910AB8DDF3D677B7B5AE90103E425B37E02FBA3E287728F15188", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683031143, "uuid": "9cc52d2e-24b9-459d-a898-21996f8fba3f", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683031143, "uuid": "992eb33e-f370-482b-a951-9506e8956bd2", "value": "6144:V1onEmMMMMMjMMMMMMMVW2S3LmcgAo0RJc54uoElKilHxN7/8RJ0tx2B:HodMMMMMjMMMMMMMV/S3LTgBMc54ZElK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683031143, "uuid": "b358debe-fd4b-406c-bd4f-7af0faeadd06", "value": 305640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683031143, "uuid": "69b4d9b6-c1a7-4ff6-8f28-b2f46f777a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683031143, "uuid": "cda418b5-5d4b-4f73-9921-3369dc87ea22", "value": "MT103_0311021014 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be66b13-e8e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683028636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028636, "uuid": "bb21ecdb-01bf-4cc1-bc0f-133296304496", "comment": "Malware payload (Vidar)", "value": "d6791f5166582e12c4e6d535de8fa13a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028636, "uuid": "2d824895-552c-4027-a4dc-83aec7918f0e", "comment": "Malware payload (Vidar)", "value": "bc929e2f5df5f8c123524a3d423a7ac3463e952e92a0fb24e293d415ffab7f32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028636, "uuid": "7e94d3ea-7246-4e8a-8a48-2ce61980d12d", "comment": "Malware payload (Vidar)", "value": "defab712af598398776fb9af0853a6f079b36aab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028636, "uuid": "cb4c87fc-681b-41d4-883d-7df96aa878a4", "comment": "Malware payload (Vidar)", "value": "89c1f82d6dffa520e52236e4cd42a9a338dcb0bf051625a511d922ca65f9676b4338c3e8e0e2ee2852823fd2b8e1e646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028636, "uuid": "075a1008-a2a8-4845-af50-cb34d245324b", "value": "T174A4BF1372F43871E63247328E6A86F4665EF8A28F69BBDB1314E92F09B11F1C572741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028636, "uuid": "ef544385-6e07-4052-9bc4-c3395ce71f51", "value": "8e1291b1baddb8fcca0899ad3cc587e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028636, "uuid": "6b2e874d-d2fa-4849-ade8-503c77b6a583", "value": "6144:51t7+nxFWWm43jqB/obwcJuJ7pcj1GDKJHlEf7vTLPJfq:5b7qxFWWmsjqBgbwccJKHJmTvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683028636, "uuid": "51c26433-5a3d-4fb6-ac9c-1ba675a1847f", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683028636, "uuid": "3015bde0-a89d-46e4-8556-ffb46ce93cb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028636, "uuid": "18a486b3-3f7d-45e4-805c-096d2a3cd8cf", "value": "d6791f5166582e12c4e6d535de8fa13a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7f1a40-e8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019482, "uuid": "69d193bc-3a38-4994-a90c-cee250412ec0", "comment": "Malware payload (SnakeKeylogger)", "value": "f3a8c6561b6368de0332b350d6731bdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019482, "uuid": "e232da2d-8771-47ac-a4b6-002888519239", "comment": "Malware payload (SnakeKeylogger)", "value": "bcf6b40b84433a52a69d309590fdfaa30d13464b0ba83b9380a808ebf1a56716", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019482, "uuid": "46f1634d-69ba-4d30-8210-6046e36a097b", "comment": "Malware payload (SnakeKeylogger)", "value": "9f45e77777c110821ebee9b249cc60d9d516fc41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019482, "uuid": "10d586ac-9f90-41bf-a666-7348d6e900f4", "comment": "Malware payload (SnakeKeylogger)", "value": "20c151edbb2c3daa4f86f4799b188486006fdd3393412e96a04cc4a0ae99bc94fc3f847ed89793b7c59f3ec2412fff3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019482, "uuid": "8b484d0f-6d78-4b5e-b8da-42eca5db1d92", "value": "T1D8A4F04937EB0B16EABA1FFD297660140332BB069423D74D4ED534DF1E62F46CA82A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019482, "uuid": "bf074e1a-1362-41d7-b572-c7fd56e34bd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019482, "uuid": "8962e890-aafb-4133-9a74-7afe3fcac43d", "value": "6144:tt22HjHHFVWBHywBdeprtWPaxmhkdMP3DCHpOiau5y+J6QsL+G/5KDylVOD8P5pr:rZo/arWBv6pOw5G5KmlsDi5pQBzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019482, "uuid": "336926f6-ac9a-439c-b513-efca4dea83f0", "value": 460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019482, "uuid": "e07b1b1b-9fd2-4580-a46e-69f2f3a9abcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019482, "uuid": "a431fc00-2659-4018-8b34-744133b9bf9a", "value": "543235789009SK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe8eba2-e8ba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683012322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683012322, "uuid": "a8ab0685-5a5e-4e32-9982-97a8073cded5", "comment": "Malware payload (Loki)", "value": "696e7058279a9ca6260bc260b68b3818", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683012322, "uuid": "036b0c7d-4017-4818-b97b-e9ae691740f1", "comment": "Malware payload (Loki)", "value": "bdca02b5a08aacb4702cfabaaca20129ff3c7ff3b332ebaeb41c1b802bb8e19b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683012322, "uuid": "690a6ed3-90f1-4dac-8021-d8d436dc73e5", "comment": "Malware payload (Loki)", "value": "33ee551b4491161270ec093f72938759329f4d99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683012322, "uuid": "cebf1fe9-b53b-4996-9cc4-06bf96256e76", "comment": "Malware payload (Loki)", "value": "db4c667b1b33f564c2324bbf8a591707c6c46b4593d792b4e6a35ecd591bc131f46c3260b3bb4544f6ea50eb6256270a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683012322, "uuid": "6c7bf985-f97f-4115-9162-c9d5c4d904dd", "value": "T174B4CF0A6165CF5BFD7A8BF09474FF8063F0B07765E0D1242FB960CADAA6F111A4861B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683012322, "uuid": "e3bbd040-c4b1-4dda-a7d3-1b2f033fc440", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683012322, "uuid": "8c7e297c-a9f1-453d-a937-1e97ddfed0dc", "value": "12288:/2Axy8BVVrDJO0+zyEZBexUeaI9Dp9k4Y0tOvaRE:JBABuEZBAaI9rHNYSRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683012322, "uuid": "0c745e2c-102f-4484-9e78-1626b7224f3a", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683012322, "uuid": "5f6b5d72-cf01-47e4-9e2b-0503c89b8fca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683012322, "uuid": "dce86ec8-bd04-4775-a37c-778e26348b6d", "value": "Q467835667.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1212390f-e8e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683028888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028888, "uuid": "10b95793-c69c-4b2f-a2c0-6851620c8dcd", "comment": "Malware payload (AgentTesla)", "value": "5a0881470abaa340428600b8ec2e0729", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028888, "uuid": "e7f37eff-08e3-4a73-95ac-b835f1eaef4c", "comment": "Malware payload (AgentTesla)", "value": "bdcbe2ba28e1b1d3830fdd1ec17ff651e864892aacb288dcc21315e7ccba4b0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028888, "uuid": "2161196c-91bf-4f2e-89fc-0bb4f6f4c0e0", "comment": "Malware payload (AgentTesla)", "value": "fb5b86e8e14e832d16fcc8023277a2f2159126bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028888, "uuid": "47a4fb3e-ee39-424f-a6a5-c5c585489aa0", "comment": "Malware payload (AgentTesla)", "value": "e229be1c789161580b9955deb8dac3df57bbe4588133a51f131a1b592bc78a4ed2146b05eb50679d7ce884553449894f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028888, "uuid": "7be6423e-83f3-48e9-9ff4-6ae53c9349c6", "value": "T14BD49D535064CD4FFE6ADB70D5B4FF85A6F1F07364D190242BB82189CBAAF011E8D62A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028888, "uuid": "7ba3abd5-c068-4f94-8315-5f1c4a5b0f31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028888, "uuid": "f4c3072d-d215-4641-be28-46d88731d1bf", "value": "12288:eAMcegQVte7dpd+4wW/CzimoB2bCzdOydPJbchjTY6o:eJwdpiW/CzcB2Orh1cFTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683028888, "uuid": "ff723f1d-b92b-4d0f-b5ed-7afa57303f83", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683028888, "uuid": "8e381ad5-dd34-4027-b194-20ab5d023b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028888, "uuid": "94832c22-076b-4c8f-8279-cf8e030b1a4f", "value": "5a0881470abaa340428600b8ec2e0729.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2e136b-e8dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683026835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026835, "uuid": "89d6e986-2e8e-4335-9880-222f078ce0c7", "comment": "Malware payload (Vidar)", "value": "a07e019a3953a84b36ece6f7212422e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026835, "uuid": "39f382e6-24a2-41db-80c1-89417a4cf229", "comment": "Malware payload (Vidar)", "value": "bedc54ee030d4c05b98bab537832eacdb08b1ca9a675007f237a2c8749db9fe9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026835, "uuid": "c36abe4a-fcdc-4a26-a0a9-126ebcab262e", "comment": "Malware payload (Vidar)", "value": "f6e452ace55345f62fc111ec10f4884591f5b9f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026835, "uuid": "3a5a9625-6fa9-4ea0-9dbe-a86b11d02c93", "comment": "Malware payload (Vidar)", "value": "1539d61caa684226d9d0459fd46d87ae84456aeb2d0cb49651a6363b5ea89bb83a674388f99915e31693bded75ed6b3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026835, "uuid": "3193af61-ecc1-4d14-92b9-9f2982629010", "value": "T135947B72B30609D2E6D619726082DAE9B7FCCD232C91E306F1257B069DE4EF1AE1D315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026835, "uuid": "456980aa-a268-42e1-8eef-48fb974d475c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026835, "uuid": "95321c3c-ae27-40bc-acc8-539b10502511", "value": "6144:d3WOHLEivCS3qTWoS91kbxqR+hGUw1DQV3byc6MKzb7plJ1IOq:jcS3ee+hJwtkdKP7914", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683026835, "uuid": "dc3ae0ff-a865-417d-a3ff-a3766d160b35", "value": 409640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683026835, "uuid": "60224124-58d5-48de-8363-c8443e8c70df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026835, "uuid": "4d322599-6ff4-4d77-9a36-eaf054a337a7", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcd276d-e8f7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683038598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683038598, "uuid": "5f1a31f7-1c46-43ae-a3bb-73580baa513d", "comment": "Malware payload", "value": "e808ab15fe2982278b1b816221ea9f6a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683038598, "uuid": "710f6f66-7713-4194-b2e3-a9ed9d3d307c", "comment": "Malware payload", "value": "bf01ae9f6e3059ecfc199137acd126e193f15b066746bbb5da217e685d9a75dd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683038598, "uuid": "6e0654e7-2816-4534-9c47-fc7eca2ff485", "comment": "Malware payload", "value": "e694741045b8aff0759b88a3af50980024fa2d9a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683038598, "uuid": "e21158d8-ec61-494c-9868-101d7d5e079c", "comment": "Malware payload", "value": "a636449f64985fbe0367908e61efe4b094b7aae1763706435db9d30a4de30ceedf5b5a53074f1fd6596e613bca36d273", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683038598, "uuid": "a731be7b-b51b-4395-8cfc-ef528deb22f6", "value": "T1B6213070BA446BBB00456AC31035C23B24E2CF20B5C7CEBDD340D76CE5274611270E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683038598, "uuid": "17e74bd5-14a4-4ce4-84c4-a7baf275d1c5", "value": "24:+XhvnL2b6i6AvEIRZ08YJxfGCQgy3eAvepv/kjKN++Biih1svV9IU5HumOl:+X0XqF8Gtkg+zm1Dd40WVZ5ROl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683038598, "uuid": "0c8dac05-20bd-4d9c-ae76-3271aa2a7e20", "value": 1422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683038598, "uuid": "50e818c6-0df8-40b9-8681-f5418321f350", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683038598, "uuid": "5c0ddb33-2471-493c-a271-9ba090163c0f", "value": "gotoCheckout.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e36bad-e925-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683058283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058283, "uuid": "254359d5-df2a-4feb-9160-7c153082baa0", "comment": "Malware payload (AsyncRAT)", "value": "062e01423896916ce3dd507ba727cb05", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058283, "uuid": "253f4706-8e69-4a82-bf5e-b48868b9bddf", "comment": "Malware payload (AsyncRAT)", "value": "bf11863630250116f8879a666c81e2c28129fecad3e35a68f3b499cca7a3e90a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058283, "uuid": "4a24a850-fe60-4197-bbb4-88f9ec063fa3", "comment": "Malware payload (AsyncRAT)", "value": "06692e051d595f7cc0112838e4ecdde92b7edc17", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058283, "uuid": "86696028-5496-4320-95e7-4fcfdec89ad0", "comment": "Malware payload (AsyncRAT)", "value": "a137cc3f2e31c7d426489a75cd9d12d987ed0f1d789ad3f0ced2a6c098db374685a24a922cd52614900ba6769528e9cd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058283, "uuid": "0ed4e50f-2a68-4e6a-885c-787f520d220c", "value": "T1B1351242FBE284B1D4730A321936A75079BD7D342F34DA6FA7C83D69C532291912AF63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058283, "uuid": "b3d95119-479d-48be-aa91-40ac94967db6", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058283, "uuid": "b7fe1c08-6e98-4777-8236-a3726796beff", "value": "24576:wNA3R5drXINCDP+8Iu3GE4bo4nFwg0gATvzxvaCgYhzbZhaw:p51zWE4vD05FaCtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683058283, "uuid": "1b88d8e5-1c33-49f0-9f6e-cd454eb14c0b", "value": 1160831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683058283, "uuid": "4904b6e7-f0c5-4f45-a937-7d47095c8b20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058283, "uuid": "59819ef0-8a0e-483d-ae37-830e75a720d7", "value": "FATURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4d153a-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683013391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013391, "uuid": "e942b546-612d-4cd5-9bfa-d6e73ed6f7a3", "comment": "Malware payload (AgentTesla)", "value": "106fc27684971cdece5b6d98442f5add", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013391, "uuid": "bbcf8b88-0232-4882-b8ad-6200823ddc5b", "comment": "Malware payload (AgentTesla)", "value": "bfede26656dbab01c01f5187f8a5d9b63cd0f8bba301e8c1d145bda515960f02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013391, "uuid": "9bfb3862-ea9c-483f-94b2-8ba3a66f164a", "comment": "Malware payload (AgentTesla)", "value": "6ce315946aa1361977901a6c879cbba875b40dc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013391, "uuid": "50e27661-ada5-4587-9877-5032e8f507d9", "comment": "Malware payload (AgentTesla)", "value": "c017221355ea6f23cc4fd9a22f3966209b479f5f55d6bdb08bb296ee8a5b21d238f3d63fff5313d51f74386239883378", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013391, "uuid": "fd884feb-58c9-43ef-b24c-19b21b351a1f", "value": "T1F2E47B525165CE5FFE26DBE081B5FF85ABF1B07324E1D0201FB961C9CAA5F011E4CA2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013391, "uuid": "f222dcb2-5b7f-4a65-89bc-cd01c17aef71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013391, "uuid": "50aef183-7e4b-4a01-89d7-8c8f3d3d83d8", "value": "12288:KJPvsegQVtCzgrWoDCD8ToOyXpGmgEmGJMQE7harWEFGHh6:KJPUgrHMOyXM9EmGM7ho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013391, "uuid": "bf927b46-09a8-4f30-9562-12f96a4457aa", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013391, "uuid": "a885b84d-99a3-489a-bfd5-68bc43371012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013391, "uuid": "558262fe-6982-4f13-a91c-edc5af5456d3", "value": "Items Listed In Detail RFQ_2804024_KTC..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b84eeaa-e87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Pony)", "timestamp": 1682985928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682985928, "uuid": "cbe50cf4-4810-49fa-bd7d-15e81f5848e5", "comment": "Malware payload (Pony)", "value": "a547e64045d30568aa7e3afd81b81594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682985928, "uuid": "68cbaca0-c79e-4c8d-afa1-8b7c9a15fc71", "comment": "Malware payload (Pony)", "value": "c01dabdb1e0572151396954fd7bcd7334cee5b1d64de29b7de21c14eafbd6416", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682985928, "uuid": "bb6d6493-518c-4491-96e9-c91ee6ca5d60", "comment": "Malware payload (Pony)", "value": "9806c99c6f77be88be0629a3c851e6002a5a0d05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682985928, "uuid": "dee906fb-561f-45c9-86c9-78484a93c7ad", "comment": "Malware payload (Pony)", "value": "454ede4bf22ebe711209fa0139fed49d332028d2cc7e5515249071a78e0e6bf7e8dbe5fd6484f47ba13cf5bcf13ec303", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682985928, "uuid": "3efdd110-e591-45a6-be20-719581019a67", "value": "T10C551262641D9426D862977030A370D33F303C736F9722623067F97FA872BE6452E76A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682985928, "uuid": "7a4ff1f0-06a0-4747-a64d-3ca895b20092", "value": "bc70c4fa605f17c85050b7c7b6d42e44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682985928, "uuid": "b9532f71-6d3b-4e69-bb4b-ec70bc60912b", "value": "24576:rKPJPQ9i31L+VU7mqcZDvO78A649Po0Gb2rIbJpmZ/+fudAZRVG51iKZEUbr//eJ:rKxn3F7s9v46MhLIbJUZ/+fuyZR4/JPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682985928, "uuid": "ce7e747a-bbc7-42a2-8879-805161323586", "value": 1348608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682985928, "uuid": "a242a5d4-fc83-4458-ad40-090462213509", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682985928, "uuid": "ec57884b-c7c3-4271-b392-db3268060a64", "value": "C01DABDB1E0572151396954FD7BCD7334CEE5B1D64DE2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eedbdda-e8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (PureCrypter)", "timestamp": 1683019649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019649, "uuid": "3c24e9f1-0599-4bed-99fe-cb81a141b1dc", "comment": "Malware payload (PureCrypter)", "value": "57d15a6f866ced075bc300b1e2c37165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019649, "uuid": "ec0c2194-9f66-4c61-8aa6-53ea8e8e54f0", "comment": "Malware payload (PureCrypter)", "value": "c084e334c31cf636666e63fbff0d155fcb10cb813f21e5c262eb21530c4c1755", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019649, "uuid": "a42942e5-3109-416a-82c7-fa6fb024594b", "comment": "Malware payload (PureCrypter)", "value": "145479399c23aabcf01caaa3c9f6356746288e25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019649, "uuid": "e4c0d880-582c-41dc-b79c-f17a7327e98f", "comment": "Malware payload (PureCrypter)", "value": "1f2adf97c122e4058c3826f2fb0b6e9780e31f71fb65689b5ed9f5850c8f202c9dbb1dd8d88c4bb395330a67314d70cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019649, "uuid": "2b972cdb-22b1-4dc2-b7d9-b58240397714", "value": "T18544FD81C688FCE8F81906769877AE321917AF35987C5D2E186D702067B37B730BAC1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019649, "uuid": "a9bb93d9-add7-43a2-8fff-b6ec5b803b74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019649, "uuid": "dd926a1e-57c9-4819-8312-e9b8fb5e2c1d", "value": "1536:VuSmgtPAEzzeUkTVs8QbNFsCqThVaNj0XbK4ka87:VuS9AEzzeUkhs9FshThp07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019649, "uuid": "67ad7f2b-1367-4372-90d0-412031b140bd", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019649, "uuid": "fcb8cad4-48bb-4345-9b1f-41dde788aca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019649, "uuid": "90cb9a8f-ba3d-4fd7-ba22-789f5dc86e4b", "value": "57d15a6f866ced075bc300b1e2c37165.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05bdbc6b-e8d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683023714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023714, "uuid": "2071a004-efd7-4ba3-a1b7-d0b08931996c", "comment": "Malware payload", "value": "1d81057710dc737ffee88f7f8b0ef90c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023714, "uuid": "0b55a7a4-e48f-47ea-8440-da7743442d5b", "comment": "Malware payload", "value": "c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023714, "uuid": "c49338bf-35ea-4c99-a8a4-25c27fe7966c", "comment": "Malware payload", "value": "8a13b1fe68d5010e5e9b14719a279c4037d7c446", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683023714, "uuid": "c385dc0a-99a8-4162-b97f-796cd8d71c42", "comment": "Malware payload", "value": "1bae15c1a48bc2887429dc3c12b599a7c6f8946e38544c7aa21a30f04e381bd94c85eed0109a9684bbd56d48dff32e50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023714, "uuid": "34067fdb-acf0-4144-b440-0b471323d54f", "value": "T1EF247E88FBDC8A95CACD277864B51B7063F07906FA13D759285A7DE12EE33A20C0615F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023714, "uuid": "ec02ed2d-ac33-44e6-80f4-4952d30c41c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023714, "uuid": "c577b8c9-aa77-4d02-95f6-bd060c1964a7", "value": "3072:7/uLAg814+WRt9y2XyHVDXMfyAkoeuuRajdMF3rjxEc580F7/EvHUfvPo+GAkGtf:LrPMfyAkuuEZMF3ya809DftYdAW45I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683023714, "uuid": "382398ce-263e-4c0f-b4a6-10bbc032e521", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683023714, "uuid": "3e463def-fca9-43b3-b490-bc8b7ee3d654", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683023714, "uuid": "f7e7b9da-3e4b-48e4-8bb6-19bc65b5483d", "value": "1d81057710dc737ffee88f7f8b0ef90c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1a93b4-e8ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683006764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006764, "uuid": "ca6d4aa9-66c5-4ec8-9799-4f778d3e78a6", "comment": "Malware payload", "value": "41f4bf78a44711a11098c3e1f7e06278", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006764, "uuid": "39993997-008b-4d05-b1cf-d0959d478c25", "comment": "Malware payload", "value": "c1d125239b37b1c7739b907cd0347d97fc8d896f8bb07bee17fb4eac03458618", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006764, "uuid": "62cd68d8-9d5c-4014-8712-9feb877644d1", "comment": "Malware payload", "value": "8981199376ff52ecf505f8b533930510bdbe6e29", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006764, "uuid": "e19630a9-fc1a-4cd3-8f7e-add4baa6c28d", "comment": "Malware payload", "value": "5748fc731da711b8dc5c570cf1f0fbf9c511a7c442dcc330c5b08fdc46b83bad17cb3a0b1f2a9873c7745d6c2f21561c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006764, "uuid": "653a1038-6389-4fb3-9389-16a99e5c0258", "value": "T147E4231BF4EEC38931A41012050D30A4577BBDF21006AC6759B7D26F71E8EEEA6786F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006764, "uuid": "02764d3a-121b-4128-98e8-4bcdacba99e5", "value": "12288:8Td5HGf/q61AcVpcaEij0pGlErqqvNR9jJ1FG0B6rxsZ8XKaAQGFJv1jwhFRMqZ8:8RdGfyO3EGlEVlrjiVVD9WK7RMqUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683006764, "uuid": "95882712-c352-456c-b2c6-5f9aeff4889d", "value": 695302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683006764, "uuid": "8d4944c3-c3df-4264-afab-7456be57fe01", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006764, "uuid": "4c7b6b62-dc96-4b54-b769-486c6af45bb8", "value": "SignedXProformaXInvoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ca6536-e88b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682992226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682992226, "uuid": "71d8b209-d6cb-4c11-bcbe-a50d93b6d20e", "comment": "Malware payload (RedLineStealer)", "value": "aaa1aadd44f8b47ffdeaf27ce358000c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682992226, "uuid": "e663ca76-26c8-465b-a795-2fa71e53d2aa", "comment": "Malware payload (RedLineStealer)", "value": "c26f4ce4e20f4de0481ba2f4fe61b5e4ca5c5d07b7ddd8753fefa7bd2100d17f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682992226, "uuid": "c12005ab-12df-42a4-8815-4b9ee75f9914", "comment": "Malware payload (RedLineStealer)", "value": "3e482d829375f9e5d9006bf4f7117135c3353e8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682992226, "uuid": "ffec8da6-8cfd-44ec-ac37-9883cd319a14", "comment": "Malware payload (RedLineStealer)", "value": "c0cc72c6671cbcea9b55c0e98fc941ee1654abc91f7d684069fdb07a7a7fc482cfec87af1245a47e776580a0a14971f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682992226, "uuid": "a13148b0-2c44-4bd8-8707-f9f4fa6268eb", "value": "T19BA35D30679C9F19EAFD1B74B4B2012043F1E08A9091FB4A4DC194E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682992226, "uuid": "4705ee85-a970-4bef-9bac-5357c1bce709", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682992226, "uuid": "abab12ff-ce6c-4d44-b74e-a46b93d0c376", "value": "1536:NqsCiqeHlbG6jejoigIH43Ywzi0Zb78ivombfexv0ujXyyed2wteulgS6pIl:7RpVYH+zi0ZbYe1g0ujyzdwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682992226, "uuid": "81a949b8-3100-4677-8e8d-5a098ead4923", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682992226, "uuid": "9879c669-3a81-48a6-863e-58eef20b4629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682992226, "uuid": "7e5d6ea3-2802-47da-83bb-1704998c605a", "value": "aaa1aadd44f8b47ffdeaf27ce358000c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7528388f-e8c0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683014881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014881, "uuid": "5afad2c2-256c-4707-8222-c51a4c740e1b", "comment": "Malware payload", "value": "441f86ed56de4008dfa6a26961706a9f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014881, "uuid": "41110a0f-fc2f-456d-9b26-ad5f527d8fa0", "comment": "Malware payload", "value": "c48e37d03af802fd362fa463fadeb5de5f387368181be98e0d06542ad263f66a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014881, "uuid": "1866132d-badc-4969-a66f-dc351fd8c354", "comment": "Malware payload", "value": "0c7e1e455a8326974f072704b360fbef93f0cdd5", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014881, "uuid": "df62f0f4-43cb-405f-a341-7ff50e612907", "comment": "Malware payload", "value": "3036200de3fc816322e84df1d13db3f05422af683e6900310923c9749c23cd9bf607a6afa1b9aa692ebfcdbaf0111761", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014881, "uuid": "6d85eaff-21ee-4b54-80b4-ef595a6a4d03", "value": "T10E672261F7DBCA26C3A75239463D2D3756268CD542C39687190B3A281873FF84B47ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014881, "uuid": "d63fbea8-30d5-4574-a498-15b54d54b564", "value": "786432:STSgdjVEmj4jJNrentKous2UwmLqSa85w1I+Uu:S2gd8TrentKous2ULqSap1Uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683014881, "uuid": "533c35bd-e0ef-4b05-90a9-c47047d05773", "value": 31846772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683014881, "uuid": "9911dd0e-b773-4bf6-aacd-c80cfae35b42", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014881, "uuid": "2c7eaa46-fccd-4dab-b533-f29cf532070e", "value": "MetaMask.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943c0611-e8cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1683020087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020087, "uuid": "84dcf327-1855-4e8a-b883-33ab476f2873", "comment": "Malware payload (GCleaner)", "value": "3c4ac73bd7b5f178cb17acd51769391e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020087, "uuid": "f3a99576-fc04-4592-976a-3e38b2a19477", "comment": "Malware payload (GCleaner)", "value": "c4db7d1e957d2225520705672e86d4ee9d14cb8df62248c26d5442fd414d48a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020087, "uuid": "472b8a3b-1e20-4cf1-8b41-281f58d9675b", "comment": "Malware payload (GCleaner)", "value": "953ee8b296a9e726e5e110d5a85c54cd4be46364", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020087, "uuid": "eb4da630-e74d-44a0-9968-b478aca5a09a", "comment": "Malware payload (GCleaner)", "value": "2be2cd71b77a554a9214a8bc32703b80279b291ba25f8bf84da50f62589e2f144f4220d8e0509b7c7afdc6cda59e38a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020087, "uuid": "766a2bb0-4c27-43d7-a8f8-2ded27366d76", "value": "T1D385CF3FF268A13EC46A1B3245739320997BBA61B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020087, "uuid": "f4830259-1056-4903-84cd-6854f8f38f89", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020087, "uuid": "cbdd7bf2-8517-4f0f-8197-f555693bf749", "value": "24576:s7FUDowAyrTVE3U5F/5GqKeVKic6QL3E2vVsjECUAQT45deRV9RL:sBuZrEUMgVKIy029s4C1eH9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683020087, "uuid": "f13542ea-0e48-4d0f-9d11-4a6d58accc0b", "value": 1766304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683020087, "uuid": "d42b93b6-7cac-4523-b2bb-6805b5278a79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020087, "uuid": "bd061a57-53ee-4891-bdbb-37a313f254ab", "value": "3c4ac73bd7b5f178cb17acd51769391e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136d26be-e91f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683055519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055519, "uuid": "25dafa85-ca25-4ab0-b999-73211d448382", "comment": "Malware payload (njrat)", "value": "06eb429b40e197c7323eab0d9e90dc83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055519, "uuid": "59a4e34a-2f9c-4e58-8e8b-56a23eef336f", "comment": "Malware payload (njrat)", "value": "c5011781748eb12db7f0423dd186194e66d7131cf60f640a88d368e694db95c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055519, "uuid": "da56167e-f5b0-4310-a679-5cf2a2e679e8", "comment": "Malware payload (njrat)", "value": "245514d6e0aea06d800be45cc87ad8e54748a20f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055519, "uuid": "921dae96-17d7-44cd-9503-2abda882d854", "comment": "Malware payload (njrat)", "value": "014c284cf6c6be8f21d9a34c2e19a2da41ad0502e2ddfc6ede5f5e667e2b27fb18318856d73c559799734fd1a376c492", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055519, "uuid": "0ad70604-3dd4-45c4-9a70-7bece8399009", "value": "T1C0032A4D7FE18168C5FD067B05B2D41207BBE04B6A23DD0E8EE564EA37636C58B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055519, "uuid": "3809a870-0cc3-4cde-9f5b-499d363be47f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055519, "uuid": "1bbd3a03-f208-4d27-8052-d2e00f480a4a", "value": "384:6mOs0IiejvCVLO309QmykrtG+dA+VfwvOSifrAF+rMRTyN/0L+EcoinblneHQM3f:kFdGdkrgYRwWS0rM+rMRa8NuvQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683055519, "uuid": "1d668449-a953-459c-ad7f-70edc23adb93", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683055519, "uuid": "78f0518f-1475-4f9b-9ea9-b9f8227aa711", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055519, "uuid": "768ebb28-29f1-4daa-888b-b91cb16997e6", "value": "06eb429b40e197c7323eab0d9e90dc83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e94a5a-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683013372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013372, "uuid": "3485a640-baf6-4b0b-b909-b841f66c25bb", "comment": "Malware payload (AgentTesla)", "value": "75edadc48630498151d234a4a4114c03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013372, "uuid": "0db65487-02a3-4e4b-aea3-c610120a5f00", "comment": "Malware payload (AgentTesla)", "value": "c627472dd28ed54f7ba1b8601cbf0033b439b9b93620814b1ff07f8fd1e7fc15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013372, "uuid": "7f2bae33-a640-4289-8dae-90ef83faf924", "comment": "Malware payload (AgentTesla)", "value": "cf41cff44e21357ba3ab40c4e64d04aa6adc030d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013372, "uuid": "b90986b5-3853-4f75-9305-a85873e493a1", "comment": "Malware payload (AgentTesla)", "value": "984e01529d9a7ab906b610cc9633031a5e9a923b3ba0d7c5d922a754fdeb858ffd6bd59dddad33e736bec4226ebaf477", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013372, "uuid": "e64e4530-d353-4595-a6fa-81e847c5576b", "value": "T109F33AE992CB8972D72D4074C8F1105B07B2E287D617E76D0EA0A8F63E467C3753E992", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013372, "uuid": "f7743848-821b-40a6-8314-78738133c54d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013372, "uuid": "e66be8dc-9250-44f0-bb95-79189269e14a", "value": "3072:nqby4v6CvRhvhMVG1ypnHQ2QQTbrDTICpiTo:EEi/vhyC2jTfIq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013372, "uuid": "de18a474-64b9-4b4a-8f97-c8a381777965", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013372, "uuid": "b2720829-4ead-463a-af06-24295790be0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013372, "uuid": "7a5203aa-260a-4a90-b893-926db2e1e321", "value": "c627472dd28ed54f7ba1b8601cbf0033b439b9b93620814b1ff07f8fd1e7fc15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34108731-e8e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683029804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029804, "uuid": "8f979cc4-21f0-483e-bc8a-c581e4e0ff53", "comment": "Malware payload (AgentTesla)", "value": "c7bc4f44e279307955bc109deac55204", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029804, "uuid": "bdfdf816-ee00-42a5-9815-ca967bb99278", "comment": "Malware payload (AgentTesla)", "value": "c6e74929d1f5df0946833f77f1074f8a8518a642067b129dae1ad261ded796f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029804, "uuid": "c8c604b0-4d05-4a44-90f7-473a3f6709dd", "comment": "Malware payload (AgentTesla)", "value": "462ba319aef5f2077d86282bbde6b8d71afe72ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029804, "uuid": "6ec4af08-f0f5-43aa-a90a-d37f4339f3ae", "comment": "Malware payload (AgentTesla)", "value": "75be02db1bdc340b9036d1e7cb0ac4beceda58b96aaa169b756b6aa1f49889fa2a5a1b3912d65f387e19d1bf93dc1e73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029804, "uuid": "06f52d2a-a406-4f08-93d1-06dba234a7dc", "value": "T10BE4D0172059CD8AFD2DCB34C434FBF462B5BCB3E8D49527267A3D89F9B6B41090825A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029804, "uuid": "6d333c3b-24e0-4b11-ab43-ef6dbe1a63c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029804, "uuid": "75e49a39-04cf-4114-a59c-aaf6bc97e38a", "value": "12288:DQdi+j8KQq/flRRoF/H1JrgKY1kdrdJwAYaTpel9tGQOFaV:QRj8ytoF/VeSLJw+TpertGQOFaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683029804, "uuid": "81e12114-4d84-4a90-8573-1b909fd0422b", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683029804, "uuid": "c967ebc9-906c-4b81-8d76-4157cabf5c92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029804, "uuid": "47562acf-3ac9-4280-abe3-b514b94fc48b", "value": "NEW ORDER INQUIRY-Q23410242023.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85358bc7-e8ce-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683020921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020921, "uuid": "825c06c5-0c52-4794-9c10-72ed1bbcf8c3", "comment": "Malware payload (RedLineStealer)", "value": "81b3c5d35a7737b864caed9b04a037ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020921, "uuid": "26c0f528-4aca-409f-8bb9-f37cadc98c8c", "comment": "Malware payload (RedLineStealer)", "value": "c7146447b6b4efeae32b380ccf8c2889bcf6d67ef9c8cb56b6301ba4d226af60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020921, "uuid": "40b96a6c-b612-4579-b7e8-b9092ae207ec", "comment": "Malware payload (RedLineStealer)", "value": "190e35ec5ac7bb642946458dd43b1094119f2fec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020921, "uuid": "0aa43cb6-3482-48b2-a157-e23c2af8bd01", "comment": "Malware payload (RedLineStealer)", "value": "89ca59fa404ed5c3ecda2f84a5fb57b5ba662127d96a2d2e3bbaaf613effacf4c8286996de39a9847332de214a9a0435", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020921, "uuid": "db325393-83c9-487a-8ac2-5eab88e8e6e9", "value": "T1D1D1C40063DA9737D6734FB0ADB3A3910774F7929EA3CB5F2888420B5D122884E71BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020921, "uuid": "fc9dca50-c175-45b0-a9cd-182d8d493784", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020921, "uuid": "d4a19539-7cc2-42fc-bdf8-288bda684fe3", "value": "96:STrLN+0bHCPLSwBtt1zQK4KvBiH3DFOCGe4vkpClltLszNt:e9VDCPLSS1zQK4iU3GXAqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683020921, "uuid": "849335d5-e698-4895-915d-d0cb02ea5753", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683020921, "uuid": "a86e3c33-8717-4300-affb-b407e6df89db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020921, "uuid": "fce5e4ad-c7f8-47db-a294-cbe696a8fc05", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec615fd4-e8e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683028825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028825, "uuid": "fd4d1d42-f8e7-4ff5-b603-3268a5bf1c1f", "comment": "Malware payload (AsyncRAT)", "value": "d7a342009bfd76a907b3f2baf9acb1d8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028825, "uuid": "73d35f3b-866c-4b82-aa8a-38be888efaf6", "comment": "Malware payload (AsyncRAT)", "value": "c72e8271a4eb3c18cd2f83c50acd4d1b77f162be15b2011aa384eab178a7d51d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028825, "uuid": "1a1a35f1-4151-4498-9644-17347b0b1b05", "comment": "Malware payload (AsyncRAT)", "value": "4a909029a5f6fce74e7ae0c11897d44658027e34", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028825, "uuid": "899ef434-ff16-43c1-a54b-304f3e4beb3d", "comment": "Malware payload (AsyncRAT)", "value": "4f68cdf0297c386a34be775c3e2ffca73b41dfad955fdc630f01e0307c6bad9b332eac3eec055beb6099cfe15842d95c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028825, "uuid": "78167aa2-a3d8-4c83-873d-e634ba730c33", "value": "T12F253A4BBCA040B5D0A9D23189B65191BB31B8991B3267D73F50B2F82FB27D85F39364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028825, "uuid": "91faaf01-273b-484a-aa44-cb8cd09e801d", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028825, "uuid": "acd36c24-d376-4345-b137-fe604b5f62ed", "value": "12288:b4mT/RcXtvyJdBQhXVQp/Dv4alfZqby13caYgd2DFW9Xmmd:b4C/6XtvWBmQp/T4gcaYgdGWB3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683028825, "uuid": "040924f6-3994-4fa0-9ffa-a437cb44a4a2", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683028825, "uuid": "c9090001-e01f-489e-b38b-bc3f9f0fc2d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028825, "uuid": "7192a9ac-7e53-42ea-8ab2-e8af02b7d6bb", "value": "RFQ#0003725812.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9248a5-e8fa-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683039720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683039720, "uuid": "e5518ba2-84ba-4216-98c4-cd49db1e115f", "comment": "Malware payload", "value": "2f6e9e81674ece854a4946e4214ccf50", "object_relation": "md5", "Tag": [ { "name": "obama259", "colour": "#8086B6", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683039720, "uuid": "52285fc2-52d9-4cca-a979-cec40629268f", "comment": "Malware payload", "value": "c835fd8ec10fca24bc9a58197a89fd4de0c6e76992cdee63d70cfc80cd0165f8", "object_relation": "sha256", "Tag": [ { "name": "obama259", "colour": "#8086B6", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683039720, "uuid": "1ce03be6-af99-4f14-b1af-7044ec43972b", "comment": "Malware payload", "value": "f02d31592b7b77ea202dc7368a7751606251ccd1", "object_relation": "sha1", "Tag": [ { "name": "obama259", "colour": "#8086B6", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683039720, "uuid": "41865de2-f352-4545-9e95-00233222bef2", "comment": "Malware payload", "value": "3037c243630701ad29dd009d8323cd888151c601d4638c22cf16a1138d0917392a86ecc40f5d06886b670d9dd4d2968b", "object_relation": "sha3-384", "Tag": [ { "name": "obama259", "colour": "#8086B6", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683039720, "uuid": "14a4c69b-3c61-4dde-a728-f4236b1355e7", "value": "T1752319ACA44CD598C9B9ABF2E752F0CAE24D737B4A8E44B2716E5FD20203D65F943C41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683039720, "uuid": "a7f762cd-a144-4ef8-bbfe-ad9b55ddac63", "value": "768:JiqVjgocGH4FBncGH4FBQNsgecGH4FBMpamnnn6TVrXmm1Qghl:JNcs8csxecsRnnn+9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683039720, "uuid": "ca304c21-d688-422a-be0a-92776bbdc1b3", "value": 46608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683039720, "uuid": "2b992e8d-3937-419e-8329-f57ef79d04d0", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683039720, "uuid": "a1688dfc-c793-4c51-8583-ffb75eea034a", "value": "Contract-1337-May2.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365510a4-e8dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683027231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027231, "uuid": "2ae09253-7f34-4217-bbe5-482181ee7c1d", "comment": "Malware payload (AgentTesla)", "value": "68e797c7f22e03e7dde89d4f1ce28190", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027231, "uuid": "92d20fd9-b043-4a78-a09f-fa25fac0fd0a", "comment": "Malware payload (AgentTesla)", "value": "c901326018880f66e8d4aead46bc396a2682ec6ed5132269cf644e48799b424a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027231, "uuid": "1cb2956a-d7d3-4aa9-be08-564db7d1765b", "comment": "Malware payload (AgentTesla)", "value": "028d072447f53d6029f7b03850fa9f4b454b5ceb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027231, "uuid": "22fc0876-9735-4b85-9e91-cacc076780a6", "comment": "Malware payload (AgentTesla)", "value": "64f2d3eabe7d11d16c010708dd444f1d08cde5ae47936dd8deae37c0c0dc3619a40c93fde0c3b6ff8567c2c3a563fcf6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027231, "uuid": "603ec68e-e56e-46c7-8e90-2fa87818f8f2", "value": "T1950523C27A6F2661CAD69E77808080863F38C315FD53D7427889126A6E57FC73E8A5C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027231, "uuid": "9985f7c1-c4b6-4835-8ad5-224a14a82b9b", "value": "12288:GTJJObchjswmxz/qFVJI+MgZ8FBzXxK7hePZbi4X7dwP5sgrnZMqt/0Z:GlJGM+N/qFVO+FObzXxK25Ji5lri80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027231, "uuid": "eef9a987-744c-4855-89f9-0d9fe46db988", "value": 795720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027231, "uuid": "6a356a0d-72e7-404a-9fb5-b1869e932ee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027231, "uuid": "18ba8025-39e1-4255-a34a-efa8c79af43e", "value": "Dichiarazioni sostenibilit\u00e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4d640e-e903-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683043559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683043559, "uuid": "8fa22fa6-a50d-4149-a486-8bc220a8a7b5", "comment": "Malware payload", "value": "0b775d76c09806ea0c77be21787aa5c6", "object_relation": "md5", "Tag": [ { "name": "1683023161", "colour": "#2C91A1", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683043559, "uuid": "2ca93542-30a9-429d-88b0-aef237666631", "comment": "Malware payload", "value": "c974fc0afc08bd056253294691366303b58fc1a6d76fa7c6f837d3932fc049fe", "object_relation": "sha256", "Tag": [ { "name": "1683023161", "colour": "#2C91A1", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683043559, "uuid": "3db08d8d-736f-4413-a2e8-77f16493f178", "comment": "Malware payload", "value": "ece972e09d5a25f7b2862e19d1db96aa35ffbc5a", "object_relation": "sha1", "Tag": [ { "name": "1683023161", "colour": "#2C91A1", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683043559, "uuid": "634dc20e-b059-48de-836d-4c91460b16d5", "comment": "Malware payload", "value": "c441ff850fa2ea9ef32310aae02dd21fb8b5337d0d6bd5eaacd34b57d4ce373a9b071b75beaab8e7ab591d6e4243d674", "object_relation": "sha3-384", "Tag": [ { "name": "1683023161", "colour": "#2C91A1", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683043559, "uuid": "d234b684-ef35-482a-870d-d1e45bc5bb94", "value": "T17872BFD2A45D184CE449FB7EC833B56A08EC3617C7DF35B27934895DE8482265B2238B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683043559, "uuid": "434e1419-6f10-4b9c-b156-7e0a771dfcd0", "value": "384:EqUSRKHZpeXHSxQ2RP3pqKyJ2mSmdJIpU4XIWitAJJ:E0RK2XSxQSeFsG4X0tAJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683043559, "uuid": "e8a60185-c4c4-4342-9e23-afc5370c38ae", "value": 16885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683043559, "uuid": "1d666317-46c2-4c1a-bf6f-f96d53877090", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683043559, "uuid": "535d577d-dde2-46ef-9e0d-15fa43283826", "value": "Earum.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53b7108-e8ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683006372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006372, "uuid": "03e00f1c-a060-4807-879e-3f024d4cbfaf", "comment": "Malware payload (AsyncRAT)", "value": "9743f6d9eb73fbea512fc1cdbaae4587", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006372, "uuid": "5afbfe41-4fee-4511-947c-939cacef3935", "comment": "Malware payload (AsyncRAT)", "value": "ca32420160b4ba9b029fdc12df95d54c10c2dd7d878265026a461125c6dba745", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006372, "uuid": "04112cc0-e0b6-4fc2-abc9-9b62822e4047", "comment": "Malware payload (AsyncRAT)", "value": "2d33bfd11bfb64d616ed711699c5c701fba14896", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006372, "uuid": "3ccb468c-d3f0-453f-914b-48238e4e440d", "comment": "Malware payload (AsyncRAT)", "value": "c223bff6fe8a769378539ec513ab0103db97bf74e3b6b86b80c38b4cf326065821277f00736b1a5b43e1cb802d40c03a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006372, "uuid": "3d939bf8-f62b-4a14-a3b7-c87d16b5d5d9", "value": "T151C51225F84A6E61FC8CCDF94AF0BDA403E46C78007A56D41374355FABABB5E9920E34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006372, "uuid": "dfa4cfcd-53b2-4ad0-b96b-461a72cc4297", "value": "12288:LMzQeJkWPRom6HjX+/o9z8NlWyOVsDVqE:UQONopHT+5N4VAVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683006372, "uuid": "b28598bf-aaa8-46ed-b77d-101553d1ec05", "value": 2524879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683006372, "uuid": "8e81dd26-e0cd-490f-b38f-fa827efc9240", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006372, "uuid": "63ede738-c63d-49cd-8cc5-bb6ea8318c04", "value": "WinZa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c03ee1-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683013402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013402, "uuid": "5941c458-a702-4175-bb8e-d5a2492f7122", "comment": "Malware payload (RemcosRAT)", "value": "0c666f4fa1b26d33fab8f9f36fa3ae90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013402, "uuid": "345037bc-c96d-48ce-b593-c8694f44c31c", "comment": "Malware payload (RemcosRAT)", "value": "cae72040b23f41152097cdd9ca3500fb0b82f6c64479d125472edd7b2d0f37c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013402, "uuid": "c6e3fd47-0d90-4f8b-8844-16590e3a49d3", "comment": "Malware payload (RemcosRAT)", "value": "974326eec40369e3c0a894340d9fda2547e4553c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013402, "uuid": "cb476234-f4a3-4c55-b409-14df1a6835d1", "comment": "Malware payload (RemcosRAT)", "value": "b5b0d3d12b753b096ef76ac8633e068dfe0276b89e4b36924f31a9c20f81bec810fbe1c927159323775583c859c2ff7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013402, "uuid": "2fee0053-95a5-417a-94b6-8293fe6ebf43", "value": "T1B2440254B3C6D45EEC070DB0AABBC6ADA673A91C74016747AF80BFBE6D343819D46342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013402, "uuid": "c6ee3bb7-d33c-468c-803b-c827a85d2c96", "value": "e990dd07e89d04c53e337ab9b3f5e0cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013402, "uuid": "146bd7eb-1ff4-49af-ab20-38fb5e245821", "value": "6144:UR0+Ik/yw+H0/GcsBUOQPzt3ge4N5vwfegJf3Ih/:/u+USqOQPB3z4N5ofxI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013402, "uuid": "44aa80e1-efda-4358-9772-56528447da4f", "value": 267735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013402, "uuid": "9d5505b6-dbac-44a8-b761-43702b207984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013402, "uuid": "e950d22f-35e2-4920-9839-5516c8ffc074", "value": "PO-1812-BNS0023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f571ac3f-e90d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683048168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683048168, "uuid": "398f6a1d-e7d9-4873-935a-daa2d4e3f5f0", "comment": "Malware payload (AgentTesla)", "value": "afad92aadebdb6f56095db58259144d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683048168, "uuid": "cfa61a77-2fe6-4138-a2fe-3194249e7532", "comment": "Malware payload (AgentTesla)", "value": "cce03ee9cac9ccbacb587c0fb5426aa0435a9e1278d0d5472ab0ae06139687ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683048168, "uuid": "45e38dc5-58b5-41f9-8f7f-90170d343f27", "comment": "Malware payload (AgentTesla)", "value": "bbb5d8761ede6a1e546fc4ef1475f8dd9f96a281", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683048168, "uuid": "fc5093dd-4a90-424d-bdb3-768cee40c6b8", "comment": "Malware payload (AgentTesla)", "value": "0767b2f4f89e1146962377c1da30814815565d595449b7477a9c9c8fa78301e88af2a15366b0bbf1ba36ba685e3a2621", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683048168, "uuid": "81537f32-92fb-43ff-9e07-39de98f17c18", "value": "T14CC4DF1650A4CF1BF93A8BF18474FF8463F0F07391E4D2391FAA21C6DAA6F101A5995B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683048168, "uuid": "b502d628-17bd-49b9-a316-cba42a5db58b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683048168, "uuid": "361bd543-72af-4785-ae55-673829cb6128", "value": "12288:7gZmvFtZnvpXyLnoNScEnURpSL0zBCOcv3Urqxqtx/qcPP76:ImvZnv8LoI3ypSQzBCvvkrqkRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683048168, "uuid": "8c3e101d-6c34-4d20-b4db-3ea3c79797b6", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683048168, "uuid": "cef4172c-aff9-47e5-be33-687a57344ba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683048168, "uuid": "c04c1f31-12dc-47d4-be69-8f077fb0a657", "value": "dollzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71c9e8f-e8da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683026266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026266, "uuid": "df43990d-5104-4c6e-8204-6c73e3eb9663", "comment": "Malware payload (GuLoader)", "value": "f29782c9385054baf2ad65b1233c4adf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026266, "uuid": "b59399f7-c2bd-48b2-b042-b48bbd468fd5", "comment": "Malware payload (GuLoader)", "value": "cdd7f820cadbc02ea8608da2bb8afd03367f4169d9f7c0d36a2e66f40dc5294f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026266, "uuid": "81bcbece-017f-4e32-a124-aa69f1d6b159", "comment": "Malware payload (GuLoader)", "value": "eeedb03fa3e391201f729a19b3a9fb7244e3d78b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683026266, "uuid": "f8a9d0ec-cfff-47f0-8f1f-ad7b0c1538a9", "comment": "Malware payload (GuLoader)", "value": "6bf10f3a58d770a6375d5dc6221730f9e24c9332a68dbb473d2eb8060e2863cfbe8e2d26f838e8902c73e66f8b7553d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026266, "uuid": "2262a88d-0f2c-49ba-9771-fa174fe96384", "value": "T1406402017BA0DA67C87280F27C66EA35DB616C4A2D50851363F1BF4FFD762921D0E297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026266, "uuid": "4d23bb9e-2d0b-49e1-8ecf-b64abd9066fd", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026266, "uuid": "4223424e-20c9-4923-b6c6-08c7fc6fd511", "value": "6144:V7ewToRaiAGZRBbN/ZxjLezbXGquH7/O2zaKIN4TQ:5VToAiAGZ3J/ZxWuqG7NaKI6TQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683026266, "uuid": "05717155-0a2a-43d8-92ff-5cefd1f5d645", "value": 308821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683026266, "uuid": "c55c1870-9a29-48a6-9573-56c96a1a31a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683026266, "uuid": "1aee0630-8e1a-4245-8087-adf5ce7bc8e4", "value": "DHL_2017128 Receipt Document,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b22e0f-e8d8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683025223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025223, "uuid": "f15c4a71-5881-4dc0-9edd-2123224d3ad6", "comment": "Malware payload (AsyncRAT)", "value": "b517ae1dc3b83429ceeac21365405546", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025223, "uuid": "d00514cf-f7cf-4a6c-9fc3-7eda838caa65", "comment": "Malware payload (AsyncRAT)", "value": "d08693cc98b1173e9ac952dd9222ad8aab5b2e62f7184a9651e088ec2940b358", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025223, "uuid": "d749c54e-e6c9-46f9-a742-6688a0397e94", "comment": "Malware payload (AsyncRAT)", "value": "b0e6637571ebae71713176bf4b3ee7d34a776997", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683025223, "uuid": "c5a592e4-229b-4e91-8e18-db470946e18b", "comment": "Malware payload (AsyncRAT)", "value": "ac9a69de2519e8aba350ecb899fcc5b94267ef1c9c8d722ae309d57b7c3eb45cce2f3770ec545d89a5de542e509c12c8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025223, "uuid": "cbe28605-d612-462a-91c7-767b06128f17", "value": "T11F246B9D766472DFC86BC4769AA82C74FA6174BB430F9203A42715E99E0CA87CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025223, "uuid": "380324a6-25ee-4290-b7a6-0c1960c8fb55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025223, "uuid": "31366df0-3411-431e-9cd5-f4ceddfff8ae", "value": "6144:Arad0VMEcsoxmkrCTCjum3XqS2zQF4mqcDVd8DiJdLI:AradFEcsLr8qSW04mq4Vd8DiJd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683025223, "uuid": "04de87ee-0cdf-4ab3-a9e0-89a9258a5164", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683025223, "uuid": "0675eea7-21b2-49e6-8064-50d242783ccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683025223, "uuid": "958ab2c8-fa54-43f4-98f9-70736a2e14a2", "value": "b517ae1dc3b83429ceeac21365405546.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c308fc4-e8b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683009175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009175, "uuid": "658dc364-f784-4529-94b7-01ab9533cd69", "comment": "Malware payload (AgentTesla)", "value": "63a70a46c4da87e6061ae079ff17fcfe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009175, "uuid": "99f99dd2-947e-40d0-a7cb-834b7b6c7770", "comment": "Malware payload (AgentTesla)", "value": "d0d8964f9c48656b637b72ed00f5fb7f1f7fec4e8cc18775c119b122223680a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009175, "uuid": "db54c2b2-cc1c-4920-ad7a-d33936ac66b5", "comment": "Malware payload (AgentTesla)", "value": "29b0b890f5d8eae9dc66e564ccbbc1d3f6bf7010", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009175, "uuid": "232a49be-32b1-4e68-aaca-95b44279dbe0", "comment": "Malware payload (AgentTesla)", "value": "a8a3d07c0ba51b58b558492495a67b296d53b94a8828034f2199855ee2c80879d84bff46a09a2ac53ca7dd4e7eea220f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009175, "uuid": "2bb7a76e-1306-4014-a59b-7b3ceaa6e57f", "value": "T1B8C4D0466024C86BFD698BF04464FF8067F0F073A1E1D2A52FBE51C6C9DEB890E5568B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009175, "uuid": "73c73478-6064-46a8-b813-9fefca572585", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009175, "uuid": "1810f561-6201-4952-a88c-c793bba58374", "value": "12288:CRy7YXn4ePibxN6jotDNO8Ttb0u/5xlH4jV6:17YI2Kxwjotbpb04xUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683009175, "uuid": "7a294730-9dc7-48fc-9509-740910625989", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683009175, "uuid": "a87228f6-d692-468a-a493-acbf80dd913d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009175, "uuid": "816bcc95-f3e6-4b99-b4de-b4dba934579d", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bae3411-e8c1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683015187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015187, "uuid": "4474737a-98b4-40fb-8983-1d10a3e1e594", "comment": "Malware payload (Formbook)", "value": "a06b7622b66895bbe24c19fbcf78510b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015187, "uuid": "c4d3d5fa-e38c-4e28-bbfe-7e8c84886ff3", "comment": "Malware payload (Formbook)", "value": "d1edcffd58ccef4c9709f027948bb28d09b1aee267cdd9b1271f7136b37ebd94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015187, "uuid": "0c0e54de-4692-41ee-92c9-a7cdf1628202", "comment": "Malware payload (Formbook)", "value": "ef25ac4047ccb1dae8836faf7df7a7234420556c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015187, "uuid": "5f8983e5-0b19-4518-ab3d-f413ce7fc56d", "comment": "Malware payload (Formbook)", "value": "b2e80bf655b2a2888c954d2dc092dd6910753abd7c514c58f413c9c44b6ff48132fddd627b978dad36555bfa3b89ded8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015187, "uuid": "a3f6cef5-9bd8-4e85-bfe8-76d55d393f2f", "value": "T1E5D4DF426169DF4AFD3ADBF094A4FB8057F1B1B358E1D1211FF624CADAA5F100A4CA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015187, "uuid": "eadb8296-bab0-4c17-82a4-7870ed14f767", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015187, "uuid": "146c31d3-6829-4e13-86c7-3da6bdfe4067", "value": "12288:mzmBW4qJkz+yZMPGDT8rLBQlbPVCfmuWbvrH8WC6yelmGGJid:smE4qJUOPGDTm8bNCfybvVCHelwJid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683015187, "uuid": "2c600dab-ddc8-4db3-b3d0-4c98d6d62dc1", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683015187, "uuid": "940cfc3c-303b-41ec-9379-579cfe85e296", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015187, "uuid": "19c8935a-bb7d-4cf5-a809-7a78b0250b58", "value": "PAYMENT CONFIRMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342fd553-e8b8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683011336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011336, "uuid": "d17b66ea-2e47-4fd6-9b27-77fc1a57cc6c", "comment": "Malware payload (Loki)", "value": "0ba192257e5e8cc03aa4a32e94662d3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011336, "uuid": "8a2550d2-27bc-4c06-a3c0-3d7876bd1923", "comment": "Malware payload (Loki)", "value": "d45f5ad41b7903babda50ffd7511660f1a092699c0ec56ca0dc347fccfe0f208", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011336, "uuid": "cc1be1c8-6b92-47ce-8cfc-8057fe20fdac", "comment": "Malware payload (Loki)", "value": "47aa5ded3911bf5dcf92853371729f23c43976f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683011336, "uuid": "d339f634-b262-465f-9f50-345a9bf99ebd", "comment": "Malware payload (Loki)", "value": "7e2ac109480ea8fd3fc0d6dad7cc1f0f1042278663a418f52c9b85d866785aa96ac64cf6534acc70cbf4265fd321b82e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011336, "uuid": "7c1d82df-5cad-43d9-85ce-79b6128f2e60", "value": "T1AAB4CF0A11A5DF1AFD768BF18074FF8467F0B07764E0D1242FBA60CAEAA6F011E4955B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011336, "uuid": "8f0251ff-e927-42be-883d-77224cb6e86a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011336, "uuid": "7b3639bc-72ad-4235-8326-5f208b38f6eb", "value": "6144:C445KrJ92bYUWcMZTPD57MgeEYjuY/jP5lBlP+D+Kgp0PySHCcA4+2CIntAz/CUy:9tdVcK5JijPplM+d+PgcA4+2C8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683011336, "uuid": "305fb8c7-15ef-4b4b-8be4-fb90c756d12c", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683011336, "uuid": "f9fe76f5-eaec-4a90-8016-116e66b4e448", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683011336, "uuid": "610e4ce3-58bd-428c-ab95-c1beeb70bea4", "value": "DHL Express Receipt_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c01458-e910-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683049297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683049297, "uuid": "f385ccaf-c691-46c0-a8fe-5c2520d277ba", "comment": "Malware payload", "value": "697de322b2bb984132bc6022c754ab57", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683049297, "uuid": "5951e577-7bb4-4e8c-b5fb-70a58ecf13b8", "comment": "Malware payload", "value": "d4f5863a20494d090fa8712ca62afc471b06d4b55c1a3916964c5eca2cffad5d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683049297, "uuid": "40441aa8-39b3-457e-88ba-cc1c8ec04d0b", "comment": "Malware payload", "value": "91968d65925d86d9205def58faa94804a31701b8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683049297, "uuid": "d043a3dc-a031-4229-898e-e1ee7fb3cfd9", "comment": "Malware payload", "value": "a04d7fbaa5599d37aa1209b8fcd1b314babd7d07c322ace3610efe420ffadeb319d29f89b859d22b49ecbd449c5519a1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683049297, "uuid": "0ea62d04-692a-4c09-bae5-fb7089dbb45c", "value": "T105031B5BA380037856620158924F6BD1A7B984747A21DAB4E48EC3ED3341D79D3FFAEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683049297, "uuid": "7d500062-6c60-4a9c-a8f7-2777492fa4cc", "value": "768:i3NlhkehGjIGwrl95xu/gbfup4SvedW9tHKIj2uI04vM1b1S:i3NlDhGjIGMM/Y2p4+dtnjDcElg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683049297, "uuid": "c79fbd44-85d7-4665-b22b-1a903001a1ec", "value": 39661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683049297, "uuid": "898b2a82-d42d-43ad-bfe7-9291d74bb3a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683049297, "uuid": "b12f9b3a-e23d-435c-8c4e-9af0c07b8dd4", "value": "B025.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0290c2bd-e8e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683029721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029721, "uuid": "a7200778-b7bc-4278-a0fb-b97a7780aa9b", "comment": "Malware payload (Loki)", "value": "aee5842856560c4c7cec9b66f806f8a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029721, "uuid": "e3cb325d-f816-4ad5-8b74-13570db7c9f1", "comment": "Malware payload (Loki)", "value": "d54ffba0c66f350e816b88e1a0fd473b161f95767412398f41be0fb23ae0b9bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029721, "uuid": "f8fdcb86-d689-4c22-868b-de7edc6d540d", "comment": "Malware payload (Loki)", "value": "381755a469ef803b14bd407310e4e947b1959082", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029721, "uuid": "e72b890b-108d-4d51-817c-f9075a100a1e", "comment": "Malware payload (Loki)", "value": "948a14804df328b70c40fc26740a39d65ff5ac2c45996b5aea0466eb407fd5d47b2edc024f94aebd754752e4bc101bb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029721, "uuid": "fd8c5831-4f78-4977-a063-0b38acdfd326", "value": "T150B4BE0260A9CF5AFD3A9BF194A8FF8467F0B5B754E0D1212FA524C9DA65F011F0CA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029721, "uuid": "78faf09a-aafa-4195-add6-22ccf09c1b77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029721, "uuid": "0979ea80-a262-4328-b499-7e6f48e9ac7c", "value": "12288:YzmEYZXqhgsmHaBHqnKDbSVtwZOrssxcALrsmOU:+mEYE+sU8KnKKVtwq1zLrsmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683029721, "uuid": "8b531577-b57c-490a-810c-5499090fe335", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683029721, "uuid": "a56251f8-59a0-4dab-8f94-1895df30f722", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029721, "uuid": "addaec7a-6cea-433a-bc74-a8b71663b640", "value": "aee5842856560c4c7cec9b66f806f8a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8b9312-e8b7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683010890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010890, "uuid": "bfbb4a79-748f-42ff-a21b-a4ab36ec4fa0", "comment": "Malware payload (AgentTesla)", "value": "e73860f80aadfa522e8f20652c116de8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010890, "uuid": "9d9f1983-81c2-417e-b984-50e38b6a4658", "comment": "Malware payload (AgentTesla)", "value": "d585e417af6ab00f5c1dd19bd9883cc75bd78cd3a1f3e5bebe7c646b8dc8384e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010890, "uuid": "05f9c4b4-3271-45ea-a56c-74ca98bd8d93", "comment": "Malware payload (AgentTesla)", "value": "20c52372c823276e0f8c72e6287f468ab82da7fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010890, "uuid": "d7155a7e-2137-4eed-8603-971e7829fe22", "comment": "Malware payload (AgentTesla)", "value": "7fea37454a49fd5cb51d5ca0b93936ec3acab6828bc500dc83266483339f4da275cc7d33d0df3b7e3cf8e1c0270121ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683010890, "uuid": "c8ef92bb-a227-4176-bf96-51b52be2dbec", "value": "T1F1C423BC5E098A312D3DDF6B2DB272984E185BB31754455E382071EFA14E9CF7AB7A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683010890, "uuid": "4072bd6a-25d1-4a17-bd01-5171b9f60df1", "value": "12288:F/EYCYjC7hmVPkC6PyqdejHTTsvtLj2zmYHxgXZyLwQGnFCc:FM+DZkUe2zjzmOxgl5nkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683010890, "uuid": "4a171f58-691f-4c30-b0e6-a0284b293ecf", "value": 544897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683010890, "uuid": "ac002001-086f-4800-a9da-35827b6ad3f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683010890, "uuid": "e5507918-efc2-4d04-ac6d-6b64567fd071", "value": "Payment Slip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07420229-e8e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683029729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029729, "uuid": "7502c8f7-0094-4415-a21c-dbd550e52e82", "comment": "Malware payload", "value": "2846e4a5f259940bcc4cec7c09dfbb22", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029729, "uuid": "e4ff6680-3d9f-441a-8eb4-05d26ab7354e", "comment": "Malware payload", "value": "d627a990f7dbe241cd5dcb3b43c1a849faa58839b000fa8c4e2739bb3901a584", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029729, "uuid": "0077cbbf-44c4-473c-89a6-eb2d489d8d54", "comment": "Malware payload", "value": "761618941b53f24e543a7120d2044b9264a263a4", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029729, "uuid": "8ff92ff2-de14-41d2-964e-a37e9a2d6eb3", "comment": "Malware payload", "value": "ba42b04a1e72f1fdc2d520b2ee142077034c0cbf504aef52d8efa80f408c330529e5f511fe239436263df38ad0afcd51", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029729, "uuid": "faa77fd1-4b22-459d-93dc-3282d4992364", "value": "T1DF0412554373AC58F972C0BECA084CD6094891C286E18CBF16A4F7F16F6136A3395EB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029729, "uuid": "9d076027-fdfd-4b34-a8b9-f3e4021e9437", "value": "3072:qNeA/8iPyQtNNHqMiaDV02td+uiF3pX3Y3vKBs8VHGJG+sw5k1wHjiW8tAp+cIV:kevisMiiVzdhiDY4HmJGTCjigVIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683029729, "uuid": "2caccde7-c5f9-4f85-9089-379330c63f3f", "value": 184231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683029729, "uuid": "4961e597-b8df-40aa-8cc6-039647269a16", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029729, "uuid": "fb9e6198-6bbd-41e2-8da1-8ad950577e3c", "value": "ACH_REMITTANCE DOCUMENT .xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7417beed-e8cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1683020033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020033, "uuid": "f34158b8-7697-4a5e-aca8-71716f92dd80", "comment": "Malware payload (GCleaner)", "value": "8cea1ec4d601d044bd5815cfdd99ccb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020033, "uuid": "4f1c8d58-279b-4ea6-b65f-a85ffa1b8a9d", "comment": "Malware payload (GCleaner)", "value": "d654248fa5ce7a4aebf299ef5acc771bc245c28b24ed85c467804a65de2ffff6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020033, "uuid": "9a6f742b-286e-4726-ac7d-e2cc01e84b02", "comment": "Malware payload (GCleaner)", "value": "ebddf844b59b1b9ab4ae88c160b5b7b6820c4ac2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020033, "uuid": "1ce51f06-a150-4e23-b315-f4d38d7fa76e", "comment": "Malware payload (GCleaner)", "value": "611f41bb0445a3ff9aa676b5e54323dd41b1f473f7722483e0f6483ce22302921cadc0e8c24dc96dab617c17d7a01145", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020033, "uuid": "0c9a33f5-d68f-4a3d-bf39-128536a61667", "value": "T1BD85CF3FF268A13EC56E1B3245738220997BBA61B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020033, "uuid": "10802a8f-bea5-4278-a488-a5c9fffe52ac", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020033, "uuid": "d33ea497-8991-4120-9f3f-7564b6aa3c9d", "value": "24576:s7FUDowAyrTVE3U5F/oGqKx7Kic6QL3E2vVsjECUAQT45deRV9R5:sBuZrEU9PKIy029s4C1eH9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683020033, "uuid": "0062b35b-9ffe-4883-9087-b3834a60b4ff", "value": 1766235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683020033, "uuid": "9db75f1a-af9b-460e-96cc-09e31b562884", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020033, "uuid": "c6f7150c-011f-4494-a380-adfc6985e28e", "value": "8cea1ec4d601d044bd5815cfdd99ccb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356ad437-e8e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683028947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028947, "uuid": "3875e390-1048-4a10-81a0-3a98d5e3e93c", "comment": "Malware payload (Rhadamanthys)", "value": "151fb5d2362e854d6b2cf87a31fdd101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028947, "uuid": "f6580abd-7c80-432e-9f1c-cfa65d7990c3", "comment": "Malware payload (Rhadamanthys)", "value": "d668246d8d9414c778f83f8f15d2ad68849c4b736d0cf65e126ffc7a7a27377f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028947, "uuid": "b0e094c2-54be-49bd-ad33-656775e2becd", "comment": "Malware payload (Rhadamanthys)", "value": "12e1f114ddfc567c2718a7283f09f2b5291faf88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028947, "uuid": "62570915-8069-48c6-b875-59c14ead3ab0", "comment": "Malware payload (Rhadamanthys)", "value": "833397636a4fb0488191c3215ca45be4c238813231ac3ef3f4b6dba6009a1a05454a09375c1f4baf126a41b137642b97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028947, "uuid": "c5ba1b0c-b3d5-41ee-98a8-8486d7143eed", "value": "T179949E1372F17832E63246728E2E96F8662EF5624F15BBDB2394D62F09B11F1D272701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028947, "uuid": "b56bc287-61ee-483d-bb80-59d7721251c9", "value": "8e1291b1baddb8fcca0899ad3cc587e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028947, "uuid": "a2c91c49-e2d4-4332-810e-2b5a6ae7705f", "value": "6144:eB/LoBCFoHjL5xRPpe31K1UyuWkHOM8gOh9qLiGPfqb:eB/cBCFoD9zxe3k1UyuWkHOdaGGPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683028947, "uuid": "f0165bb8-b8f6-4817-bf4e-89d85e8c051d", "value": 420352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683028947, "uuid": "18fe065f-4457-4496-9bab-8677993f8df9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028947, "uuid": "c5ccac60-aa43-4a11-a090-905965903fe7", "value": "151fb5d2362e854d6b2cf87a31fdd101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0abf10c-e90c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1683047703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683047703, "uuid": "7ebd15b4-ae35-4b87-87cd-1c12993a4a13", "comment": "Malware payload (AZORult)", "value": "e802071be25db2528d3878bded56d3bf", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683047703, "uuid": "b2c3565e-bd1b-44d8-9e5b-1c7a85c09ca0", "comment": "Malware payload (AZORult)", "value": "d81faad0d92b453c12c9de5562f2ff509e88743776af0e48b6ed676f538a9892", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683047703, "uuid": "aed58d08-4f90-4ed3-85c1-e5b7bc519283", "comment": "Malware payload (AZORult)", "value": "d40b2a7d4f73110f1adc13438ead5d0e0e3ce66b", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683047703, "uuid": "c8de24cf-e47b-4d3c-b40f-2ce49ae8f8d2", "comment": "Malware payload (AZORult)", "value": "64629bccb0aec23a3754fec8958caecadf70cf294b5be78e6cddd1f00cd4a75ceb2ad0dc5120a8d419163dbb1a2ec625", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683047703, "uuid": "1ac6b87c-a814-46b2-bc79-5ed348994e29", "value": "T15B64129733D88CABD5580A7D8DB3ABFE53B77D0D8628600707957F5E38312929F1A881", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683047703, "uuid": "c2eb72cc-b876-4f8c-9fa4-ccd4eae62eb3", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683047703, "uuid": "b0dcc2a9-f510-41e0-b9d0-aeb52f9c7b8d", "value": "6144:R4SUjhth56iHdx+K16auhrniMhiZmLm56zsoI+vL9sEInDpH:q/6i9x+K/uhrgmLG6g+S/9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683047703, "uuid": "9c8a74f1-0f28-4477-8e43-82612c2035e3", "value": 330534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683047703, "uuid": "dfbfc3bc-8e62-4081-8ea2-b59446405657", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683047703, "uuid": "126c7be2-49d5-4206-9b40-7887cf28713f", "value": "BK90150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b062e71-e8d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1683022219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022219, "uuid": "7959e42d-4da8-4983-871c-f15defd54574", "comment": "Malware payload (AveMariaRAT)", "value": "67cce9713c1f125deb70cce62abc7335", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022219, "uuid": "a1e5d552-5d0f-49a6-96d1-be80d28df356", "comment": "Malware payload (AveMariaRAT)", "value": "d82c8b26b89f37dc001cd489570e5e3ed2c84d7604c4aea6346ad898c6537b57", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022219, "uuid": "f62e3746-9b75-456e-a3e3-c5aed281d4e7", "comment": "Malware payload (AveMariaRAT)", "value": "af0a0b18690ed78d091d90f9825fc1fac2c47c9e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022219, "uuid": "0273f783-c732-4fe2-ad37-46c788abd598", "comment": "Malware payload (AveMariaRAT)", "value": "5e631286a161b2d06cb61b8191d278e80947885d398346e9a7b669737078695c2ed43ce9fd665736832c8008b0336a5b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022219, "uuid": "4f045fbb-6e12-42ec-a647-334a10e42bce", "value": "T15FC4DF166165CF0AFD7A8BF09474FF8067F0B07364E4D1242FB960CADAA6F101E49A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022219, "uuid": "2b3a5a11-1f28-49f8-a5f1-572343af9c47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022219, "uuid": "bf17c43d-c6bc-47df-b2c7-d241ba78ba60", "value": "6144:+445pW0+y5I4rCLLdDATBZFnQTyUqzksifKJ/tIu4YEW/qeKrNcjRICX5KZoHdrX:aHn5I4GhcBf2yryWibcaCX5KFQR+lSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683022219, "uuid": "332d7d01-50f3-4825-8394-aaacdb3752f6", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683022219, "uuid": "0b212c6d-fea8-4562-ad5d-48407cacdeb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022219, "uuid": "c8c261ab-de74-46c8-a033-8919de608988", "value": "PO00243591.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1a5665-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683013393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013393, "uuid": "c24d42aa-2038-43b2-91f1-4c7fa0c0b83d", "comment": "Malware payload (GuLoader)", "value": "7b77eecd6bda6f0847a34245d0636692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013393, "uuid": "4793c41b-b712-45d2-8dbc-a512545f029d", "comment": "Malware payload (GuLoader)", "value": "d879879b64f9d4295ab61b58bdefd35077f4cf5204069398ebc3692914471f7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013393, "uuid": "1a6d2bbc-35bb-4d42-a030-8e54ab1c3cc0", "comment": "Malware payload (GuLoader)", "value": "8b5b9c279cb4f1267fd48534772868376209e4a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013393, "uuid": "74edf192-1cd7-447b-89df-640d22a4f44e", "comment": "Malware payload (GuLoader)", "value": "54cadee2daa9c93956cabd2e91925a8377f9e0b22b4767da4f5437ee46bfcb3b75485bf889687f6c9a92d0be85e9c246", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013393, "uuid": "aab4a73a-841c-4ae5-9d49-4b3965e964eb", "value": "T18A947C9238CA766FDC2F4934035FEAB62A755CE07382486E5F80361D5C3664A90EEDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013393, "uuid": "8984e30b-0486-4914-82df-4f7cda34848e", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013393, "uuid": "263d4bbf-b12a-4f03-bbcc-e386f29a0fb8", "value": "12288:Vc/nhe2eKvI7rjP1AOcrazuSYueW7+vrVb:V8hecvOX1Em1erl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013393, "uuid": "eb4d05c6-97f6-4aab-ab3d-5033ece2d0c0", "value": 437472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013393, "uuid": "f9fe97f6-2499-4b45-ad2d-e8f00f05fd1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013393, "uuid": "42b170bf-0406-4909-9714-ee2a1e55de45", "value": "Lull.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee804f06-e8b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683009501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009501, "uuid": "6232e75a-3bdc-4733-8859-8a16845f9543", "comment": "Malware payload (Gafgyt)", "value": "0dbf142d189a929a18957bc426345616", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009501, "uuid": "2d3231b0-1e85-4e13-bb8f-8476f7b306f6", "comment": "Malware payload (Gafgyt)", "value": "d9d658cbb94d6971a557880a3301ca94598a2c9459aaa190fb1c2604c971b00e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009501, "uuid": "66ae3801-b610-41e9-9cbf-c458cc17cd4f", "comment": "Malware payload (Gafgyt)", "value": "f31b8994614ab6c3b121ba94b454baf02032ad73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683009501, "uuid": "df1d7609-9694-4839-a08a-512c044b1613", "comment": "Malware payload (Gafgyt)", "value": "e22b12a83c1de2b16d36b9520631ba446a45bb4886c75783e6483619be3e98292235b1a87aeb5cdfcdefb3f30dc1f9a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009501, "uuid": "e2b6dd0e-8959-4fc1-8b3b-f937af5691fb", "value": "T126D31A24E4104737C2D2177EB69E954D3F321FEA93877315A6347BB41FE2B9A2D26820", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009501, "uuid": "ba08db79-088b-4e9e-87b6-12e324094902", "value": "3072:YUWx3caVhP3kfI+OQyJq0qz61HQ7kmhxQ5obxUNu:s2aVhPyyJq0qJkmhxQ5obxUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683009501, "uuid": "ef0c26bb-48a3-4a87-9eab-4492013eec2e", "value": 138930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683009501, "uuid": "bbe30cda-997f-4451-8d6d-1e2953ffc212", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683009501, "uuid": "7aa44f63-2b2d-4932-852b-2b792408db18", "value": "0dbf142d189a929a18957bc426345616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02744480-e8ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683005669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005669, "uuid": "d62c09b0-d274-462d-ac4e-1e61c18fc69c", "comment": "Malware payload", "value": "5d7b0ce4bb8517f1203e75453adbfef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005669, "uuid": "aad45789-2971-4b55-b60b-fb0cc65d8aed", "comment": "Malware payload", "value": "d9d7621fa407484ae3bc8a081adc30da87de065c8345bc1145c05a6b5805c5dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005669, "uuid": "57731dc2-8d0c-4e04-95eb-632b47864722", "comment": "Malware payload", "value": "9a5f40375ad9c8db34d5907f92cdceab444d2eea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005669, "uuid": "1b1a31ad-7877-4779-9ee6-61aca6ee91ad", "comment": "Malware payload", "value": "ba8614c50f0d9302adcac15f7eb60690b6649a4ee870b8d755e91ee6967552bae6423bf37bad6b89a6c16f464ff09499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005669, "uuid": "cfcd3b80-8c6c-423f-8ee6-eb3b339df0bf", "value": "T1DC54132013F5959AD4635EF269BE1A776EB9AD5904B0A21327C0270DBF40343DF2E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005669, "uuid": "7705b657-6244-47b5-957f-c84753f27fa8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005669, "uuid": "7b5e50f7-07a5-42a2-bc68-83897639c277", "value": "6144:DYa6QMnN+b2VDJauXw7KcfONarYSGUICZAYMGwK26+OtU:DYiMN+7qXeoUICZ5MGUOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683005669, "uuid": "fd06db29-422e-41c7-b278-766aa3314dbb", "value": 293877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683005669, "uuid": "c9f2f8c8-6a15-4b3a-ad22-e570fd65b56e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005669, "uuid": "356598b5-3583-47cc-8f20-a846d134fa20", "value": "SWIFT COPY-345655445566544556_pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d25de0-e8d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683022771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022771, "uuid": "a51867ac-8dfc-4efd-a9c1-19d280829c06", "comment": "Malware payload (Formbook)", "value": "e53804e1c5cec72d938424d8a07788f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022771, "uuid": "1876360d-f490-4479-8003-9953f29d3048", "comment": "Malware payload (Formbook)", "value": "d9e6629d10acc5f2c14986434a8ecf599c025ea5250015cb15dea536f05b61e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022771, "uuid": "2081cb5f-5c4e-450c-b19e-bd1555de9b69", "comment": "Malware payload (Formbook)", "value": "09e168d35f269c613e45e1f898270a1b07493cc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022771, "uuid": "ae03471f-6657-49ba-acb0-3b289b3c398d", "comment": "Malware payload (Formbook)", "value": "646e882ec763c698fca72b729e4e7df7f71012dfe81049973ea3d6d862290701f353a2243c8ae6b72f928aeec1928552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022771, "uuid": "a6712c69-a9ca-4952-8e0d-01260058497a", "value": "T1ABF48C382B7B1FA6DC78DB77D6646416B3E0F56AB21DDE293CD610850A0380375B32AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022771, "uuid": "532bffdf-6fea-472f-b9d8-0e1e6c55f3b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022771, "uuid": "ebcef4c6-4bb3-45bc-8937-d9423d9b2150", "value": "12288:qKVC6YN1Px+70pKXQlIj5g15HFuiXRjr13VLHQ7J3A3i73SJXC56Aqgcx7Tx8Cl4:bZ5g1buWRJNQ7CDlDxHxFJoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683022771, "uuid": "9bdc00b5-39a2-427b-99d5-f75df22e6e81", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683022771, "uuid": "fcd94090-8b53-40b9-913d-20b44650df18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022771, "uuid": "880e4da0-5a2b-41e6-a08c-4511d60dc52e", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5ff070-e925-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1683058297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058297, "uuid": "70eba1b9-0759-4032-a65c-600252f67a5b", "comment": "Malware payload (AZORult)", "value": "5a9be1888d9aeae7dbd8858af046883e", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058297, "uuid": "b3e9e3d9-6c0d-4240-91f0-c505564adc3d", "comment": "Malware payload (AZORult)", "value": "da9c1fd728f0220f57a8fcccd8fc75662d81f4855c66b99e2ba14e4c808c8750", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058297, "uuid": "c4af6d55-f270-4e43-ab08-f8597fcb4c7b", "comment": "Malware payload (AZORult)", "value": "5431c2baf4f15c2a648873c46c9816d5b7dfc062", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683058297, "uuid": "d1bf5a83-798d-40d1-891c-c03a22c904b8", "comment": "Malware payload (AZORult)", "value": "c8aca462f1702a1f76bbd98d85fac6844097c89d730fb102e5738479a48547837787b695d0f4bb453c192737ecc84c64", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058297, "uuid": "ce1c5a18-acc8-4f15-a3e1-d9231fefbe62", "value": "T1515423541E9C1DE719B9B450BBC9ADBB1E27ACAFA8C280F70255F18067E07C30E4ED59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058297, "uuid": "8a3702fc-4d2b-42e1-bbf7-662a76f43492", "value": "6144:YV7T2zLR9T88PsZS/43LR9GqVVGUYklJBZojBXweMvUik30v7JakPa4:gCgUkS/wL77VGoBZoVwjrTEkPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683058297, "uuid": "f86dc7a6-4b57-423b-9186-8734083859d0", "value": 297541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683058297, "uuid": "309f3c26-49f0-45a5-9d8b-988c95e1e608", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683058297, "uuid": "5af23bef-7537-47d2-b4db-fc9062c110f2", "value": "SWIFT COPY_1.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b53f4f-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683013374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013374, "uuid": "389c2c0d-0a19-4b04-8998-ba338850953d", "comment": "Malware payload (Formbook)", "value": "70bb5402df7e843e041a4812dfe98516", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013374, "uuid": "ff2a9a6e-6f55-4394-9085-6338b8854dbc", "comment": "Malware payload (Formbook)", "value": "dab33bfe3c4029b76ac650468368545a771cd5c5b98321bd819c176946e09f1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013374, "uuid": "3bf35b23-f689-44a4-80ef-55857d1a3d5c", "comment": "Malware payload (Formbook)", "value": "90f1eb68ddbc78710d5018ae07f71d637b70204a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013374, "uuid": "412176fb-d419-4195-8f97-ab62ed2a6676", "comment": "Malware payload (Formbook)", "value": "200a722c19a7cbf58d3056e27722ff6219e337777c1d790779145bb177a0f93d03664687d91db8e8da719d6489e658bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013374, "uuid": "2695ccfd-d149-40a1-82e3-ce23edf1c4e9", "value": "T123049E32DA41C031E2B252B5F6BD1B7B483D0E353255A4E9E3E216E06FE45A5F42A31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013374, "uuid": "8788e2eb-e70d-4442-8af9-43ae05c1c813", "value": "3072:7Oj7kNohQLst13cv4+08HKmU3EtfdJidSGOdLHF0yBODDnh:5oZcw+BHKmU3Etfdk8dLl9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013374, "uuid": "856e3fc6-366a-4b31-b18a-b9bd3f4e494a", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013374, "uuid": "04058552-14d5-4ce9-9ce8-8dc17995d43c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013374, "uuid": "0f20be0e-e0f1-4cff-9707-68b6bd9a32f0", "value": "dab33bfe3c4029b76ac650468368545a771cd5c5b98321bd819c176946e09f1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b5e462-e8de-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683027597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027597, "uuid": "405cb66a-2298-4efd-bbaa-56f536359ab3", "comment": "Malware payload (Formbook)", "value": "e565eb54f3946e60873367da9405317b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027597, "uuid": "7a934f91-d65e-4ecd-b45f-9f6c1f4d94bd", "comment": "Malware payload (Formbook)", "value": "db29afaa6283ad55b4fc9abb4def3c06a8e445fc110b112408aabb3937432822", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027597, "uuid": "77f14111-73eb-41d8-b036-cd7ef385a863", "comment": "Malware payload (Formbook)", "value": "88d15f13340db7219c54ddac2bf41b79a200f208", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027597, "uuid": "fc8292ba-24c3-4e68-8039-2558ae10418d", "comment": "Malware payload (Formbook)", "value": "6f4d0f4c3eba70fcfa59a8d66237c22bce228bb10815b6f2ae37d8437a6424bd607f93c2c6ad0b0cdd6a7d442064c8de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027597, "uuid": "0dd5e066-b5e6-4d42-a1b0-220e7b4ea56e", "value": "T1FB4412807FF9C4C3E46387713E3686765EE9E83620E4564BB7506F067A791608E0EB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027597, "uuid": "3858742c-ef39-4498-a714-f4f0d9e5d8de", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027597, "uuid": "8f1c470e-51e9-4978-8a0e-8308e24e1620", "value": "6144:/Ya6oaG6ec/h5g8xYqbvP2Q1lWMEaZrWHRHpwQ0WgT3:/YWaG9c5ZYmpEMRZyHRJw+c3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027597, "uuid": "eee80b31-5205-4c2a-b0da-808b107998b6", "value": 260957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027597, "uuid": "8aa86ca7-f1a9-4360-89db-15a7e86d7174", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027597, "uuid": "304feca1-5699-4d6c-aef9-dd06d30db6fd", "value": "dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8b2dd7-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683013420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013420, "uuid": "bb4ca69f-f82e-49b4-9ed7-a46a612d8658", "comment": "Malware payload (Formbook)", "value": "4db9b09ad19fb2759956321f9b19f4a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013420, "uuid": "9d9ea34b-b582-4a1e-b2e5-e020d7f1d079", "comment": "Malware payload (Formbook)", "value": "dc353de8e426e5a5934ca6cc0a3c164a6ac10599fc6341db12a9f7e7d3eb5f02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013420, "uuid": "e62f1825-6e9a-44a5-932e-8d685aab7e6c", "comment": "Malware payload (Formbook)", "value": "63724d11860eb401b090ed3d136ee303b5a90ebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013420, "uuid": "e23dfb21-efe4-4898-9f9d-401cd8645567", "comment": "Malware payload (Formbook)", "value": "436a7442c80b17cab61e46e4c62ea9dc3505c572823ffd0d26509e02d818b53fe8380d718993a2e5686fe5f9cdde858c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013420, "uuid": "dfe536a4-b143-4dc8-856d-37d7a34254a6", "value": "T157D4DF1221A9CF5AFD3A9BF25474FF8057F1B573A4E1D1221EE624C9DA69F000E0CA5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013420, "uuid": "96628045-ea36-4cbe-bf2b-dfc213db7cd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013420, "uuid": "9fb4adca-cc29-4633-93e5-2e6fc1ee4f47", "value": "12288:3zmClH52d04CP9fo0EF6CZ/CmgWv6Dsr4Jg3nLqg6KjiZTeG:jmuGKVo0EFnFBr4y3n9viZTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013420, "uuid": "6a170af4-43c4-4f06-af63-4e41ce4ec2d3", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013420, "uuid": "b205cebf-fc79-40b0-9279-dfc1b8c7841e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013420, "uuid": "173f7dd8-02cb-45ef-839e-13b16d25b6aa", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f038e9-e91f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683055874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055874, "uuid": "f4cc10cd-e1e7-4ff5-9345-5383bec96d0b", "comment": "Malware payload", "value": "19340e33293b639bbfe02140f8749898", "object_relation": "md5", "Tag": [ { "name": "0-tcp-sa-ngrok-io", "colour": "#04A06C", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "Pjoao1578", "colour": "#C683B2", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055874, "uuid": "dd45eae6-61d9-48c0-add7-e22f69b8d76c", "comment": "Malware payload", "value": "de5fcbc819ec322d272fa837ce4687900edf001801f112d948e1e9153b54ace1", "object_relation": "sha256", "Tag": [ { "name": "0-tcp-sa-ngrok-io", "colour": "#04A06C", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "Pjoao1578", "colour": "#C683B2", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055874, "uuid": "db0e4eb7-e8ae-40fe-a07c-178f1a45d574", "comment": "Malware payload", "value": "c4cdfe28f4f6df7f466fd1003ba69be2b7c415ad", "object_relation": "sha1", "Tag": [ { "name": "0-tcp-sa-ngrok-io", "colour": "#04A06C", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "Pjoao1578", "colour": "#C683B2", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683055874, "uuid": "e7871465-9f3c-4290-b42d-17efa1da7e07", "comment": "Malware payload", "value": "b9eb4b828794cc245550ef302e1e1b98c01cf2bb20e217b2fb4e131c0b933726829a8c26ea6cf4ec0070ff1dd82ca5ca", "object_relation": "sha3-384", "Tag": [ { "name": "0-tcp-sa-ngrok-io", "colour": "#04A06C", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "Pjoao1578", "colour": "#C683B2", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055874, "uuid": "760d9ac7-b8c5-4a53-b5d8-db620cc8bd17", "value": "T1A692C019895C32D3C436B17B64EF7D5B5467ECE09099D21A3662D10F933884BA99F08E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055874, "uuid": "324676e0-dca9-48e6-98d1-114be83f31eb", "value": "384:dXPtARUVRAdDSivl9m2u7q26MMUbcL7tXQNK7tEiyzH+m86rZYiC:VPtT3AZSid56qh/UbcSNK7+Pze6+iC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683055874, "uuid": "bb4ae76a-405e-4f7a-a7a5-76044b7162c3", "value": 19906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683055874, "uuid": "0372f245-afd6-4b31-ac79-0cf390312214", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683055874, "uuid": "85dff9c4-085f-4eec-bace-da35b07bbb20", "value": "Comprovante.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b432b95-e8e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683028501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028501, "uuid": "bc057aec-de5f-452d-b4d5-b11587ba5503", "comment": "Malware payload", "value": "bd5aa42d602ca678d0f63bb9303ebcf3", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-space", "colour": "#DF369E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028501, "uuid": "36d6e6ad-01c9-42f7-95e6-1687720d3ada", "comment": "Malware payload", "value": "de9071d310ee3a0850be73639e2af19dff7d5c2d105bb057298f55e8f63fb756", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-space", "colour": "#DF369E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028501, "uuid": "88a857b6-9203-4458-83a7-39d206b32c0d", "comment": "Malware payload", "value": "6ea0969cafce00f9971779e2e3a980a7aca4aaeb", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-space", "colour": "#DF369E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028501, "uuid": "2816968b-692d-4435-a32f-e198ca118b8a", "comment": "Malware payload", "value": "a0302d19db1d2f72dfabeaef5bc68f1727e29efe2a628c203a26912a960284c1d0495f68f564e9e9c2cd45ac96ec6b2b", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-space", "colour": "#DF369E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028501, "uuid": "2d428a1a-cca5-4447-9262-33dd51af0b67", "value": "T1B9173350E57C63726C85A365FCE7E6703858A07ECD8FC2D050EB52BAD3B4505F8EA4A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028501, "uuid": "c2e5f7f3-51b9-4c7b-a607-010a8185a61a", "value": "393216:KVkDvGyn/quK2fxqReUJmEkCxKGTz8HX0tOPXK37OirlaH3xGWgL:lDOyn/qujpqBrk3QyYTYHw5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683028501, "uuid": "85dc0b69-b7d4-4746-8be0-6cc5b2ad0095", "value": 18511161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683028501, "uuid": "373ae11b-fe63-4fa0-b310-26e6d12d6a1c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028501, "uuid": "3f951b5b-1b2f-40c4-9203-15d0f62f3fd0", "value": "Fortnite_hack.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb1e5a1-e8fd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683041150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683041150, "uuid": "8347c4bb-e736-42b0-9519-2bef7fac1c3f", "comment": "Malware payload (Formbook)", "value": "0657dda4137717c2dc9c4da12cea6b0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683041150, "uuid": "8b26b37c-ca5a-485d-bbb8-885704fc6d39", "comment": "Malware payload (Formbook)", "value": "dee9f9c3981971bad83e2d8e0735f699a74dfb1be01da7a7bf8b7dd584a731dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683041150, "uuid": "b76ef28b-d10f-45b4-bfd9-5fffa4df8d53", "comment": "Malware payload (Formbook)", "value": "56271588e5b2c41c888997cb03ad4fc505f60c1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683041150, "uuid": "cd56d302-41e7-4441-b00c-01217a0f8ab6", "comment": "Malware payload (Formbook)", "value": "0e0703122771ce18ac401b391efd2a00135038f8a4ad8f517abcce94050776b63408a08e887e0c1ef640d96c0b749ce2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683041150, "uuid": "455df0c2-c26e-4c5e-adca-2c519d617d26", "value": "T1D4159EAAB4B950EFFC37C532A2E080474A2C7EE51A51851CF9A77CF90B749149CD27E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683041150, "uuid": "bd2cfe35-8fcc-4503-bd7a-0b611d0c3077", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683041150, "uuid": "36f21661-5b8e-4a65-8687-2dfa2ad7518c", "value": "12288:NUaQrLlBMvn3vaauNdlddJylHx9eYYwxCLo9YVWWdBwWDO0gOxwr:NUDLkvn3yJPddQeww0YKWDO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683041150, "uuid": "9af70225-5148-4ec9-b8c8-9c1f0a83ee68", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683041150, "uuid": "7ca650d3-cbad-4e0b-af00-0e7b03a79335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683041150, "uuid": "739df301-d5bf-4b40-b29a-78999ddae256", "value": "PO28511059.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a674a027-e8dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (StormKitty)", "timestamp": 1683027419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027419, "uuid": "68c37864-b6e4-46e4-97ff-ee7dadcdbfd7", "comment": "Malware payload (StormKitty)", "value": "dd74d403b3ba8fcef882c001d5b66ad2", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027419, "uuid": "efe9b2c9-98a3-465f-bbe0-694425b4e134", "comment": "Malware payload (StormKitty)", "value": "df4406a46530428037161ec4da37e8c0cc20fb58f772f1c05af031caf1741a84", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027419, "uuid": "9969b329-fb0d-4aa6-9c81-5d913915572c", "comment": "Malware payload (StormKitty)", "value": "a548bf5ea57b1cb0e4bab201e3c02c0fe4dfb877", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027419, "uuid": "6779bfb1-7478-4df0-a16a-2856fd1da1f3", "comment": "Malware payload (StormKitty)", "value": "5c6e6eae4f9d7e9451e3b3a5973ed233a9cee3a2aee39416a3080da772062f729fa264c979a22df8c88475a1c45b7493", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027419, "uuid": "3fc58e44-ab30-4dd2-b47d-854f7fbc4f56", "value": "T12B61AD1447E6020CF3F3AB3A69BE62554E3B3946AD31C78D0059814E62F1A40DCA6F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027419, "uuid": "8a02727a-df5a-4905-98d2-df4785c99767", "value": "48:8v5aFU9Dmel0iglZ+nLLpQfYj1sAT1rTRRSJxodgIZacRE:8v51B0+nn6YZsErTR0/yg2dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027419, "uuid": "a18f55e4-dc89-4e74-b548-faaa002b00b4", "value": 3442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027419, "uuid": "5e97e349-9877-410c-83b2-ce18c31c9f26", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027419, "uuid": "711b0561-ed14-46fb-8544-98ff043b1417", "value": "hesaphareketi-01.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1861354-e8fb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683040403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683040403, "uuid": "c1f28098-a477-49ca-9b37-232bb7aca185", "comment": "Malware payload", "value": "ad291e12f40e86409a24ede4f6903de7", "object_relation": "md5", "Tag": [ { "name": "1683023161", "colour": "#2C91A1", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683040403, "uuid": "6d7c5d51-8143-4f75-bc3a-0e59ce6821c5", "comment": "Malware payload", "value": "e129d7e093e1ab82b09c0b4d9c23f71ee8c50bff17ac9f9a2bc71fec053fd3e9", "object_relation": "sha256", "Tag": [ { "name": "1683023161", "colour": "#2C91A1", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683040403, "uuid": "1afa1b55-3bf8-4972-8295-b018e7730e47", "comment": "Malware payload", "value": "6f917fa806bdba2a2a99cca578e7b5f5f905cb0f", "object_relation": "sha1", "Tag": [ { "name": "1683023161", "colour": "#2C91A1", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683040403, "uuid": "cf3bb19d-ad69-4313-85e8-a6805dac2635", "comment": "Malware payload", "value": "732fd87df5962126a815176835826fd7a27b8550909ebdc56267f6dd97a30067ce7f23e31a24dc77174b076f9caf3dce", "object_relation": "sha3-384", "Tag": [ { "name": "1683023161", "colour": "#2C91A1", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683040403, "uuid": "1f6c1e0c-0741-4f08-9f53-ecfbaf26226d", "value": "T1DB72D0F5353DA85CED656539B96A23A0BBB7D2482E0DC01833D02E35D0BC5A8F27F616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683040403, "uuid": "cc19ca0d-3ede-41df-819a-494432332d6d", "value": "384:Now6iaMGvuhcEhxdNKHGWaTnFLmebSpVigfbQ7xqiGb:N51aHuFdN//nFPuVbQ4iG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683040403, "uuid": "0673d3d6-715c-4371-80d6-c49347ad2932", "value": 17124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683040403, "uuid": "47d48312-f722-4af6-8230-b5abe6b28b8b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683040403, "uuid": "b291568f-33b5-42e2-9736-baf123ab8852", "value": "A104.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df86f85-e8be-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683014037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014037, "uuid": "1937ef94-37ae-4c97-9ea1-4f687ae527d3", "comment": "Malware payload (RemcosRAT)", "value": "765e838105b7c2f6937d93f94336400f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014037, "uuid": "a3cfb2ad-c0c6-4c76-84e3-be1857369786", "comment": "Malware payload (RemcosRAT)", "value": "e1e5649b11992bddafd4ca3b16396043eb4049b58c7500237fdd307a0d414102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014037, "uuid": "9c93876b-9a3a-483b-b690-ae5c5fdb13fa", "comment": "Malware payload (RemcosRAT)", "value": "349cd40b0d346a164d68665a1a81f8233d482d81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014037, "uuid": "d3f3d243-705c-41d8-b82f-802d946ce951", "comment": "Malware payload (RemcosRAT)", "value": "a8066c3958cb227f9d12f79b794846c6cd1a7c8d47e125b84e75766f5795073ca4a0ee03bfc767d04e57781d0aeced81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014037, "uuid": "f9f683bc-573a-4ba8-b02f-73e3880f28f7", "value": "T101020920A7E88576EA724F36A87F52800378B7709993CB5D64C4300F9EA27714F627B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014037, "uuid": "af68dd43-b20e-4d66-be69-f9fe8352861e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014037, "uuid": "6becdc06-704e-4d4f-b2d6-a4b6de9b2962", "value": "192:KjfON+D5LUELalfNXTRe5YqM0UP8mmILgmNfDTgP6F:BMLUELsfNXdPjngP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683014037, "uuid": "714fa6ed-5599-4af2-8fe0-a2d9a18500e9", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683014037, "uuid": "2a385f5f-c3e0-4f5b-aead-f12c37fab515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014037, "uuid": "23f4ee09-a2dd-4209-8415-710b5499758b", "value": "AWB25637373283GT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb98621-e8e4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683030200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683030200, "uuid": "9166f8a8-bb72-44f7-ae89-a5f6e35c0919", "comment": "Malware payload", "value": "e11017936a9f96ca5452d1cca21ea0c1", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683030200, "uuid": "364fa9ab-9153-4c21-be62-2ac9ee36f256", "comment": "Malware payload", "value": "e1fa7e2d5a93cd76599efbb63bb2a08eaa0232b2a0bcfbda4ed087e18c62dcc3", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683030200, "uuid": "f5876af8-49b5-44fb-99e9-37a03137e0c7", "comment": "Malware payload", "value": "bcd5757ecc5960057ea44751f76cc8c3d62508a4", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683030200, "uuid": "c94982f9-aa8a-470c-ab00-dfd3fe8d7dbd", "comment": "Malware payload", "value": "6ffee105960ff39a3519b6ac6b7918de55de136f55325015f41b393dc54e23e494c5a6b1468b772a5cf21bfea28735e0", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683030200, "uuid": "8000cd25-1651-4af3-9200-951532388822", "value": "T1E9C52339E8013A92FD9DD9700AB04DB446E06E7C07AF96C11370399F9AB7E5C9F38925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683030200, "uuid": "03db4b2f-efdc-4940-a556-2d299e560884", "value": "12288:Vaz/dhJrxJXycsg7qNJ/8g33RXeKjwuhGo6XocawQIsBDd0t0looUGXNj3q:V8rtvXyNMk+23RXxhlHcWrwqVXZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683030200, "uuid": "d8048731-ce1f-47ba-86ab-fc1b9f6239f0", "value": 2668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683030200, "uuid": "b352fa69-c6b0-40e7-896a-0eee5aa9c19e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683030200, "uuid": "4867a23f-657c-4557-9e5c-8daa1e87d567", "value": "bin.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443c0509-e8c2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683015658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015658, "uuid": "4018ee38-49e7-40d9-9fa0-442a7296ea76", "comment": "Malware payload (AgentTesla)", "value": "5bbcc8d841ef5e7a419ebacfbfffa60d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015658, "uuid": "bde79b4b-4110-4e73-8959-3afa68c60467", "comment": "Malware payload (AgentTesla)", "value": "e2cc887397df4de0c525052454948bf172da7d320f757c9285fe88b5b825dc03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015658, "uuid": "6a734865-2cf4-4459-baaf-ab847991375d", "comment": "Malware payload (AgentTesla)", "value": "79eb53194d9291ecafc8ce341f713bd82aeb2246", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683015658, "uuid": "a5c7924e-9767-44dc-a87e-c83174507d5d", "comment": "Malware payload (AgentTesla)", "value": "80dd59c8aaac56aadde181aaa4fce67774d953a88b253c17ede1cfd76fef264635c5c93dc41daa83a038f884ec35b6f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015658, "uuid": "5176a345-dfbf-48d4-a704-76c1cbc78414", "value": "T1C0B4237C0C3F7EE7666B156F1D80D3A16018573692D3770344ACA4F99E3D0BA69B2398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015658, "uuid": "8e448eb2-a139-4abb-8d2d-4abbbc82a669", "value": "12288:ewThmnaBsD2lhu7rV8lvWj3fcC3O8TJb0uGjQJfyQqwtiJeUg68cQ1E:ewThmaBsDAurovWj3ftdb0Ehtr7Ug691", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683015658, "uuid": "42959582-8829-4dbe-8282-e8fa8c4c972c", "value": 514320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683015658, "uuid": "5ad97395-4885-4403-af12-803561579128", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683015658, "uuid": "4813438a-bc1e-4846-9462-d9ca9ba8b278", "value": "Amended Order No. 60-230235.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ee1aea-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683013426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013426, "uuid": "34c06595-340b-4d5d-bf35-4c91b672e770", "comment": "Malware payload (Loki)", "value": "2bb65038b6891ae8f0027e704ea4c6f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013426, "uuid": "88d788cc-5956-4c8c-959f-6e19c5b740a0", "comment": "Malware payload (Loki)", "value": "e4309bb40f85612ab36c291d95a3846033b1e5b0125421fcdc06feed071e239f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013426, "uuid": "9d05e399-6d2a-4af7-819d-acb1354895c8", "comment": "Malware payload (Loki)", "value": "48079a6b675b009446a95dc61d0c0c1dbced9948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013426, "uuid": "27bf8877-4350-41c1-9db0-ce27eba567a6", "comment": "Malware payload (Loki)", "value": "094013265af5d4cf04bbc3423ebc440b55bfdf6f3a157008699d34a55eee3f25f5847e44f6982ccfc7ff8ebab382d5f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013426, "uuid": "f0472242-eccc-45dc-8ff4-0fcef5803114", "value": "T1FBD47B3976F0A372D871053227E5C2385AE42F68CEE1C74BD2B01A99B720DC53E5969F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013426, "uuid": "11b2a8f4-454a-4858-852c-4ad785e6f6b2", "value": "e92b2275a730f59940462780c383a1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013426, "uuid": "0f956d4b-4699-4da9-9e8f-c9eb0a6e5690", "value": "12288:4qUyZzjn9co0du/nf1GSQrkNB8DCvldiiQbJ:XdZKo0YNGS+PuyZbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013426, "uuid": "350ae380-c759-45fc-b3ed-6e534a2014e1", "value": 604201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013426, "uuid": "52bd5b07-84c9-4ff0-bc7e-80a25c2127c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013426, "uuid": "20cdaf18-3e55-428e-8baf-c88b95e70ac0", "value": "\u0417\u0430\u043a\u0430\u0437 \u043d\u0430 \u043f\u043e\u043a\u0443\u043f\u043a\u0443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f404d34a-e8ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683006074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006074, "uuid": "7b588a2a-ac6d-400d-9c1e-0cc297d61211", "comment": "Malware payload (AgentTesla)", "value": "77baf5acdf30b2febc109770b1583452", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006074, "uuid": "0dad7f45-4846-4a82-b0e3-4d728ad2650a", "comment": "Malware payload (AgentTesla)", "value": "e446bfc6a1d4e343f6840965abf9d010f5c32e06b188d3d076fd2e3e0b0bab79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006074, "uuid": "f53686ec-6488-4c36-bb9f-adb82feed7a4", "comment": "Malware payload (AgentTesla)", "value": "d8c9040d6a9610e0e7433dd3efd7008bf30bc9e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683006074, "uuid": "76a91e07-1fcb-41dc-a2b9-36905a2046c2", "comment": "Malware payload (AgentTesla)", "value": "b885e599c7c1cc3f6e17dcecdb3a3fbf65ca0e0bdc31fefe5dd780b5b1ca2e287071fafdf91ec9002b70afe0c6e00f3d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006074, "uuid": "d2c8b66b-07bc-41fb-b07b-c175ef88e593", "value": "T132E4CF0221B4CF26FD39CBF41468FB4427F1B07B14E5E1681EF6A0DAD965F040E65AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006074, "uuid": "79f365a3-c050-4024-9841-d5758a239f0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006074, "uuid": "3ac6a19f-4306-4d06-ac69-4f31cf1392c8", "value": "12288:M+32iNvSauAR1rR08E3BPQ9Qo7UXEpn+rGPgv4:n1tSauARFa8E3Bn6n4kw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683006074, "uuid": "faeb0527-0be1-48e9-bb19-357b782cfa96", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683006074, "uuid": "bef1c545-60ae-45a8-a10d-466236d0ea67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683006074, "uuid": "bb73605c-3dde-4ce8-b9bd-d4ecdc2ee38d", "value": "TAIZHOU MACHINERY CO.,LTD QTTY (PO#7A68D23).pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b97723a-e8b6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683010409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010409, "uuid": "ba1bda9b-8f1d-478d-bda6-b782a6476f90", "comment": "Malware payload (Formbook)", "value": "92db7e5f0ba46963aa610f48ed3f0f61", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010409, "uuid": "7893b8a8-1eb3-4507-b127-28d1ed5b6efd", "comment": "Malware payload (Formbook)", "value": "e4e9832c1c93de38ed3cc9626dd409653a57268060ae0b0c356a808a63348bd7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010409, "uuid": "d2201bee-b381-49f4-8223-cbbd73b8234e", "comment": "Malware payload (Formbook)", "value": "e7194c07e8d2d04aba8971c8e9c56ff0ad700d53", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683010409, "uuid": "207fc478-0cb6-4023-a603-29a133919cdd", "comment": "Malware payload (Formbook)", "value": "b4b5dbcd8f2fccad91c639a361cdbb145318b4795850b0716332e920594e2c6938ac2afc29abbdbcdad25cfe84493cd1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683010409, "uuid": "6fde7147-1824-4327-89ee-3f7b10bbb0da", "value": "T1D445CF4162A4CF6BF939CBF04464FA4023F2BC6B54E5D1291EFA70C5DAB6F010E6496B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683010409, "uuid": "eab48f10-38ae-45b4-b333-981c15273a0b", "value": "12288:Ia2iNvy7i4/x0w8+/GVdNyDxRT9dg4VGM+A4neSPmDTKKzy4rGn:51ty7MBNyDX9ZG9AOeS+qKzymy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683010409, "uuid": "a069f5f3-3280-4673-9f69-39d30774f721", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683010409, "uuid": "510b0d6f-b65a-442e-9a83-923d5b809e16", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683010409, "uuid": "295e96df-b9cd-4eef-974c-ac6cb24c291f", "value": "OVERDUE PAYMENT.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34dba6ff-e8e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683029806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029806, "uuid": "e23009a7-17e3-4f29-b22f-ed7258d9da87", "comment": "Malware payload (AgentTesla)", "value": "b97aada19fe2209c3fb0b4500409b67b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029806, "uuid": "bdcc5608-749d-4207-8183-0325f0a02e96", "comment": "Malware payload (AgentTesla)", "value": "e594f4113c4a110d4da926cbe62dc968a51e854ff346292e3156fd354f2e041d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029806, "uuid": "91c6f578-abf1-4f8d-8243-61cecc69e596", "comment": "Malware payload (AgentTesla)", "value": "9f2e99bd1c80df75e23f61e25db7b68e05854800", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029806, "uuid": "3f8660fb-a0e3-4684-bf33-b06f248b9d7b", "comment": "Malware payload (AgentTesla)", "value": "e97ba6bd868f6daaa94a125f2cae1e8fc5bfd63f643b39908d56abe859a7fdd1c1ebdd67a79af3335ab0023f53d4f430", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029806, "uuid": "c65f46d7-d059-40bb-b16f-c6569e294ac4", "value": "T159E320D2B5045994EC663A7244379D740163AEEDA8B4E70D60ABBF237FF32831427987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029806, "uuid": "8f85a3e7-320f-4406-ba43-63482703fdb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029806, "uuid": "0d8ef1a1-953c-4098-a871-63159e86a4d4", "value": "1536:XgdoFYy1sRWQm41YjJKqdMYIYG9g5mYz6MGnxCikFy5e2Dos2TGSW7zwV2111x:Xgdop1id+MYIYG9L/xkMLUs2XWXwVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683029806, "uuid": "0035fbb1-5103-4d80-b3be-935908500351", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683029806, "uuid": "65aee58c-3100-4aab-ba7c-a14e416edd99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029806, "uuid": "538cba99-af45-4ea3-9446-41a576c128a7", "value": "Booking_5136_05842pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a03858-e8d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683024191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683024191, "uuid": "8afe1b82-c583-473f-9c2f-263ef7c47c4e", "comment": "Malware payload (AgentTesla)", "value": "9ca3da634d0eb072fb9eda171c159020", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683024191, "uuid": "44e43c10-4838-492b-8617-d6e367578296", "comment": "Malware payload (AgentTesla)", "value": "e621a773ec75f605fe4780a380817e3dd7125e04d0e97009413570a9babb4d94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683024191, "uuid": "b6982532-ea67-4c1b-91b7-b7f7308f20ec", "comment": "Malware payload (AgentTesla)", "value": "f76500bde56036150abe4a62a3a96eddf816ced9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683024191, "uuid": "70d9a065-212e-404f-9c5e-f5958ca5b0a0", "comment": "Malware payload (AgentTesla)", "value": "0df7d51a80d8691a6c41a8d875f6fd6afbd577906951c7af1e9d9e5d6810bdf43d31fbbb0bb617a3a1007f63e77baf69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683024191, "uuid": "37613e64-4e3b-4ce0-ba11-71d4134ed354", "value": "T12E329302EBD5D9F6E3614B759CB373404A78A211EC92FFAD4C85413B4D2A6C20A726BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683024191, "uuid": "7de0f738-620a-4df0-a6ac-1f6ec409b9e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683024191, "uuid": "2dec1a41-dd4c-4eb0-861e-4e442fc6463c", "value": "96:+H/TbfOHhQLfoXtdoLfqJIVx92R5BzS6JNeGzIPAi/dwdBVpTGr0D1UkDMm883Th:uvfOBCfIGLyWVj2fNSrcI4O+dxGNkTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683024191, "uuid": "4dc9f714-f26b-470a-bb68-a889b7fcf4cf", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683024191, "uuid": "006c2c8c-c44f-46c7-b93a-9dc64ed1fc5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683024191, "uuid": "6868dd0a-6498-44ee-9532-cd18219569d5", "value": "Quotation_W230400791801.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00809596-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683013397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013397, "uuid": "d1502919-d1d2-4016-b075-a3fb41e052a2", "comment": "Malware payload (AgentTesla)", "value": "0321ca8ef48bf726014b99c0995f631b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013397, "uuid": "1ed23962-eea5-4e85-9c47-01a65d860884", "comment": "Malware payload (AgentTesla)", "value": "e710d551910b6751fc61ebe64138b020526a8d6d24ff282c96d7f74249da0a5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013397, "uuid": "d0d2f6d9-1441-428b-906c-7ac0513fe532", "comment": "Malware payload (AgentTesla)", "value": "096ce875243bb253cf37c164d1fa5976478483ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013397, "uuid": "31409cfd-3455-4a9d-99d5-2b3e0ea46fca", "comment": "Malware payload (AgentTesla)", "value": "8e4f81a0731dc2dbca1889226bd76cf89825198fb17cdef0b967b4cf73f9a9eecf77e9cc01141ec46db14ed773e46454", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013397, "uuid": "7f4d0254-bb79-4844-b7a7-d2bd2dbb77a4", "value": "T15DD49C535065CD0FFE2AEBB095B4FF55A6F1F07324E194242BB821C9CBA9F021E4D52A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013397, "uuid": "b7462d01-fe44-46fb-99cf-8cd3ceaff9e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013397, "uuid": "68b33a2d-dc63-4a18-827b-a683d6e4e88a", "value": "12288:iCpE3/XRQCFtQOF8zs5QGgaCmrl1V/QyNegQVtu:i8E35Bff5QGgaPlrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013397, "uuid": "0d429757-0a3a-4b26-9d86-40eec677b685", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013397, "uuid": "b3e3371e-e32e-4428-a200-d01bc346e418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013397, "uuid": "cd9afba0-7263-4164-90a8-2d26c787bbad", "value": "Nuestro Cargo Abono.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f202976-e8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683019515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019515, "uuid": "55960a22-b4ef-49e7-8c27-38d7552b1599", "comment": "Malware payload (AgentTesla)", "value": "c4e0b78dd0f4652a6f2ce5c1684d8779", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019515, "uuid": "25a51427-661e-4fdd-b864-9c3e85143c35", "comment": "Malware payload (AgentTesla)", "value": "e7ebcd95f56f4c089d56ba8519b2ef3abe3d765abbf56a9959071fe6914f16da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019515, "uuid": "f7866978-87c2-4337-b318-95ba27f9e755", "comment": "Malware payload (AgentTesla)", "value": "12e681cbd86074ec1f90a14b4e54d5c10b917075", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019515, "uuid": "e2113d38-84a1-48af-b0c8-f4b8696b7b91", "comment": "Malware payload (AgentTesla)", "value": "3596a156c0b4e8519c1ecb91b8a29fb551c5cb3b27777e32e53c9d8d63c6bb5cb3353e188972d0a55c747261cd84d131", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019515, "uuid": "a33c8a12-7c0f-48ac-9d16-8f4601abfbfd", "value": "T1BA151CD1A050CD5BFD6B4BF1A83AFE2025E2BD7E54E0800C1AB97656D6B3701249EE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019515, "uuid": "fb1feaff-f0f2-417a-9025-e1ba0d0551dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019515, "uuid": "a5aa6246-2c7f-4e0a-9fad-58e363acb622", "value": "12288:QJPkQegQVta0B+FF9SqPvpnqKun4pQqphicVuoTkbjOHpt3tB5:QJP708FmEq2QqphZuSkuJdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019515, "uuid": "d2ed5c6c-3ce7-45c5-8004-ef6799500e30", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019515, "uuid": "c73a55a2-dd29-4699-b222-763f04ff023d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019515, "uuid": "096d45c1-a9c9-4dd6-a2a3-4cdd5ecc3d37", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97db8ad1-e93b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683067767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067767, "uuid": "a93305c2-7e2a-4abb-8698-b849f75d0589", "comment": "Malware payload", "value": "2119e85fbbb936bc3d731c09aaf8fd98", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067767, "uuid": "f4d1814f-876b-4443-99d6-098aa4a7f8c8", "comment": "Malware payload", "value": "e7fa4545f52dcbee0f28d8782bb0aec2cbfa27cc164d9543c19775575cd96141", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067767, "uuid": "6a91f654-cb1b-49ab-be9d-05c6c1da62ee", "comment": "Malware payload", "value": "e4c45ec3fa9cb25dd301e8ad439fd3750905c2a7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067767, "uuid": "dfb8a98b-0c3e-4f37-a7b3-d4b5641ce5b0", "comment": "Malware payload", "value": "69c00fa3ad037765515146e111d6cec2d0f6e4d4e333e07735aabdbf31a27f4dd0a337f28aaa80740dbebef10d63269d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683067767, "uuid": "9440cb57-36e2-46bf-80e0-10d273a7a0a3", "value": "T12E0120E8373F9A568B602090E4386C94D85EC01C3184D790E44DE543C8A247147882CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683067767, "uuid": "0233c9e9-5b71-4e56-9ad3-7faaf2b4a22f", "value": "12:TMG4UoUWUJCSUJ8Qr16fA7RPsUS+ixku/3aSgYPsskKaTW4QonH1iDgA+uNSTjB/:34UMUJCSmn7lpuxd3aSg+AKu3nwgPuNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683067767, "uuid": "97aff063-6e16-48af-82db-684f15dd3946", "value": 759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683067767, "uuid": "fc3df28d-57a0-460a-a8f2-e59ca4fd7d58", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683067767, "uuid": "559847e7-719b-4089-bf9a-bb58e10449d5", "value": "ayoBRreIjJ5z36Tqa.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f391c34-e8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019542, "uuid": "bb262033-9382-4d56-bb68-433e13df92bd", "comment": "Malware payload (SnakeKeylogger)", "value": "7569dc2ceffbe1f1a9f058efcb490968", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019542, "uuid": "24070768-f9cb-45e1-ba77-391a6e36d8c1", "comment": "Malware payload (SnakeKeylogger)", "value": "e838f6eca8eb0add14d4bd5d0a4f4baaec9c4450540e099b09862fbc679486f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019542, "uuid": "cd6a89d1-9551-412d-943a-dc4205583bec", "comment": "Malware payload (SnakeKeylogger)", "value": "b3b46d8f6109581c68e76112c6a8ff240b13834b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019542, "uuid": "0b5d244a-a239-4730-899e-2dea3c53d8d8", "comment": "Malware payload (SnakeKeylogger)", "value": "2efaace6a86f5e003456684cd550c0493a3b556277ed8e17d001e3fff098b81d8730ea1d3de22829b2f8d0f9c8525122", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019542, "uuid": "53c7864b-d426-4fc0-84ed-3f0b94badf1a", "value": "T1EBD46B525065CE5FFE2ADBA18175FF95A7F1B07324E1D0201FB960C9CAA5F012E4CA2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019542, "uuid": "e83dc88a-4453-4e31-8127-4cc73fd44576", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019542, "uuid": "43d62993-56df-44dc-89f4-b95594472567", "value": "12288:eJPD6egQVtCPM3aoHHazzZ9R5Pg5pbI3:eJPuKaoHHwz95o5pbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019542, "uuid": "ce51807f-e30d-4baf-bbad-c03b04dc469b", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019542, "uuid": "e0ae4525-e558-4272-a45f-d5df84e1e58e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019542, "uuid": "20e6d2bc-5d0f-46e4-ad96-0005c612cb64", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c19c6a-e8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1683020595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020595, "uuid": "057a2464-4827-4be9-8760-489b7b8baef0", "comment": "Malware payload (QuasarRAT)", "value": "41e764117f01139d2facc1b10d29db46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020595, "uuid": "a8ca356e-19c2-4c76-b910-458409a9c3ef", "comment": "Malware payload (QuasarRAT)", "value": "e98d63fb7e1461f5dfc8b5f283aaa2a402f9f1f45b0e2453bff144956169c2df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020595, "uuid": "791d3572-1ae5-494e-b0e1-88f601b02f55", "comment": "Malware payload (QuasarRAT)", "value": "50f618073cfcb21dd5e6a8f39c858b4613faeaf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020595, "uuid": "f1ae3d2d-cbf2-41b3-a9c2-21e7cf924ea2", "comment": "Malware payload (QuasarRAT)", "value": "7fff7dc752e7e46a3c1ba7551c2b6dde4f59ed5beac6db8073be3cadef83b4bcd81f4a12ba5a1b6ab22c8f307feb24c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020595, "uuid": "87b15383-f5e1-406a-9858-d387cebbafbd", "value": "T1B5D1D605E3D4473ADBB60E7EA8B3B3438274F367EA578F4E4C80811EAD062D40A20F65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020595, "uuid": "2f97f962-e71b-402c-863b-70b93ef88d31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020595, "uuid": "05d7c43d-7ffe-4ced-a726-3d39090aa48c", "value": "96:JN7tLU+s9PofaG3wR4gDsteZX8LwtakKxwr0frrY6jT97BMebFnU:xLUsfnwLA4ZX8LTkKVfrrY6HJWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683020595, "uuid": "e12baf62-3d26-4ac7-aba3-0f50575245fe", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683020595, "uuid": "5fb01ddf-a94d-4b9a-8302-941fc83fbbe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020595, "uuid": "ebd91108-5f3b-4a06-8f2b-51d427a2827b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382b5677-e8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019503, "uuid": "a4b5fdc2-e55a-48bf-9503-0cf31fcb3d60", "comment": "Malware payload (SnakeKeylogger)", "value": "c7a4f00ca53bb629bd568a0e2a3b5f23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019503, "uuid": "b6ac676a-8b0f-43fa-850c-19ec896b62be", "comment": "Malware payload (SnakeKeylogger)", "value": "ea5ecd2fbfbc97248e315b602a26f9f9e7ec7e7705b4d536cbb2c10de76238b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019503, "uuid": "255deae6-e8be-419b-87da-80223080bbb6", "comment": "Malware payload (SnakeKeylogger)", "value": "6660e130cdeeedac1747eb469f4aca562b7ab415", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019503, "uuid": "2ba878bf-a7de-42c1-84b4-fdf7d06d145f", "comment": "Malware payload (SnakeKeylogger)", "value": "dee378246825f799596b6bef733d83ef80653b859b4a7e8712342189e08c1e3e1835a5b0db1eb2a8b317c868c8129dbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019503, "uuid": "f4548224-0923-4314-b189-a564cf7aa4ea", "value": "T1BDD45B525065CE5BFE26DBF18165FF45A7F1B07324E1D0202FB961C9CAA9F012E4CA2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019503, "uuid": "7ffbef69-6efb-4e76-b8d3-ceb6764cd017", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019503, "uuid": "8254ba62-f408-49f4-8c45-1ad260c3558d", "value": "12288:BJPAegQVtF3K4cvmLWX/fc5z8zOSDxwbPPvaEB82oCh1CE27L+q:BJPBK9v5sNoBCT6EB8QsE23h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019503, "uuid": "25fadacb-0209-42cc-92db-ae1d1c41f8b0", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019503, "uuid": "70d7460f-16d4-4ff1-aadd-70677b288aa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019503, "uuid": "8f4e51ed-1c1e-463f-be60-dc8a50fb3281", "value": "COMPROVANTE DE TRANSFER\u00caNCIA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b2fa7f-e8e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683029780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029780, "uuid": "1f4c2f39-b9ec-48a3-b0a3-4f928b28dd66", "comment": "Malware payload (AgentTesla)", "value": "a6da388caae761efbbbb197624dffe7c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029780, "uuid": "308715a7-d1b9-4de1-a08e-f5899b5d92c0", "comment": "Malware payload (AgentTesla)", "value": "ea9c43836863f74a0ea38ed27e6a24e3e4fbc5846b49b502af5505348d683eb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029780, "uuid": "47f86fe4-e10d-43af-87a3-60e7a263cc72", "comment": "Malware payload (AgentTesla)", "value": "84fcd734e52967727e17938c489e48d174e93720", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029780, "uuid": "e98a9b60-b55b-493f-acc8-50700e1af84c", "comment": "Malware payload (AgentTesla)", "value": "5ae7715b8c2073e0ba6fe05b3bdc18b3d812b1f5641bc5b553b0c26bc7122cc114e2375903644cbe0a5bee86d8c7d35d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029780, "uuid": "d707a5bc-6eb0-41af-bc67-6e727d25fed9", "value": "T1EFC1B405E3E84B36DFB38B7A9D73B3820274F3659A678FDE0C84451A9C066C91922F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029780, "uuid": "8795b781-5f87-45a5-b378-9a343872e102", "value": "96:Gx30S0Ez+szeofQkwM4gDBTCMHbQxKUKktakKxwr0fS649xFBbFnU:cX0EzRfvwMlNGhskKVfS6494", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683029780, "uuid": "9136d291-dd44-4307-ae67-513f6ac95655", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683029780, "uuid": "2388c29c-636c-431d-af53-14d7839e67ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029780, "uuid": "30291f54-5003-4e7b-9061-a01c8ffc1a53", "value": "NUEVA SOLICITUD DE PEDIDO567687______________________________pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51100df-e8be-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683014183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014183, "uuid": "524defaa-e56d-4903-ae33-d1c9dbad2f75", "comment": "Malware payload (SnakeKeylogger)", "value": "ed20ade737797c6335e1f87987e77e3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014183, "uuid": "b737aa85-4015-4f5e-97dd-11dd2d69b54e", "comment": "Malware payload (SnakeKeylogger)", "value": "eafd56c92c7688c8d00725285da67ada75e227750b9a6f5ecf6d2c0d90e8dc1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014183, "uuid": "59acc8d1-b0b7-43ab-bfb1-852d2ecbf7e0", "comment": "Malware payload (SnakeKeylogger)", "value": "7acc655b4f8bfd87ebbc176dfbe44056d5228da7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683014183, "uuid": "e6b3222c-27c1-4fc0-a3d3-37fcc1265c01", "comment": "Malware payload (SnakeKeylogger)", "value": "f12a1aa30791536a775098a7563a2b284cec534c11e5310e48fa2aee1f34686083986ac5c477051dd5f7092a1a2e8817", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014183, "uuid": "f2ca88ce-1eae-45c2-ba41-795957448025", "value": "T1E2052CD1A150CD9AFC6B47F16C2AB93021E3BDAD54E4810C5AAD7756A6F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014183, "uuid": "339f14bb-676a-44ad-a63d-3b688e94302b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014183, "uuid": "70146f05-2ddf-44e3-b393-c74939f30159", "value": "12288:siNX6f0jNr0WMMjvd3NCxlcCuVdfuJYZY:fqoXMw3sx23P2GO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683014183, "uuid": "14430c4c-9b61-43ba-982b-481c8b70336c", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683014183, "uuid": "2cd49cf2-3823-4fcc-b8e9-63c4e2f89050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683014183, "uuid": "5c997a28-b75f-46f0-9ee2-58bb7380a8e2", "value": "Hesap-Hareketleri-02052023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdc8eac-e931-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683063318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683063318, "uuid": "2f71c143-8c38-4519-ad85-7d4e1fac55e2", "comment": "Malware payload (RedLineStealer)", "value": "d1301a840a1eecfe0187553ff124afb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683063318, "uuid": "2f4e2f49-145e-4394-b3d4-f522311ab92c", "comment": "Malware payload (RedLineStealer)", "value": "eb05e3acd443e4138a6f57216d47e1572b363e03a285fbb078904be77ef69046", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683063318, "uuid": "e37d4834-48b6-4a66-a8ac-4060b996c272", "comment": "Malware payload (RedLineStealer)", "value": "402dfef6fd5828bb448fbd092c796f109012b35f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683063318, "uuid": "4e5ad9e7-8ae9-4a64-9e69-dd83f6d04e82", "comment": "Malware payload (RedLineStealer)", "value": "dd4a6db61c8c049f93fd5630dd1001c03566520ad60bbf8cdca4193a3581bf43653a066f9944f5fc5363d215959b4146", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683063318, "uuid": "c3aa94b8-1fd2-41ce-a133-ac04af13646c", "value": "T13F85CF3FF268A13EC56E1B3245739220997BBA61B81A8C1E07FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683063318, "uuid": "ab470164-6421-449c-a77b-906b9504259f", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683063318, "uuid": "ef6ebc41-2dac-46c9-b946-5938fe2e1e87", "value": "24576:s7FUDowAyrTVE3U5F/SGqKoKic6QL3E2vVsjECUAQT45deRV9Rr:sBuZrEU3yKIy029s4C1eH9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683063318, "uuid": "78693561-09eb-4c70-a3a1-92519329e746", "value": 1766668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683063318, "uuid": "b71a7358-5d54-4962-8e6e-231e12fabb21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683063318, "uuid": "9b87eef2-139e-410b-ae03-245b785c790a", "value": "eb05e3acd443e4138a6f57216d47e1572b363e03a285f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8deb60c-e8cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1683020229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020229, "uuid": "0c863f9b-c6a3-438a-a652-deb70216add8", "comment": "Malware payload (AveMariaRAT)", "value": "f2bd4538d6636464cf932bff82eec8ae", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020229, "uuid": "8809141d-91d5-4952-bdf2-ceddca08bc53", "comment": "Malware payload (AveMariaRAT)", "value": "ec1f0bf4bf63a006ae48413fed4c1212c08f1564bd3ab30c7088d0e8ee45f0cd", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020229, "uuid": "cfb4f9bb-ac2b-440a-b15c-c0d693e5047a", "comment": "Malware payload (AveMariaRAT)", "value": "a1cc02034e2bdea75ad3bc80e6d897f8bda37bf4", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683020229, "uuid": "4a8ffc5f-499e-491e-ab2c-2db7d36e2cac", "comment": "Malware payload (AveMariaRAT)", "value": "c8bb9d33aa66951cfc93b3dbf1ca40c12a5fcfb770bb50d360d7cb04f729c3ca51d7ea3a1f2c6ce017e5689f1b73432b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020229, "uuid": "2d6d32df-9dea-4ef8-b205-fe390e9854a2", "value": "T130556B2439FA901AF173EFBA4BE479A6DA6FB7733B0764191051038A0723A41DED153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020229, "uuid": "4a161584-6d71-4e02-8de1-86a9a00bef56", "value": "12288:t1bTu0nIQqINMS/3afNrXbDXIk77R9nAdSXb7PNXZgbf9Wuktux+fvUujx6bq5V3:r2r/X4H4e4Qr8bUNaf6CDruxp6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683020229, "uuid": "63d77f88-f275-42b9-bc2d-9d1db33aff2c", "value": 1351168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683020229, "uuid": "fd0c4898-9f5a-4b2a-8221-9c050d05e5a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683020229, "uuid": "9dd8494f-1e23-46b9-ab42-643403561004", "value": "Quotation Ref. # IRQ0105799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81f6622-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683013356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013356, "uuid": "7b2f2b8e-d589-4463-9e8c-5499a4a380b4", "comment": "Malware payload (RemcosRAT)", "value": "e048e9f25b6c18511433d0f1c7195585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013356, "uuid": "4de2a539-51a6-48f7-bff0-5053bf609ba1", "comment": "Malware payload (RemcosRAT)", "value": "edd0bc79de9c5ecb3d4903d20259b356171aa41af2df2a43aad0bf36bda95c7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013356, "uuid": "fec2339a-89c2-45f0-b0ae-9e7add6a5e22", "comment": "Malware payload (RemcosRAT)", "value": "60748def5ec22aedf5f9ad31d6fd4d85a3125944", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013356, "uuid": "509683ae-06a7-4e0a-a603-a99db331dac8", "comment": "Malware payload (RemcosRAT)", "value": "f63e58020afefe2956b051d5799205732faa839ad27ba9a392074cf10ae19e7f53086fa4be14db59a366200b5eee1eea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013356, "uuid": "1004b32e-6464-48ab-bbae-e291048799cb", "value": "T12BA4AE01BAC2C072D57524340D2AF735DABCBD212935597B73EA1D6BFE30190A72A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013356, "uuid": "e38b25cb-efb6-42ea-bee4-cb9bf4a91aa8", "value": "b1c8f7572a6db205362528e88fd3ff32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013356, "uuid": "4aa1d08c-07ac-47e2-a32d-3eee7a84a0ea", "value": "12288:yX8/Vx65HCnDAByqulR1fZJQGs/Z8tRq:Z/Vc5HCnDABMfZJQNZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013356, "uuid": "e886de0e-44f7-4b5c-b552-8d943f010079", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013356, "uuid": "4500e639-42a2-4c8a-8a01-105504971c67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013356, "uuid": "b60d39ae-93e1-4ef9-9993-f76c5284c0ec", "value": "27-04-23_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f45356-e8e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683028945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028945, "uuid": "1783502e-07c2-44ce-b579-31881e4cb35c", "comment": "Malware payload (Rhadamanthys)", "value": "9a02aa1cbb9f67771e3931b32bfd2d7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028945, "uuid": "99f51796-837b-46c3-8e4a-0b95a19e29d0", "comment": "Malware payload (Rhadamanthys)", "value": "ee5e9a1a6a599570ed2d5bd4e933b60b49c3b2a5fe6f198989277d640a43698d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028945, "uuid": "7246efcd-7efb-4593-911e-83d34c903a1e", "comment": "Malware payload (Rhadamanthys)", "value": "623ff82c9bb3801bde9f010f1be4afc53e71b1f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683028945, "uuid": "3be0db88-0961-4721-98fc-cb5392b4141b", "comment": "Malware payload (Rhadamanthys)", "value": "ba6d7704c12a5ebc93b8be7e33e6c5f756f3802a999ba50e816104ac8c0012dc7c37e55587a3b4b7496c3a31ff6e6d4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028945, "uuid": "b944f0d3-f44b-4871-8a52-1792c651813d", "value": "T107949E1272F16832E63206728E2EC7F86A6EF8614F15BBDB1754DA2F09B11F2C572701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028945, "uuid": "9d7ea978-7454-4692-937f-0c788b2d25b3", "value": "9d545fc5792b6e651ea15e3004061a16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028945, "uuid": "e30551f0-0d25-4eea-96aa-dbd29c14d906", "value": "6144:bJO6/TZIeo4ZOI4YvJ90eFb5sBGP0KoKjXzfq6:bJOmTZIeoxNB5GXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683028945, "uuid": "89651ca8-f05a-4124-81a4-3bcc7c7ef3b9", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683028945, "uuid": "fc496945-2714-49f7-8826-000c670415de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683028945, "uuid": "831297ac-4310-492e-84fd-d2cfeef4d587", "value": "9a02aa1cbb9f67771e3931b32bfd2d7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfaf9632-e91b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683054117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054117, "uuid": "f8100c10-8e02-40f3-af86-6755fd707829", "comment": "Malware payload (GuLoader)", "value": "abaf5ea47776f6b5c0e1e2b1f15e323e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054117, "uuid": "8c6b202b-ea1c-4159-9ae6-b549debef511", "comment": "Malware payload (GuLoader)", "value": "eeeb1bc5faafbb0921895d6b2bba4d0dce0ef5288e4b22e3eb6ec329b3ef7c6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054117, "uuid": "891e14a1-a030-4dbf-9dd9-43bc9a212654", "comment": "Malware payload (GuLoader)", "value": "46bb1d92fe0ba61008c5a6a660c3df5e0fd95dca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683054117, "uuid": "fb1a86cb-6234-4c49-a5e3-dabf84ba4df9", "comment": "Malware payload (GuLoader)", "value": "e9aa47cf53135d7905996af72e540c485ce0e7fde02d0699adaca0a200eec7d1ef480277ad520577cff0a1067655ba95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054117, "uuid": "1f810223-c2fe-4599-9708-310ec4b415f0", "value": "T1E16402577B85C49AE4950A79892BDBFE53B73D0C972C1A0B27A43F2E3C313825F25981", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054117, "uuid": "edad969e-0f29-4f8e-b312-19172204b524", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054117, "uuid": "949426e4-44d5-473f-b656-b4e1fde2af32", "value": "6144:R4SUjhth5eidq9iTzzy2/TsZFIYDh0EZmLm56zsoI+vL9sEInDpy:q/eiEMXzyCTsXIuasmLG6g+S/9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683054117, "uuid": "c1930fbc-60c7-463e-89f0-ec6e39f868bf", "value": 335160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683054117, "uuid": "c51c1fde-e325-4e2d-96a6-85edf872f513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683054117, "uuid": "64ad7b4d-adb0-48a3-8a71-074ecd5d0a37", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f631874-e93b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683067646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067646, "uuid": "f60b1978-b3ca-42a8-b48e-fe2a5c13db88", "comment": "Malware payload", "value": "953b8c6b72ebfad8d0c89427325dff94", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067646, "uuid": "2abc0c07-8143-4da7-a321-e4c94f1b9a11", "comment": "Malware payload", "value": "f1cf17385d9ca2d168e4ccde38f426ec8f9f27b9599d3974c53008e79595fc7b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067646, "uuid": "794ab204-66a8-43a0-8507-6727eab59f2f", "comment": "Malware payload", "value": "5b58f0521d43491024180c60fcb0e2d9f658ac1c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683067646, "uuid": "269d1c6d-c0d8-49c8-9659-48e63cf7c1f8", "comment": "Malware payload", "value": "a8a52735d4d87a7a21dd7227b84ec85c719ada76b7b899d247889d26ab83889d07aec2d86c842e196d075bdf868fbd9e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683067646, "uuid": "3d7289bb-d2ff-4fa7-9aed-505c12789530", "value": "T13D72C00F67A16C6746DCE8BC04D0EA51D9EA05DA30E354F892490D67ECFDE8207879B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683067646, "uuid": "201fabbd-7fa8-45e5-9af8-5b2a98e998a3", "value": "384:y/NkuBL4J8wpR2yD3BeezkDcP0q2z8wJy/+AWjQv:nu9mfXDRJmcP0bgwJATWkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683067646, "uuid": "4c97d87f-e030-4217-acbf-83ce0cc4d5de", "value": 17151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683067646, "uuid": "18fdaa83-851d-4b3a-b5a6-8732c503602c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683067646, "uuid": "8b7937fb-2ef4-4fb5-8e22-9078c3167a17", "value": "A401.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1776d351-e8e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683029756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029756, "uuid": "000fbffb-d11f-4500-b962-23ade58cf70b", "comment": "Malware payload (AgentTesla)", "value": "3f9e372cc103758491c9786c67468330", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029756, "uuid": "1c828aab-75db-48b2-85bd-36f6c253a669", "comment": "Malware payload (AgentTesla)", "value": "f1dcc38bd18b2cc106bcf1c3800931658d0b7463f7259916dec7c123830045c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029756, "uuid": "f065dc7d-cb28-44da-ab95-c52b0cf895dc", "comment": "Malware payload (AgentTesla)", "value": "cfe662d47c20ad42a47bd6caf1cd1ba9523a8d17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683029756, "uuid": "aa0d2ad8-3bff-4e14-b738-3b779057e50f", "comment": "Malware payload (AgentTesla)", "value": "a87015fd4cfaf4bc228bb2c4a7f857be8725eab27f89d5db8847e840fac80786011891498f5a2efa022b2105cf285564", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029756, "uuid": "a075f513-dffe-4d0e-b9e1-b6aa2b9a7054", "value": "T1FED4DF426179CF0AFC3ADBF154A4FF8457F1B5B398E0D2211FB624C9DAA6F010A4961B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029756, "uuid": "8529428a-efd0-4d1c-a77e-d85b77a84f7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029756, "uuid": "1ac0b532-d490-4b11-9f93-acdb977fba68", "value": "12288:Ozmqjz+ydhlC8gRXocOkgqieQmCIFmmXLy:0mquydhsnRXocPgqiPERy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683029756, "uuid": "39ea98e5-9264-49f3-9db1-139c3442a20f", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683029756, "uuid": "b8aed3b7-4b20-49b5-81b6-7883baeeb492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683029756, "uuid": "95c5793a-fc94-48f6-9f58-6f3c2b917c16", "value": "Aviso de pago - (DS78B) Pago n.\u00ba 133060908_jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f728d66-e8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683019435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019435, "uuid": "6191b85d-eb9e-4fe2-aafe-d8a0b893ce9c", "comment": "Malware payload (SnakeKeylogger)", "value": "66ebaaf498081227abde85e3c0ec5f22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019435, "uuid": "64831ba9-f937-42f0-abef-28dd4ad916f1", "comment": "Malware payload (SnakeKeylogger)", "value": "f21ecef6b50a540055a4b939cfc184b2dc36a3486c086e9e6bbe0e489f30f496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019435, "uuid": "73be49da-69a9-4b5c-9711-a50bead2a4d8", "comment": "Malware payload (SnakeKeylogger)", "value": "b4dc6caa8c07c7bbe7d147c1390660b90f3d6037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019435, "uuid": "14c924b0-e653-4f98-9b0e-943b62b3f477", "comment": "Malware payload (SnakeKeylogger)", "value": "6d051fd662b52da6c5d5d5058939ba45faaff0bf262c17899101d1f5e3f2dadd29f50da239a22e5e1a770df34e625feb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019435, "uuid": "c1596971-a0dd-4346-b7cd-bbeca35a23d5", "value": "T1DD153CD1A150CD9AED7B4BF16C2AB93021E3BD5D54E4C10C1EAA779666F3302209EE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019435, "uuid": "792a603b-531d-4517-a066-07dcc1bad11d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019435, "uuid": "a0dde8ee-7572-4652-aaf5-af5f49a57400", "value": "12288:11W2iNvRGHLTXgw2kxljShWiGo9oLQ6FfMkxVDhbm8d1p3v4rR8ZA:O1tRY57SWXo9oLHFpTdm8vZ8R8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019435, "uuid": "55673d23-665b-44c6-913d-b90c8cf8465d", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019435, "uuid": "981eaf16-84d9-45ff-afdd-787d0455d480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019435, "uuid": "8b2d3d82-9aa0-443f-90f1-6ab412db7b77", "value": "01032023T.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e24da4-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683013377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013377, "uuid": "573d42a1-0f6f-4ec7-8bfc-6c7b2211dcde", "comment": "Malware payload (Formbook)", "value": "b418ded7352dfd447eae15fba6612d49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013377, "uuid": "9589ead6-579c-4fb8-b226-9ac0ca73f4e7", "comment": "Malware payload (Formbook)", "value": "f2de7e1866310a43bf34f50a907b7ec8ff5c7b9ae4421c304e26aed008f30850", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013377, "uuid": "a7309c63-da37-4109-a66d-b72fc132e295", "comment": "Malware payload (Formbook)", "value": "060d193bcba96611a902ca6b0ebe712218a93065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013377, "uuid": "ded9cd06-c499-46d2-92cf-4ee3abf00374", "comment": "Malware payload (Formbook)", "value": "0a5756b999e17689b580036fecd844f23e287b57b93285677a79f848fb3093806f853bfb8d520cf7efda6f9763c8fa02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013377, "uuid": "5a0ee838-4074-40dd-8d88-85a709dd0d19", "value": "T1BB04AE36D641C075E2B211B5B67D1B7B893E0E343295A0E6E3E116E06FA49E5F03A31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013377, "uuid": "49c340f1-aac5-417f-8797-04b4ff59fee3", "value": "3072:eedbiE474WyfW3aheN6c7ayMRIY71+/lx89WYpWxkYKv:hckAaYr77MRIYR+/lSTpQKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013377, "uuid": "8d79aeb1-289c-454e-bb05-fe39103fc364", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013377, "uuid": "cbd91379-20fc-4973-a1bf-103cf38193d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013377, "uuid": "c30cfdfb-dda2-4330-a317-8130bba075e0", "value": "f2de7e1866310a43bf34f50a907b7ec8ff5c7b9ae4421c304e26aed008f30850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c112048-e8cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (EternityStealer)", "timestamp": 1683019993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019993, "uuid": "6ff21157-331d-4985-b765-04e6e56f80b6", "comment": "Malware payload (EternityStealer)", "value": "c8160bcafcd6bf27d9b37ffd1985e029", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019993, "uuid": "36b04a10-7cc9-42c0-90e0-43e46392da90", "comment": "Malware payload (EternityStealer)", "value": "f3253a3732bc4b99f4cca79e439d9f2fb25d6a4e1a75e47228b6aa8a5175e4b4", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019993, "uuid": "0089891f-b725-40b0-998d-a00bb00c0aa0", "comment": "Malware payload (EternityStealer)", "value": "fa8da691a6fddb294174eca4ee3cb222bbf3ab20", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019993, "uuid": "6f388992-cfce-4f20-82fb-f75ddc90c820", "comment": "Malware payload (EternityStealer)", "value": "d03518a5f8c4d8c9535e780b49f3d9fb2943be742815c6af744b129be1f2290807541956f8a4da895e457252eb2436e3", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019993, "uuid": "c2354c1b-15c6-4f0e-9e5e-87c6cc3a98cd", "value": "T1032512027AC295B2C4631E315B3962216D7DBE302F69CECFA3D475699E311C0EB3176A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019993, "uuid": "e20b4a22-5451-4e53-a116-3381f2a8b93e", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019993, "uuid": "82f238d5-c7fb-412f-b372-72f2b83049b4", "value": "12288:lToPWBv/cpGrU3y4CDFOkZdhvRH9EfIpops7SQlMDbkHB6B1rAiQ13+jxLEj2NJJ:lTbBv5rUqDFzhvxpFKUEBCjDWhvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019993, "uuid": "b73bfdb9-f611-4770-b3e4-88f0f9c26a89", "value": 1043339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019993, "uuid": "23029361-9df4-4b02-a783-f82102b70fb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019993, "uuid": "7921308d-f3ef-4bf7-b7c7-0783ee1cf0c9", "value": "c8160bcafcd6bf27d9b37ffd1985e029.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f741da-e8c3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683016245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016245, "uuid": "3becaf3a-8fcb-4e14-943b-02fe2bd1c206", "comment": "Malware payload (SnakeKeylogger)", "value": "5a69930ad6f415935c1b281f13ea14f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016245, "uuid": "3e98c109-ee47-4e79-a822-25b0e1ecb5e3", "comment": "Malware payload (SnakeKeylogger)", "value": "f39c34f6567c6621290c4a7cdc7d6a436cec626f9d80aec20b508e1dc375432a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016245, "uuid": "2bcff883-53e0-4d70-9527-0b58326017f8", "comment": "Malware payload (SnakeKeylogger)", "value": "cfdabe9ea5c8b0d9a4ed4b969357a17e7fd9b68c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683016245, "uuid": "aed3025e-f946-41fd-9d78-0dda8870a61f", "comment": "Malware payload (SnakeKeylogger)", "value": "496e7f2e0275017f4d87b9e5d4f8beab0caa727b52ad7c487c76e9618e501d047848b6252c84d93fbc613721fb9e1a73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016245, "uuid": "ea6c8e77-7625-4e26-ae0b-9bf636f01562", "value": "T1BA052CD1A150CD9AFC6B47F1AC2AF93011E3BDAD54E4810C1AAA775666F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016245, "uuid": "e49bd91a-d615-4254-8f6f-343809ca926f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016245, "uuid": "bbcec9b8-daf1-4e31-99bc-37d9795440f8", "value": "6144:z4454d2nIZV0s8MqJMUxsXMlB5XosEYkgSKkFLeomNCpN4Md78pR0lPilfw1vC9e:CoIZt8Me3qYBSoomIN4MWj+Pil0c4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683016245, "uuid": "736dacc1-dd22-4279-ba0f-47e22a7c8b98", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683016245, "uuid": "87d5a42f-c052-43d2-be5f-1d3b9a67770e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683016245, "uuid": "39de8794-08c8-403d-9cca-c959cc4ad8c9", "value": "SATIN ALMA EMR\u0130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a897e6-e8bc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683013379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013379, "uuid": "127a2a0d-c3d0-45e6-a070-ebb78b50ae35", "comment": "Malware payload (Formbook)", "value": "cf7e91f816d979baf90785208eba0e3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013379, "uuid": "61fbfc47-0bd3-43c1-8115-53a4e2d314b4", "comment": "Malware payload (Formbook)", "value": "f52d31b838551b1b8c1dedb845115e5aed85decae70cba2596fa43d326b2a920", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013379, "uuid": "94290573-6b42-4183-8eca-eb5c2e2ffdc7", "comment": "Malware payload (Formbook)", "value": "1a33ada03d16f20a42784866853f55a46ba966f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013379, "uuid": "61c253d5-fcd6-4e35-8f43-b7c52fedc89e", "comment": "Malware payload (Formbook)", "value": "d7f5334ee52f54494c3b4a896d57d4fa142690cae2e751550d1df63a644a2d57e107d3ac735c3658990969a83c7414df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013379, "uuid": "63eddd5e-79ae-47f6-aefc-d0364cd0ea0e", "value": "T10F04AE36D641C075E2B211B5B67D1B7B893E0E343295A0E6E3E116E06FA49E5F03A31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013379, "uuid": "e965af7b-3a34-49e5-bd66-8a7ae82eb081", "value": "3072:WedbiE474WyfW3aheN6c7ayMRIY71F/lx89WYpWxkYKv:ZckAaYr77MRIYRF/lSTpQKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013379, "uuid": "02d8554c-664c-4b3e-b9b3-72882898f965", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013379, "uuid": "3cef672f-2e5f-47a4-8dca-a6a72be58c7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013379, "uuid": "018b0a73-ddfc-4018-835d-de63781f4397", "value": "f52d31b838551b1b8c1dedb845115e5aed85decae70cba2596fa43d326b2a920", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60457d4-e8e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683030130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683030130, "uuid": "a57a307e-bd8b-49f2-ac03-82d526f0e69b", "comment": "Malware payload (SnakeKeylogger)", "value": "608a6d08b4a99e405b845e5cf70f4fe1", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683030130, "uuid": "b8f6dd34-864f-4d47-bca2-bfe65c9daec5", "comment": "Malware payload (SnakeKeylogger)", "value": "f58f989c542ac41b295bac70da60a73994421d1153b82f99c0a03189d057e292", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683030130, "uuid": "8fa9cdd5-1883-446e-bb44-2aeba83a3f13", "comment": "Malware payload (SnakeKeylogger)", "value": "7ad8a6ca3bd615b72b0a1dbba4c335f7b32cbf1d", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683030130, "uuid": "04804810-111a-4273-86fe-ba9a5509a53d", "comment": "Malware payload (SnakeKeylogger)", "value": "164e5aa65554c8783607ba64eb2ac7b2382b3622400f37d6f531617a8e5f584afd42d16b138d11dead35b093a8e5f12a", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683030130, "uuid": "d1774f84-fa32-4453-9b0b-b1aa0eebb3a8", "value": "T1DFA423C522A27ECBAC33A92F8D59F6CE27651BC242245534BC23B15173F422B595F23B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683030130, "uuid": "0f9b684e-9112-4113-8579-9a0b995a6ba5", "value": "12288:Z98a1BiVsXcIdA9QWUU8lupnB7+i44jNKgaWr1s0N7M:sa1BiiMIu339pB734a0gr13u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683030130, "uuid": "7b98f80a-4c43-484c-9382-2f186e497d09", "value": 475276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683030130, "uuid": "94654e0a-edb5-4b90-9034-05247670f4d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683030130, "uuid": "e2dc2d9a-5733-44a0-96de-5d2d3aac99e7", "value": "MV GOLDEN SCHULTE PARTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0493ce31-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683013404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013404, "uuid": "0885151f-546f-44b1-b90c-45b8ef5349b5", "comment": "Malware payload (Loki)", "value": "4249c08ffaef998e670f8bc5885de945", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013404, "uuid": "723c07b4-9558-4a14-8316-fc7179210878", "comment": "Malware payload (Loki)", "value": "f6d0649facfffcdc2e79091b9854dca36b770b0090e17c5081a9c30711761455", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013404, "uuid": "2ace6d26-ef4c-4c89-accb-2296733cdb44", "comment": "Malware payload (Loki)", "value": "1abdfb8e0ff35ce056ec27753f24584e3728ab68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013404, "uuid": "8ef5b653-344e-43db-a018-adf9294c1764", "comment": "Malware payload (Loki)", "value": "27bd83bd64e866b39aef2e9ebb4d5b96d30ccf1228005bafe30fb109635c119ef79b935a9435ee52c620e297829b93b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013404, "uuid": "3083d082-b668-4006-8273-66d923a4aac5", "value": "T1DBD4063819BD1727C179D7F58FD08427F2A4A86B3021DE6568E767A6431AF1229C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013404, "uuid": "2c78d743-3ca3-49de-90b7-bcb3f42a8594", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013404, "uuid": "c8653647-e5c1-4ad1-9b5e-237648632047", "value": "12288:xbSJgvm7Rik/Cm1jNQO1YeM+F3Kjx5rmDBVfmKo+7qH0s8M5CRCajH/sI9UH:xbSJgvm7Rikj5Q8F3ExGBVfmL+7tc5C4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013404, "uuid": "fbb2a90b-074a-4145-93f4-5dfcb7324118", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013404, "uuid": "1db36dbd-5065-4060-a93a-5c54e182bf03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013404, "uuid": "05a7df0d-8083-4e4c-ad52-0ab72a701de6", "value": "PO7865.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102b26d7-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683013423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013423, "uuid": "75512fe6-f6c3-47f1-956c-b4374e8a889b", "comment": "Malware payload (AgentTesla)", "value": "38325ed2233434b55802736dbb215c27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013423, "uuid": "7cac95dc-337f-4cee-a51e-046e7af0716b", "comment": "Malware payload (AgentTesla)", "value": "f6ef78e5668f64b9a00f5f7c84a1d1748570fe37bad66c59c62fdfb6407318f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013423, "uuid": "dad19ea2-eba9-4dda-b21a-69e5b4c77ded", "comment": "Malware payload (AgentTesla)", "value": "b25ff37d124a71e9e91bc1c2ae58abfe73da3f95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013423, "uuid": "f7236b27-244a-4e5e-b6ba-6152788467bc", "comment": "Malware payload (AgentTesla)", "value": "89be7ba0a504791e53c777f0d8f0dc7deafae04cb156ec66f270a72dc0247d1250c2e153744e77b8894a73c5f77c7d2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013423, "uuid": "bf6e4716-429a-4f9f-888e-0af34f3065f8", "value": "T1A2431849A38C4616C7BD7A73EAB0295E5B73C213E4A2E79E0BCC53E605D331279011FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013423, "uuid": "09494e67-eda7-4234-b606-448def0962bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013423, "uuid": "a0c9d142-d89c-47a1-866b-7b38fd8f5ea8", "value": "768:JuujW62bzEZbTfHagdlWCyp9VRpPKG19zYFgnX512MYVtzMzjwwuO:kqW628FaIMXp99KG17X5QMOtuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013423, "uuid": "5b0770bc-20c7-4741-b390-bf79a6d41030", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013423, "uuid": "1c9c3a9f-cb52-4858-909d-0347980bedc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013423, "uuid": "3772886d-04a0-459c-aabe-247778cc92c2", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fd5c64-e8dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683027363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027363, "uuid": "d3f29fa5-4bf6-4bc8-b213-7b13817b71e9", "comment": "Malware payload (Formbook)", "value": "875547f42bb7177636616dedfc74a180", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027363, "uuid": "e7ab178c-6472-4994-883b-06382a0275af", "comment": "Malware payload (Formbook)", "value": "f815d1ea14ef2734defc99e94b62ea6d0fd6a98f15a17c4476eef17b14f2587e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027363, "uuid": "8f859a56-0073-4719-bd2f-38a2516849cd", "comment": "Malware payload (Formbook)", "value": "836d77d551dad3ef0a48d4b2d645023281420442", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683027363, "uuid": "03d3cd7e-46c7-4d65-aa93-a1ebd2e76ee9", "comment": "Malware payload (Formbook)", "value": "1b8ed8b916d3c45bdb4cf91f4d2ba578f762b440252357ad78cd5f3cfa470ec1a0c256c84b7f9a833e4e3f5cbb6f21e6", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027363, "uuid": "ac2a9ebf-2e65-44e1-afbd-bd99018262c2", "value": "T17205BE85D1548A55EC299BB06536FE305272BCBAA8F0D02C2DEE3D97BFFBB921414017", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027363, "uuid": "c52a337f-f747-4190-8e3b-9be8ffb950b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027363, "uuid": "c7081a8d-f993-4aba-bb87-ee8e88bfd9f5", "value": "12288:EVzsqLg7U/D6rU82J5WgMLZuhkRp9bsPYctRSoVdCAaiwpbwSWP7r9r/+ppppppp:uN0UeUD5UNuhkRpqYM5TC+wpbLW1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683027363, "uuid": "0e313235-57e4-4293-9135-e5518a717b35", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683027363, "uuid": "f3a341f4-e440-4324-8fc3-278958995800", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683027363, "uuid": "67d300f4-ac72-4535-97e6-7d7bc3728624", "value": "DHL EXPRESS JEDROO15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb436c1e-e8d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683024045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683024045, "uuid": "38523603-e027-47c1-8047-d096e3395ceb", "comment": "Malware payload", "value": "b6d45fb472ad1646d4d5cac107f5715f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683024045, "uuid": "389ae560-f19c-4e6f-8b79-f6a460bb6370", "comment": "Malware payload", "value": "f8637e66be23ca8b3d51b53cc36b38e00ffd6cb8eccdfe22f10288c60c4e33ea", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683024045, "uuid": "ab8e68fd-159f-489a-9763-d0a258af7fee", "comment": "Malware payload", "value": "7c943eb2aadba032f85b0d882f921e734cdb6566", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683024045, "uuid": "8544ab70-091e-472f-baf1-5821a4142296", "comment": "Malware payload", "value": "41e24ba0b3fa2d6e6a3e18750c32b704286d46f866b3139eba8ec157532c4e99de8fd87e539bf4d63e9a4cd8ec7a2569", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683024045, "uuid": "feed767e-2322-4092-892b-e1ba1b2b31ec", "value": "T1978533B432D4F427BA44D2EC2776979D4FBF6CABE405B04E46EE5006913D3BCE926806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683024045, "uuid": "5832eb1a-0274-45f8-8372-03a2713b1896", "value": "24576:f6HmcbNfZ22UYHe19GDUegrLBeanfCKWVG96RlQWg898cFJAWQrpROJziREtiB:3UNfZjUeOB9nfGU9GbEDIzZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683024045, "uuid": "653d6947-7acd-477d-b345-555947d3d64c", "value": 1714179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683024045, "uuid": "c219b94e-44eb-4a30-9509-557974c46903", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683024045, "uuid": "0defad97-a440-47c7-a49d-ddbd3cae0468", "value": "All-In-One-Version.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83eaf94e-e8cf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SystemBC)", "timestamp": 1683021348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021348, "uuid": "07106839-2f3b-4a86-a7b2-a855373e7d8a", "comment": "Malware payload (SystemBC)", "value": "fec1bb333482a2e245660c0e4026f85d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021348, "uuid": "10cec1eb-ec69-45e3-ba9b-d2169f54bb77", "comment": "Malware payload (SystemBC)", "value": "f90cac94e15dcd83102e845c4e1e10e244506615157f19b8dd816c1ce32fca1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021348, "uuid": "656fd6e4-c8d9-4b1b-b0a7-0863bd550033", "comment": "Malware payload (SystemBC)", "value": "a08544a217c47a3d77292f013afa6d84f93f0821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021348, "uuid": "12109f3c-8081-4849-bbc8-31b1f9c70a00", "comment": "Malware payload (SystemBC)", "value": "52498db9e2258d57d543587910261860110b0c743654bb278bb3119f16e981c01c2ac4a8d1c101edf3d3aa976b7c59f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021348, "uuid": "451c029a-e65b-4dfd-af95-9d4f7030430d", "value": "T1ACD4CF1879F44D62CA8C0BB9D5734564AEF1B920BB22F76FF4427AF43A0225CA913747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021348, "uuid": "33e0f1c7-f5a7-438c-8cb8-9f40fe9c79a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021348, "uuid": "a567c45e-9273-4217-a02e-590df3ae578f", "value": "12288:QTg6UFR4EGWlEUkx9RCDwGWzjuGW0IRlHoEM+fK:QExEWOXkqyGpKlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683021348, "uuid": "ed6ec085-faff-408e-8046-01e8e590946e", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683021348, "uuid": "8b0952b4-4f41-4c27-9946-3690265848a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021348, "uuid": "2cc92c7c-c586-499d-a086-ef01f8bd2376", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02242c6e-e8bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683013400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013400, "uuid": "55ea2374-7991-4ac8-bf82-1d5e7077d3eb", "comment": "Malware payload (Formbook)", "value": "64ce92242a4b896e952c57d6e8144bd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013400, "uuid": "8518beea-8683-48e7-b52c-2f7d368fb277", "comment": "Malware payload (Formbook)", "value": "f94be5630497d64da51b0a362279b6a60133365e60e27bbbc90f7767faed4f28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013400, "uuid": "d9c6410e-8575-4e35-ba48-8a21575e4043", "comment": "Malware payload (Formbook)", "value": "167cf3fe9a09072bc3abe8d0ff957217201cfc63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683013400, "uuid": "6fbab8f6-ee74-4409-8f11-4381e9faea9d", "comment": "Malware payload (Formbook)", "value": "ce9c2b355877d3861f0da5d8c1b0e8069891ae9aae185202cd0c0d76bf1d975a120adcd65d9cc2f39dc1e08fbabfda54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013400, "uuid": "efdd93b4-30c5-4e46-b17d-7522beb9b474", "value": "T150F48D22A3B08573D41A1A749C17E79C48D97D202A31BC4BB7E07D8CDF797817B2A693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013400, "uuid": "b30ccc85-0452-422a-9fbf-14d10a3157f2", "value": "3315fbaa0073c4f3592d7e54ba056c9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013400, "uuid": "413680c1-19a8-4bc6-bef0-b2aa15b9c96e", "value": "12288:Hu+e4v0ma0dwwcQNHRh+ZXiwBdbPmWNQhnBMQfhxN2rn4PhWu7:HuRQq0iwcmhEffeW+zhxN2rn4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683013400, "uuid": "08f2ce9b-f275-4183-ab56-436e2010d3e7", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683013400, "uuid": "2b858330-f42b-446b-b8ae-8f51fb7f8f0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683013400, "uuid": "81655124-af9a-4310-93a0-5f701507f7cd", "value": "Order confirmation is attached.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993d1f8c-e8e8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683032121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032121, "uuid": "571d1df3-3cfe-4942-bbd5-51b6f6e5090e", "comment": "Malware payload (Loki)", "value": "f9fbfee491440e919bf3ee8df7f415aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032121, "uuid": "beb1ce9b-af92-4e33-9dd8-0d2d067e31c0", "comment": "Malware payload (Loki)", "value": "f99da1aad2e70c4ac47fa15cbf2a3eeafe86a79886892fe6f970ce8d54f45286", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032121, "uuid": "74a364d8-449b-456d-a292-510fcf458fdf", "comment": "Malware payload (Loki)", "value": "18ab829aaad68fc593be3307b3d830e1d6dfbc57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683032121, "uuid": "84d71b08-01a9-4112-8304-5b346339ff36", "comment": "Malware payload (Loki)", "value": "41a139c8d14b75a254e7206bc9e87d68fdc2e5ab22ae60d019dde90280bad440c134e933623d48a6bdebec2c40f3ba78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032121, "uuid": "e5fe72f8-59aa-4e30-8c03-3c2618a38ae7", "value": "T1D4B4CF4250A9DF4BFD3ADBF044A4FF4067F1B5B798E0D1212EE524CADAA5F000E49A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032121, "uuid": "66af9c33-c660-49f6-8178-e4cfbbd6f4fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032121, "uuid": "016f7bf1-c1f2-4d0b-b8a0-0ac0550dfea2", "value": "12288:tzmlPwbkmMJf2W80TJg8UVe1VcDnslcvta3EV49t:BmlPwb1MnvTCIos6vrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683032121, "uuid": "088d7688-7e2d-4020-b6e1-e7462cb913cf", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683032121, "uuid": "3a834192-a7bc-4694-910b-beb3cb30e8f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683032121, "uuid": "c67a4415-3169-4b29-b9ec-151d958aa24f", "value": "f9fbfee491440e919bf3ee8df7f415aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e76854-e922-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683057111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683057111, "uuid": "22d27bdb-4ff5-4137-8d68-2fa4be832be4", "comment": "Malware payload (AgentTesla)", "value": "f3059dfb6c4eac0305068d69f00a907c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683057111, "uuid": "e069b679-6b48-4c69-99dc-7d7ea14f01f1", "comment": "Malware payload (AgentTesla)", "value": "fa58b90fab0ec39c6f8eea060f48f44d5329e80e0286fe6b1f7bbe42b0f32e7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683057111, "uuid": "ad212f70-9f58-45ad-8862-7a30352972b3", "comment": "Malware payload (AgentTesla)", "value": "53481561119286d19aab1469852ae93a390441b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683057111, "uuid": "8c9ae9f3-bb16-4b09-883e-7c4f7e24956f", "comment": "Malware payload (AgentTesla)", "value": "da2a5c289e5c73e481b43a9cc0fe69e226438a981a1f0978f5b573067b6410d265d9f43d9ff3054fad60e841615bbdbc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683057111, "uuid": "4bc17925-5367-41d6-be45-1f140d6aa2a0", "value": "T100B423B06E67B5AFE57C96D26FB94D1BCB2A8D10616E37CE0053721C8237052E259C87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683057111, "uuid": "dcb96683-9528-4658-82ef-0fec7a959676", "value": "12288:FFI/4vzWOgvl8+ltBC2nJERen6xNNMHJ+2geoGscWcndNe9lu0gRO:D7Svl5jJE06/NMp+2iGshZu0g4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683057111, "uuid": "34f425bf-173c-4c4f-a897-aa519476720e", "value": 514312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683057111, "uuid": "68820368-b9e1-4996-a539-57471fc4bdcc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683057111, "uuid": "f7d5271a-10b7-4be4-a5ec-3ee9f286e32e", "value": "URGENT REQUEST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708900f0-e90d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683047945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683047945, "uuid": "35fbc45d-2e5f-4e64-b7c5-8ca440b7a1ff", "comment": "Malware payload", "value": "d6d89eff8ae95f17795daf44ddc35389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683047945, "uuid": "85ebb7ab-2173-41be-9b84-86f6fa7721e7", "comment": "Malware payload", "value": "fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683047945, "uuid": "47831b24-62cb-4d40-87e8-5971fcb6b0a0", "comment": "Malware payload", "value": "a7cf42f11071fe319b4e73203ca8269fb38f008c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683047945, "uuid": "24497f28-f37e-48f4-8a5c-764eaa316c25", "comment": "Malware payload", "value": "9f5bbfc6a674eeff89f459c2304116db374d64e3c04281b9ce2c2ed3c24566d3bce152b66b97af2f412df9d5058334d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683047945, "uuid": "f448efd9-51a5-4bc6-a09b-03775c73b24e", "value": "T1716512066064DB5BFE7687F09564FF8463F0B4B794E4E6282EA920C2DDB2F141E4C91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683047945, "uuid": "8aa90868-c559-4496-825f-c4b6b5b31e48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683047945, "uuid": "fbb2a3c7-ef65-46f9-90af-935e428bf0e4", "value": "24576:4AETCN6fdDv7X8E7Rf/vj6ksjurjtBEmDUheyX7TFqktKOpnAxWB:Yw61XNxmkQismIhXNtZpAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683047945, "uuid": "aaffbacf-f017-4343-a7dc-125db210b23a", "value": 1479168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683047945, "uuid": "60025913-8676-4efa-a124-d309bafa0eef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683047945, "uuid": "dc7d308e-0c2a-429a-ad16-febd235cb03c", "value": "Quote 1345 rev.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95aff5a6-e8ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683005916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005916, "uuid": "0ef02943-2f02-4e87-b264-eb3f8f2a6a18", "comment": "Malware payload (Formbook)", "value": "13d057d6fb7f8f5e5dac6cd71d0eee28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005916, "uuid": "d2d34fe2-ff6b-46ba-9e78-e4d10acf2807", "comment": "Malware payload (Formbook)", "value": "fba7e337e71bc76897190387a7cea0b3cd205fd03a822420f38c8d1f595693e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005916, "uuid": "a02a0001-0581-4e2f-8407-889352e2f9b7", "comment": "Malware payload (Formbook)", "value": "d7ca3ef185cc1f2e2c62f5d6176a0f39e57dc398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005916, "uuid": "b1b4c576-9630-4238-94b7-a04548ba722a", "comment": "Malware payload (Formbook)", "value": "25816d79f75b8d83cb3226158fb32adc016ba4137905903480b4339c8bdd4a801b232b59efb8b6f43ad2731e38180d7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005916, "uuid": "b1cd522e-fa64-4d26-a6eb-6561c1fd8cee", "value": "T1A4E4D00622B5CF1BFA3A8BF40464FB0023F1B07754E5E1691EFAA0C9D9B5F050EA556B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005916, "uuid": "61a54581-9ae3-4440-8deb-2fc4be272c96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005916, "uuid": "40a5e629-3212-4439-b3b0-981126d76311", "value": "12288:cW2iNvjy/T50INqmag0gucrz4thuw/EVlmAMXRTCoC77PY:V1tw0ISg5oth9/EV4AmdCX3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683005916, "uuid": "d1c690e8-bb32-4013-a8fa-72e03fe60a76", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683005916, "uuid": "5df93fd4-fea6-4643-9122-054634ff7eaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005916, "uuid": "68d52e4c-17cd-466e-8b0f-b7e67fe147bf", "value": "PaymentForm2929098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8934df-e8ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683042084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683042084, "uuid": "5942b2b5-3d1e-4a98-9c2b-7f5e8ee07092", "comment": "Malware payload (Loki)", "value": "ed2db033688a12b3911c3f04b7a58c46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683042084, "uuid": "e3f27170-2d74-4aa8-a475-935804e6a7bf", "comment": "Malware payload (Loki)", "value": "fbcff56858130d8fd159a85011bfc3ee71e80aee372aaf5c71cc4f9b0a19bfc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683042084, "uuid": "94ae6739-88cb-42c1-9fd8-3f19d2cbe186", "comment": "Malware payload (Loki)", "value": "4a32a9372cda59587395abbd9371a95c6ee6a1c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683042084, "uuid": "acd965ee-7e61-47d7-bd5c-646dd1024cc3", "comment": "Malware payload (Loki)", "value": "845c5106b4b992396023ee10b43a149ec1034f1815e7eba013972e16d628846fe117e5b62657e7797f79aa7d48a81bdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683042084, "uuid": "aefdf937-bb1e-441d-9111-bab0a2caac5d", "value": "T18DC4872A38AA510DF661AD3C6BBCB172915DF7F216360CB74DF7084A11129F0CBAD627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683042084, "uuid": "cb1c6533-d37c-4436-a512-5a17d0607b23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683042084, "uuid": "7c1577e2-236c-4261-9e7a-59bcd5b60b8e", "value": "3072:NPtd2epEFbMkbNZG46Xz3kFE0bFd+m0de2fcRMBLEFx11Hiv2MN+w86555x555la:NBjkbNNhNHG+96+TUxJQOOMvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683042084, "uuid": "34610b21-72e9-46be-b6ce-53765eab3616", "value": 553984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683042084, "uuid": "a0f95663-8970-48a2-b471-811dcfbba83e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683042084, "uuid": "69855a7e-f8ee-43ed-b93a-764091d87501", "value": "P.Order #20441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060138ef-e8b0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683007823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683007823, "uuid": "4bd7397f-7432-4c02-8a5c-0270582c2160", "comment": "Malware payload (njrat)", "value": "0498998459758636b6bd4c5c446b1811", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683007823, "uuid": "c185eaef-993b-4f3a-9627-35b0ce8a0a03", "comment": "Malware payload (njrat)", "value": "fcf0e6732462cba8a909ccdfd4bcd1a86074cfc8b30dfa4e78ed0149e570e32c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683007823, "uuid": "e52a92d9-77ed-4396-b649-b645929382c7", "comment": "Malware payload (njrat)", "value": "f3acdd302d62807141207683fbaae9436accfedc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683007823, "uuid": "175ae554-ff9a-4717-8354-30c87b56fae0", "comment": "Malware payload (njrat)", "value": "e09d923f00998259907823acc05d4b66e0fcb3644c9400d0fb65af9d068965f721387c3004920ccd208243fe91c6dbbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683007823, "uuid": "d4855edc-b1c1-4c63-8599-a6174ff416a8", "value": "T17D4598A7AA14BF4CD5933DB887A106625E14AE50B1C74EE90F5AF883CB7977733D8024", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683007823, "uuid": "3345c821-14c6-40ad-8d63-02e4e4527b2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683007823, "uuid": "844e1a23-0687-4055-be7d-a73ce0ec3539", "value": "12288:h7lnRwd/hVxClswcTZlq9l41gzXCkII4y/W2:h/wd/hTClsx1gzXXII4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683007823, "uuid": "9150e8ac-d883-4b72-8025-d308822707b9", "value": 1167872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683007823, "uuid": "e39e1efd-a143-47e2-a805-48b0ee63ccdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683007823, "uuid": "8be4e6bb-3921-434f-af7f-4a8b3b40c55b", "value": "FCF0E6732462CBA8A909CCDFD4BCD1A86074CFC8B30DF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0da8b1-e8b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683008724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683008724, "uuid": "8df3b905-713d-41ad-b1c4-e15af204e75c", "comment": "Malware payload (AsyncRAT)", "value": "60048276bc28ab0b9fa976a535a36562", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683008724, "uuid": "153b1d11-75ef-429e-8e6f-b0db3b5ff12f", "comment": "Malware payload (AsyncRAT)", "value": "fd927ccd954b92b1ee0b6695108361066b74dccb7bafe5dd0a7cb37147af1c84", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683008724, "uuid": "a6192393-094d-4e07-958a-d1bd10da0bca", "comment": "Malware payload (AsyncRAT)", "value": "a07322e218c5bbb6bb600f21541706ce335fdc69", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683008724, "uuid": "72069421-9040-4fac-b8cf-4c72f3641fed", "comment": "Malware payload (AsyncRAT)", "value": "b9c468108510f552fa2e7ba6c5762533465960a354a147588fc2b5052c8fdb595d544f3d53da4f489edd15ce76523e73", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683008724, "uuid": "1de47b09-890f-4f7b-bc33-a6450775a9f0", "value": "T1DE253A4BBCA050B9D0A9D23189B651917B31B8991B3227D73F50B2B83FB27D85F39364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683008724, "uuid": "a102f961-7c34-403b-8c30-063e9a6913a8", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683008724, "uuid": "cf64d628-9cb0-4e42-a778-b95210f2f86d", "value": "12288:E4mT/RcXtvyJdBQhXVQpfDv4alfZqby13caYgd2DNSD/+6FO5HOfI:E4C/6XtvWBmQpfT4gcaYgdkC/OOfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683008724, "uuid": "e2f470a9-a85b-450f-a6f5-932bfc488c77", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683008724, "uuid": "00e59937-72e2-4846-b985-c0de879170b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683008724, "uuid": "9475db7f-72a2-4455-9daa-30f6bdb154e5", "value": "WinZa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ae44ab-e8d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683022316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022316, "uuid": "b2bce70f-cb1e-4a64-9954-320a2a61e9df", "comment": "Malware payload (AgentTesla)", "value": "0835fab006ffe0033622f80ba3212b91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022316, "uuid": "abe56d3e-afb0-4f70-99a1-d0214096463e", "comment": "Malware payload (AgentTesla)", "value": "fee1491c964ce2a96ba7671cfb51cb3074d7863eb5332ba5150fae19e95b4052", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022316, "uuid": "ee5ee9bb-d21d-4f8f-bfb8-5b27485c9ba6", "comment": "Malware payload (AgentTesla)", "value": "4128298739d46aa5e3ec05aefc5d5fd10cc35576", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683022316, "uuid": "4284d7cf-d33e-4f56-9728-e0de2f18b6fb", "comment": "Malware payload (AgentTesla)", "value": "bb3a1f08975e188036871da768768544750fdd60031f6dc9dfc02624ea2ee1af0458e145bf20d2b482c8e581a136b568", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022316, "uuid": "b5a7bc73-f3d0-437c-b14f-80bfa3706b3c", "value": "T1FCB4236EE8EC45DB57A46C0DE471D516FB8F80BC8D8827A45D95791802CAFA38348F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022316, "uuid": "d427ea57-39e8-4511-874a-9af9b2ce8deb", "value": "12288:J5YBdG2qScvJXlolFMi99Ioxf++wZ2E191pg:J5+gHSYXlolt9lF++KTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683022316, "uuid": "28f52d0d-0e36-49dd-8bd3-670806ed865c", "value": 518150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683022316, "uuid": "d930ab4c-4bef-4948-9b35-38361be3139e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683022316, "uuid": "0811c1ef-0472-493d-b567-6385a61be547", "value": "DHL-AWb 451387.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9f6821-e8ab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683005849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005849, "uuid": "cad7e609-da9e-4900-beac-4129cf24b919", "comment": "Malware payload (AgentTesla)", "value": "a7ad0ba62dd43be3bde3182daee37242", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005849, "uuid": "4ade79b2-5206-4218-8409-043752651092", "comment": "Malware payload (AgentTesla)", "value": "ff93a2e2fc9a3ff0bfe4ae5b9bef84478972cc403c1c68ce1de414e19acfa6ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005849, "uuid": "e291a9cc-d07c-4a29-92e2-63cacd05d0b8", "comment": "Malware payload (AgentTesla)", "value": "2d020705a207956277362c288631aefce048fa20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683005849, "uuid": "c31410e0-96c3-4f5f-b7bb-de0421f4c5fd", "comment": "Malware payload (AgentTesla)", "value": "3557b95421ce716d77567ef344e36f8ea49332b9d031d4c773af8f0810315cf223a7e8d1c81f06c7db079557fbb81466", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005849, "uuid": "d1637387-2624-4685-bc20-11e5df0f4eef", "value": "T1F8E4D00122B4CF2AF939DBF45474FB4423F1B07750E5D2681EF6A0DAD9A9F040E64A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005849, "uuid": "0439ba5e-9793-419e-aa44-339418e9258e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005849, "uuid": "d77cc341-b436-4d69-b373-0811403a2774", "value": "12288:zL2iNvRDWMdaJT5dQqreSItmis1ZCbTXXCk0pGShnSJ1dxAsS/:v1tRtdaZkkeSIhs1wrykXSMJ1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683005849, "uuid": "c5f4b13f-d968-45db-b84c-7f99f80e7747", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683005849, "uuid": "39e52abe-24ce-41cd-ba41-c7f6677ec933", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683005849, "uuid": "056a4c93-c124-42a0-92aa-ce67adab3cfe", "value": "contract copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519a577b-e8cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683019975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019975, "uuid": "a8bc0e27-2a47-40ab-86e2-954860eb8279", "comment": "Malware payload (RedLineStealer)", "value": "b6b64f32d82d4a81b8ac1228315191b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019975, "uuid": "858edbce-1558-4826-acff-980f6cfd6618", "comment": "Malware payload (RedLineStealer)", "value": "ffbe21ca74f8b1bae675ece8100925b8dc237ad474c30c6ad445be5f5129b1f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019975, "uuid": "565ac55e-b1fb-403e-a0f9-42a505427f37", "comment": "Malware payload (RedLineStealer)", "value": "aea927ab8f17b49975b52e27199eb1a3a8f996e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683019975, "uuid": "fceab2a8-accf-4bd1-8d44-112e25ca213d", "comment": "Malware payload (RedLineStealer)", "value": "2ed536bb62e2521b50d372cf9dce23a516c049f764e5969a94fbdb80cec63c071497b79bd1e390b93c2c8234023f49fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019975, "uuid": "7e5e0190-eb9d-456a-94e1-04894f9f9249", "value": "T121152382B5E49032E9F957B029FA13D307363CA38A7C93EB2359998D1471695E03973F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019975, "uuid": "b3dc5a50-a8fa-4bd5-8a88-8d7866627b4d", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019975, "uuid": "78a16167-2da4-47ad-b147-d45fa632c9d0", "value": "12288:ry90RoTR2k01IBfde0rIkc9dqUWTjm5N+Y4qQuGg8AG9AQJIm5HNllyzFegYzBkN:rywoTR2k2IZde0rK56WQldIm/dDz6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683019975, "uuid": "9c5f28cd-ec2c-4536-838a-1c78f5f2b802", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683019975, "uuid": "74468afd-0102-4181-bb0e-ff60e3f0a952", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683019975, "uuid": "a8186498-7290-4b75-adc2-a164f60ddf2d", "value": "b6b64f32d82d4a81b8ac1228315191b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8dd95d-e8cf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683021314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021314, "uuid": "65034b67-6156-4177-aeb6-dc32da7a263c", "comment": "Malware payload (RedLineStealer)", "value": "050ac42fe77e86950596c29a63a4ab17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021314, "uuid": "3e824b94-d0ca-4447-a777-e892ae363de6", "comment": "Malware payload (RedLineStealer)", "value": "fff847bddcaa2765ccb6c404dd0a8b7faebf1381504c749fd32d4c6eee0a0b0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021314, "uuid": "0fede2d1-4895-4379-9f60-33e6930427a5", "comment": "Malware payload (RedLineStealer)", "value": "12c29e07264d5ea8d7f965773a6bc59d7c00dc71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683021314, "uuid": "25ea7e39-3995-40da-9060-744857e94ecd", "comment": "Malware payload (RedLineStealer)", "value": "5fe156569e3fc3bc62c0e7f3b2adc7fdc8c6fecd916b9c78191f04767d7c33cd7fb319a35406744b9aad3f50165a1947", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021314, "uuid": "3d2ee7b0-e9f3-4caf-8540-c5d89db9c0f6", "value": "T194A56CF095AB48D2E40BEE9269BCFDE6073671F3CEC50954137D39085F27EA8A90494E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021314, "uuid": "d2d7dfaf-6780-4920-8169-dcfc88bebdef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021314, "uuid": "d8122b25-745b-4984-84b9-02a1c71d090e", "value": "12288:oos15BzNZbiCqAy1qffz+j1KoPXzvvh0LE3ycFVj4HarxuRczHTqqgfw962GfOYM:oosRuqz+KAXrvO0PWHarxQMHHWL5jvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683021314, "uuid": "c27ca493-fcf6-4773-97b6-b58754911147", "value": 2151424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683021314, "uuid": "db6e174a-542f-4847-89e4-e288747ee249", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683021314, "uuid": "0ea9c821-b092-4dd5-81e9-49f705417a5a", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }