{ "Event": { "published": true, "date": "2023-02-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-02-02", "timestamp": 1675382582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "653c0dc1-0995-41a7-87ec-45f3afc44300", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e30686-a2d9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675329225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329225, "uuid": "a050c843-2885-402e-9cb5-bbe96df94e0d", "comment": "Malware payload", "value": "dc854a7fe3d5c79ec73f5c3ece1bfb58", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329225, "uuid": "cd9c661a-9309-4fe0-8d65-df473b985d42", "comment": "Malware payload", "value": "00000f6dc506c0893973cde12e43be88be103b7f07c3f1f12dc97f4d157e29f8", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329225, "uuid": "50d9d6c1-a62e-49a6-b71a-1fd1c2a5821b", "comment": "Malware payload", "value": "53e49a25dc2e72d959256277b66643a3f0504efc", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329225, "uuid": "5d39c386-a2ab-4c64-bb37-e8392c710b07", "comment": "Malware payload", "value": "8b9403a1722482b70ea034e571d5e7af6508193f767fc50a2348214a5863fc342d715897b21372924ccd6b002fe46cb8", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329225, "uuid": "55d09a3f-353e-4d7a-8b1a-2aa5d2ea63e9", "value": "T18604D10226F649E5DEE47BB25DE3571DAA27BE27E222035F4BB6662D4D60310DC0470F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329225, "uuid": "c997bc49-2c71-4680-9a99-e9994edbbf5d", "value": "3072:QaA0YRw9/WITtTWR7IbNzvL1aA1SuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCC2:ea9xytedL1R1A4iERBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675329225, "uuid": "aec0bd9b-e263-41fa-acb3-85a36d1f4a3a", "value": 180063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675329225, "uuid": "d1fbce6b-d3a9-4fec-b632-1741222858ce", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329225, "uuid": "d263af29-e8aa-4f86-9cf3-fe405041b2ec", "value": "ComplaintCopy_74987(Feb01).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cb42ff-a2d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675327934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675327934, "uuid": "6bf2af7b-bd08-4759-81bf-f3dda1277953", "comment": "Malware payload (Formbook)", "value": "fa79fabb2d811a14fd5b8a6614ab77e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675327934, "uuid": "e9c2858e-b31a-4499-990a-7838caf69dd2", "comment": "Malware payload (Formbook)", "value": "0067b252ab478516ec30b56fbb160b7210083c5d10f1b06c4233a3f92bdec28a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675327934, "uuid": "f2abffdb-cd6a-49be-8c5f-402c6c32660e", "comment": "Malware payload (Formbook)", "value": "0e61cfa5525bbced902f0df595b1f9f9959fa56f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675327934, "uuid": "30a8ce5f-7656-4777-8350-4a09cd422f96", "comment": "Malware payload (Formbook)", "value": "76b8098fe7ec0900c1e0c504971899a3246d13903e9a2dcef97eef6826e63e8cfecaa27be3a359fbf5fba6e25b0d00e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675327934, "uuid": "0093344a-e950-4f6d-a5fe-3b88984420ef", "value": "T14054D09C326470DFCC6BD0768A991D64AB6078BB530B9207D0A716ADDE4D69BCF180F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675327934, "uuid": "69a274ad-351c-46ec-b831-87964c1a62bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675327934, "uuid": "48ce7ff3-7dbc-46af-a215-36200aad1636", "value": "6144:WPbLJvaK0pjj5iQMz1kOIFuPS0FruvdoOOLMiMAqOLsKqJEJrPwvm2Oh:WjLQ/1seXYruvd8aOjSEevm2Oh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675327934, "uuid": "51438e70-8794-4c02-a370-17c9b8e9b6a4", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675327934, "uuid": "d2563757-5f6b-4638-b063-80f64e6df3a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675327934, "uuid": "321fd01a-d33d-4286-aa40-8ce3b0cc2f89", "value": "DHL Express.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266c2992-a2f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675340072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340072, "uuid": "eb964426-9de3-40c5-97b7-b1d90f7fdff6", "comment": "Malware payload (AveMariaRAT)", "value": "acc697db4d7fea0b44d341ba251c0c71", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340072, "uuid": "272e8fed-ee24-4a2a-b852-535e3830d718", "comment": "Malware payload (AveMariaRAT)", "value": "009c9422644c39463eaad27e4f3ad07864170dba41fd384b7f98bc2481c772b2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340072, "uuid": "1bf6eb34-1d5e-4eef-90ed-5ccd8a730da1", "comment": "Malware payload (AveMariaRAT)", "value": "d710bc5e68eed1670fb0cdb82898a29ebd425cc2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340072, "uuid": "f5e3cce6-cf93-4972-8856-8f9208e7952b", "comment": "Malware payload (AveMariaRAT)", "value": "c3ed1479cc1cd0b9db1c87ee0591526192e3f4e070c308bad54405eab72dc191e56f61587157a37730a4eba354ad5bc4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340072, "uuid": "91588102-b352-43e3-ad50-b25aeb9dcd9c", "value": "T1E6C4F10B6DC216F6C4A58970E3ED14E916F1575B2129FBEB2CD442F4CB8679FA0421E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340072, "uuid": "8db6dcff-eb53-4e08-8604-a1c26f8d8d50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340072, "uuid": "46d8d9af-e481-4320-9d23-003315ca7cf7", "value": "12288:eXeMgr8gZ8UsovrjQmNUvXdCtt+F5IBRKYWTHv:eLKvHAvXIRuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675340072, "uuid": "764fc975-1a4c-4628-84e9-a0a8f05c2ac5", "value": 583168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675340072, "uuid": "097370b9-6d9a-4859-81fb-d313a68c328b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340072, "uuid": "3d2b4e91-77a9-46bc-80dc-63ea2496ae66", "value": "acc697db4d7fea0b44d341ba251c0c71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be4d263-a34d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675378816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378816, "uuid": "947c7aee-b2bc-4726-b168-b31959d93ef5", "comment": "Malware payload", "value": "c975aadbd6d3a8ab02dce380f22e744b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378816, "uuid": "0cf8f0e7-214c-47d0-9bc1-49d08086e55f", "comment": "Malware payload", "value": "00eb3bfb2d8276e6bcd52293e284896d7d72bd2c2eab173ec910ed80f9fc7e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378816, "uuid": "5da79a86-795c-4075-b9c8-4dcf344b3a55", "comment": "Malware payload", "value": "d190d692b42506c8bc9009d4566fee923708c7a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378816, "uuid": "bd9219aa-7882-4b53-a80f-83453341db82", "comment": "Malware payload", "value": "3bc446646532c58ad80860e661dd21542a22308d10d99c95b3b12ea421b07c7cf3b3baa5a20853a74370cf562a9cf7af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378816, "uuid": "557b0bfb-960c-4b2f-916e-db3abb8a8ba1", "value": "T169648D426293FC41DE65CB728E1EDBF47A1EB9918E286F6A12195F3F1972073C5A3310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378816, "uuid": "794e90e6-9f13-43cb-8137-e952e7a172c6", "value": "2ff60b2f756b6533c2643b340c02a5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378816, "uuid": "2829dbf0-28fa-40ad-a388-0cc1fb84288e", "value": "6144:j6bYLL6ih1wS7p4gOwj/EGlwKwpx1t7jV6ptCbNKN:j6bYn6uwS7p1QGle1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675378816, "uuid": "cda4be66-5967-4bb5-8b2e-89bcfbfc3af5", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675378816, "uuid": "5fdd43fc-c25c-4e28-a670-f08b28209dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378816, "uuid": "e22c42d5-b80d-4017-846b-8dcb2c5afc9a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5327774b-a292-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675298486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675298486, "uuid": "93ccff10-30dd-4136-9ad8-fa8891aeda58", "comment": "Malware payload (Amadey)", "value": "54fa8ae6671f98d704489ab97e7d47a6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675298486, "uuid": "2de8ebf8-e35e-4959-ae8a-83c0f53cedee", "comment": "Malware payload (Amadey)", "value": "014cbe5bdcde3da162378765e82975509eb964079627c95eeb975eba9f8828bb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675298486, "uuid": "dc733010-75bf-4340-aab2-e9eb580164ee", "comment": "Malware payload (Amadey)", "value": "420336123e74288f1675ce3d9b490b2f4a1e6b81", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675298486, "uuid": "9c6f01bb-8657-48fb-b586-48d287bae590", "comment": "Malware payload (Amadey)", "value": "af3d9f94592c0351c05045367b0295b6d5452239f38224c19415685fda990457c43953165ed79774b5a2b9ddc7e959ee", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675298486, "uuid": "93c9f3e8-aa30-42b6-8e09-c9c56eb7884f", "value": "T13844E13239A0CC72C52B04745C30D6967B7EA93115B9991B77980AAE9F703D137FA38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675298486, "uuid": "54afb533-af6a-4a14-a96c-2f0a606bf706", "value": "5b3e1365fd24e4232cba105b88665e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675298486, "uuid": "dd028c83-1a2f-4759-aa40-34833ea4dda4", "value": "6144:03a28LjlPXli/8LnzAAyGRllMS79+yRSQS01ZA:03a/PlPXoAMGR4I+7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675298486, "uuid": "77515e9c-cb04-441c-a2fd-4e1fba1b1d2d", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675298486, "uuid": "bc73ecf9-1369-4855-a76b-d3baef93c521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675298486, "uuid": "661e4389-625a-4547-bd08-260c4f17f028", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd799a1-a2f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675342366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342366, "uuid": "1b222d1a-3110-4a12-abb6-04ddb4dd9f82", "comment": "Malware payload (LaplasClipper)", "value": "4d4a1306cd248db7b9656672df7243bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342366, "uuid": "5d68391e-bfcd-4f2d-b321-7a920909db10", "comment": "Malware payload (LaplasClipper)", "value": "017923447224c91f2aaac9c108cdc3f4a02996a6aa3d7bb435a3e81f8401ba71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342366, "uuid": "43af325b-6aa7-4531-8a54-dad47aa74c42", "comment": "Malware payload (LaplasClipper)", "value": "4caaf7ca01ea8df92762537dce545f129299e70f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342366, "uuid": "f15ab9bf-9085-4174-8976-4831d09b2b96", "comment": "Malware payload (LaplasClipper)", "value": "73e801eb9f483fe2b86851ec9d0270ee55054e767715fae63ac4300579be864029a2ba15fb85a03a0d9fc60a5f788b9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342366, "uuid": "31bcda75-b29a-4ec7-b3b3-d4f1df8fecc0", "value": "T1A9853310B9E3CA7ECE09D6B3FD28E09C19B3A9849431810E3764F37DAA959C54FB6354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342366, "uuid": "5e0e1560-015b-4462-a570-14915cbac6a8", "value": "20540b45038474bafe70cf1c181e44fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342366, "uuid": "dba48ee9-bc90-48ec-888d-a5cb81a6bc97", "value": "49152:klxuqnfElY1SKuSUCJlu084P3k+m4mpt:kruqn8muS9JA084/mVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675342366, "uuid": "f97506e5-0374-4902-a2dd-7ca4cd19a24c", "value": 1827328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675342366, "uuid": "3f33264a-5a84-4887-9f73-11bf3aa78d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342366, "uuid": "c7573d09-f0db-48fe-9a5f-bde7c35b9d45", "value": "4d4a1306cd248db7b9656672df7243bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1348aa9e-a347-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675376117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675376117, "uuid": "c9dcff81-be34-41ad-aca0-e38986ed54ff", "comment": "Malware payload", "value": "84c01857a7bbed2e2f567f4c0655dafe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675376117, "uuid": "2c876591-956a-49c6-aef1-e73b4bb846c9", "comment": "Malware payload", "value": "01a96307d05004e86d435f7268f231c6e87b4cc81414e925bdf05bb4e906e49d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675376117, "uuid": "1463fb49-d689-466a-a37f-7841122189b8", "comment": "Malware payload", "value": "b3e21e3490ec34f9ef7dac83a52b67f6ff338c1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675376117, "uuid": "a1e19ed6-aa87-4a9c-bbcc-c4cc6df3512a", "comment": "Malware payload", "value": "39302ab8db086fa26e74484dcee6f2393ad5376a64267f4b12bb69b80a28ddc7370f10714eab8064b1edfdf23e79f6ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675376117, "uuid": "8d3ec849-bae8-4cfc-bf01-cec65042e286", "value": "T189A53310F455DA76C1A2C67D6C262605EFA7FD127038131632CEB6AE2FB73F0A899644", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675376117, "uuid": "815738ff-6d7e-40d6-9dd7-51e4bc0c21ef", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675376117, "uuid": "297a3628-c6e7-4376-b43a-73f81be7bb9c", "value": "49152:bgTavAyyHMEjzqEV2y411ekHWN8MNxYFC6mFWeRQJcfmzLCgv2MR:cTavAyuM6qE4y411jHWNz5JtR4d3v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675376117, "uuid": "7143d9c7-7b30-4e41-81ae-bd2531b26a32", "value": 2106073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675376117, "uuid": "00e5163f-0ba2-4d89-a654-42de676b9ce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675376117, "uuid": "9ee89c48-f499-4922-abd9-06cccefa9521", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47f4327-a2e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675335639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335639, "uuid": "f397648f-3578-43bc-9157-fcf54307a1d1", "comment": "Malware payload (RedLineStealer)", "value": "d343fc61ec1eb34ad0ca4bc8d9a95ff9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335639, "uuid": "f951304d-82d8-4512-94bd-7bfcc567b4ac", "comment": "Malware payload (RedLineStealer)", "value": "01c007dc096c0fc7019e919cc088655b0f2b494d96c1c4bf6f8601d49a66764d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335639, "uuid": "05b0a962-a4a7-4f31-b6c3-39c97612c4a3", "comment": "Malware payload (RedLineStealer)", "value": "800f9e5e2bbc309796943cb156c5ea4535cc57c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335639, "uuid": "9a109d96-50e1-4755-92e9-9c5520d3d4f9", "comment": "Malware payload (RedLineStealer)", "value": "8f2b05ce9cb55f91ad09e388a57e98b061355526203c358d97e2c935d35e872ae7dba2310a9612af0cd7daae3aee2905", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335639, "uuid": "0aff232d-9520-4a06-a995-0e2d1fd636e3", "value": "T10A94BF42B2E1BC49F535CB719F3FE6E57A7FBD008E1837B62214AA1F14711A1C962325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335639, "uuid": "36dec131-9e67-4890-83f0-159317aee3d1", "value": "20540b45038474bafe70cf1c181e44fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335639, "uuid": "39fdc21b-0282-4776-a158-8e82153aaa23", "value": "6144:eoXiL1OzpXi8IV3xQPzS7NgYGmuNt8FirqeDyID9/CJTk637eQfnd5bEsaB:epOPIvQGhAbywrnei9CJb7d5bEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675335639, "uuid": "5b911f4d-c4a7-4c28-baba-63385e504093", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675335639, "uuid": "e13df46d-f569-4790-ad44-0664e2d1bed7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335639, "uuid": "2ec39dee-480e-46c0-a0e7-b5680831eb0a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe162609-a297-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675300920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300920, "uuid": "ca316429-3949-4772-921f-820e87faab1c", "comment": "Malware payload", "value": "c41a3beb745832d8c2d4a1de767cd2d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300920, "uuid": "2fa9d8ed-091f-4d35-a225-8072435eb7b3", "comment": "Malware payload", "value": "01f496fe1bba44638255a2736e06843adfaf5aa3e5783bd7118d91b0f5bf926e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300920, "uuid": "09420c3e-3871-4014-a516-8b9ac610489b", "comment": "Malware payload", "value": "22ce5ae8070f0d58ed4943102f0a916c2ec5cb57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300920, "uuid": "cf984d4e-bfa4-4260-8826-efab7c63fdd5", "comment": "Malware payload", "value": "944c724d73a6220252bac51604b307372823fc6cf77c9aed31984fc363bfb6dba65ff199c2097403754bfbc35f18731c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300920, "uuid": "3ee19d5f-b8e4-4daa-b344-e68a78a18e0f", "value": "T12A86E081A94180B5E49A207288ED585895A76D610F6420FBB3CEAFDD8F735F12CF3E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300920, "uuid": "156a7266-ed10-48b1-a95e-5ca96d8a2bec", "value": "6e551c0a9f0f6a58f69d26c09ab0f270", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300920, "uuid": "ce42e87d-7f47-4116-b0d3-906fdfa34281", "value": "196608:6+mg1oTQUBXJ4sErcySdr7mKqAa+dfeIpjR:62GMU9qRr5gv/+Ipj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675300920, "uuid": "88ea2078-0856-4595-97a8-423d82865f40", "value": 8155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675300920, "uuid": "9412c36c-fc26-4f2c-81c6-397a767e2808", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300920, "uuid": "7b6c0316-abdc-4597-8d86-b52d63f4d1f6", "value": "01f496fe1bba44638255a2736e06843adfaf5aa3e5783bd7118d91b0f5bf926e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2dce5f-a315-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675354849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354849, "uuid": "7a6d1564-838b-4d2f-be52-d150f0fd1575", "comment": "Malware payload", "value": "5d4700394df5f8e2628749b829053a7c", "object_relation": "md5", "Tag": [ { "name": "1675352134", "colour": "#43F4DF", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354849, "uuid": "d656fb91-5f9e-4c7b-b567-59b927ea9161", "comment": "Malware payload", "value": "024630c0af7e0af46dd856451e7a382f3a0975e94153e710249bd6a64934dfa8", "object_relation": "sha256", "Tag": [ { "name": "1675352134", "colour": "#43F4DF", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354849, "uuid": "0eee473b-e788-478f-90eb-638a949012c2", "comment": "Malware payload", "value": "aef6363b6d8e38e646928eb9a057461aff981dff", "object_relation": "sha1", "Tag": [ { "name": "1675352134", "colour": "#43F4DF", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354849, "uuid": "e2820dfe-a87f-40cb-a695-34f187b5bf3c", "comment": "Malware payload", "value": "8d6e0c3f1883329c3c565b80165a06e2902740ed7a3a3b124db6c3121f44000c818678038d49cddb072c77643b7e2ed4", "object_relation": "sha3-384", "Tag": [ { "name": "1675352134", "colour": "#43F4DF", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354849, "uuid": "0de9c92d-b800-45ae-8579-19ea3198b5c2", "value": "T1AFB4AE42EBC702E2D95A2A7864FB3737733693974217CE87D338CE736E21361A91A145", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354849, "uuid": "73564896-a5bd-425d-8b15-90dc0e3269e6", "value": "88a9618d30da3507c4e11f4ef0e516e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354849, "uuid": "a838ebd9-46a7-471d-a937-09ed3a3b120b", "value": "12288:ldu4vzN4CtsMWsbw2Nx0sgEv91zQ26KZ9eY7b5ruC:7vzLtsUbw2Nx0sgunXxB9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675354849, "uuid": "d4ea7245-905c-478e-8302-78eb86368425", "value": 534324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675354849, "uuid": "0018e3e0-19c2-42b5-85e1-ccb16b3b15a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354849, "uuid": "0522ca66-2cb3-44e3-80d8-7483ae5bf323", "value": "3.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6d0076-a2c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1675319149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319149, "uuid": "e1d7588e-47db-4f57-8946-d12a043c2e29", "comment": "Malware payload (STRRAT)", "value": "2e66758be40b235dda864c135d31eaee", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319149, "uuid": "0c0f0774-b1d6-4150-8388-5ad7822b74f7", "comment": "Malware payload (STRRAT)", "value": "0466fd19f00357bcb1e949bc0b382743ecead8b752d3b2e69aabc262e407716a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319149, "uuid": "33805b42-f336-428c-b778-8b07d1a8eb32", "comment": "Malware payload (STRRAT)", "value": "7c61179368dc08812b3bcebb87e8ec2e603a568b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319149, "uuid": "dbe8da5b-c1ea-480c-83a0-65b5d695f72b", "comment": "Malware payload (STRRAT)", "value": "3ce800619b9abd06981c6436e1fb4683228f5a93ae2c6e2e892c50c62a0788079ec5be62047cb0268c4a2bdba63ebf22", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319149, "uuid": "ddb673c4-d02b-41da-b6bf-78a2938cfc20", "value": "T1A124015FBDD990DAC0BB623E0096863AF62D0594D11EF13B35ED68924D32CAD2351BCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319149, "uuid": "ad07388d-61b5-49bc-91f2-53231186a1ed", "value": "6144:FXkbIQtTRLeB3hg45l7FrHZUCCzVF9fU4KawxN:abIQWFl7VuVhF9Myy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675319149, "uuid": "bf9b7916-55e2-456d-9b24-fc6de024a173", "value": 225233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675319149, "uuid": "7f1184f6-d1af-489e-ae01-9d81d7578681", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319149, "uuid": "28dcdccc-a620-4c2d-97a9-a24fe61750b8", "value": "INQUIRY K26029 2023.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5097c226-a2f2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675339713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339713, "uuid": "9577ef79-2890-457f-8aea-c051d1af53cc", "comment": "Malware payload", "value": "eee9a7ca22054f501441aeb2a5d1b099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339713, "uuid": "5e9f42fa-cb82-4101-9681-eb4fb29a6bb9", "comment": "Malware payload", "value": "04734a56c82289ac9015acbec07eedf031126a72a8b39059b4adb8eddac1971c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339713, "uuid": "340b7e0f-d5de-4cb6-8b17-6c677697a6c0", "comment": "Malware payload", "value": "f0bd8d740b3b17efa1476fc8ae9bb300d2186aa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339713, "uuid": "36e0e4f7-18c8-45d1-b703-0830a919bf7e", "comment": "Malware payload", "value": "bc6bedc89e62b50d50d03049c8febd1ce597e7f0dc2aa7b8c6a22604a0d7f264fbc93751ba7b6b45909dcf342f3bf510", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339713, "uuid": "163dee13-57c7-416d-b0c8-4d774a744df6", "value": "T1106412C97994E87FCC17D03A49598D948BA67677226FE293404362DA5C4FF1B8E1C0B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339713, "uuid": "66a54c7f-9c59-4555-b1cd-079471c579f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339713, "uuid": "0b10ae29-6731-4a9b-87bd-2bb87085c580", "value": "6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675339713, "uuid": "50f6188e-152a-4ce3-aca1-9b184b7083d6", "value": 333227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675339713, "uuid": "50c2e3cd-33c4-4b68-aad4-846cdfb4f610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339713, "uuid": "30ccb49f-7d01-44a6-a551-30876ef6d987", "value": "eee9a7ca22054f501441aeb2a5d1b099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6dabf4-a2a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1675306876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675306876, "uuid": "d816b7d8-9352-40a7-b893-cc44c4b32b93", "comment": "Malware payload (TeamBot)", "value": "a4ba32eb4555ed7547ec5b24c3fc40ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675306876, "uuid": "37395ac7-e431-4ddc-8191-18109a9179d3", "comment": "Malware payload (TeamBot)", "value": "0479f76018550b4fabe27f89557e337ecfc20d0b4c014288c5514518ff005728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675306876, "uuid": "ee148c16-2c46-492e-b23e-6c88fe9d0a31", "comment": "Malware payload (TeamBot)", "value": "617c39840ec8332b3d7e4f3bc3e5bdebda1a028b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675306876, "uuid": "f933c57a-42a0-4c7a-900f-0a4d94e64d91", "comment": "Malware payload (TeamBot)", "value": "d7500ddcd8db1c089440d4226df6626b08efd0177b298b829cf313b95f9415c7dba7aff6efa564f24e6241aba2edd5c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675306876, "uuid": "de06d7cc-1df2-421b-9b3c-577b793f785b", "value": "T1F134D03279D0C0B3C1AA1070ECA0DA957BBEB5310575998B7B9C16BE4F713D0663A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675306876, "uuid": "3d9438b7-7c40-400d-916a-01a960f66e92", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675306876, "uuid": "1978cbcf-c25f-44cd-82dc-6ab24dc65171", "value": "3072:Gpke8yBisxjPjxLk+cWVE5Y3iqF0zdYTxzRBIx/yuwmjrx9:Gp5jp1LbcQh3d0zyPZ9mf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675306876, "uuid": "823f7bd1-9848-4115-82c2-e4064574d92e", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675306876, "uuid": "53167ba0-9622-4deb-82b2-210b5db8ce8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675306876, "uuid": "e5236838-8289-42c0-9be8-7c819868287e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da565b36-a2c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Urelas)", "timestamp": 1675319328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319328, "uuid": "e9c53fd5-7248-459e-bd99-fba26fdd5e27", "comment": "Malware payload (Urelas)", "value": "e74efbef2db2e1cfbb803fe7f36a0743", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319328, "uuid": "8488ee40-b7ae-47d9-ad7a-3e7a2aca9c2a", "comment": "Malware payload (Urelas)", "value": "04e655fcdd59710b409245bcfed959f67a97e6a756f4425325ad008e185a4ff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319328, "uuid": "323abf28-80bd-4b03-afd6-d1601d9d344f", "comment": "Malware payload (Urelas)", "value": "10f93d42f37e939e164086ffadf7f3eb81ac1e45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319328, "uuid": "527c2524-7691-4c2b-ab02-fc9ed7ac8c5b", "comment": "Malware payload (Urelas)", "value": "7cde23b11a095fd024b03daf2a2409c431cbdcdcf853863758fe08494ace5b04d0dd9dbbf3df6e47afe77d5f8a97ada0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319328, "uuid": "8118e185-4376-40f0-92e1-5c85cb0d3aa9", "value": "T1C964F056A60148A4F31D0B38186AF9D458959E7C55D8F44FF23CBE36AC7209B8EB704F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319328, "uuid": "6f45b9ab-06e1-4e1e-abc6-63e3e90118e2", "value": "09d0478591d4f788cb3e5ea416c25237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319328, "uuid": "9822f32f-f737-4e96-b00d-64a12478d2a1", "value": "6144:ELtOexihqv4m+lXD6betiTuBMTWjIDIiUBAkW9UOKMOtzWO8CatspX:EL1D+IatauBML42MykRai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675319328, "uuid": "afd9e2c4-cba1-4b15-b3ac-3eb8756184d3", "value": 324815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675319328, "uuid": "27d0e4a5-ffdd-4fa2-b92a-013080f97e48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319328, "uuid": "c4c2a75d-0e23-4732-87ba-ff8cccef595e", "value": "application.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b45b081-a2a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Blackmoon)", "timestamp": 1675307572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307572, "uuid": "462d640a-fb1e-4a93-a959-20f6984b70cd", "comment": "Malware payload (Blackmoon)", "value": "65d98b08626656ce4ea3234b3ba6afea", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307572, "uuid": "e4aa5124-22bd-471b-b11c-a12c57e53fc0", "comment": "Malware payload (Blackmoon)", "value": "057f97594414b909d605b9e470ed2607190f390a865153c5f0c295039bf48e9b", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307572, "uuid": "d5d9c59c-3b2b-489b-8794-c8dda291cc11", "comment": "Malware payload (Blackmoon)", "value": "ea85f30e53beca788a501f5fa877990f1a6cd5f8", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307572, "uuid": "13396b19-d7fa-4cf0-ae96-2cb7c51c3d22", "comment": "Malware payload (Blackmoon)", "value": "fb75483a6966ee62b12d5f669c72f3049a62b83bdf23940b0a34113c05e3ca3cf90341236c96c165e17d350eaa3e574c", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307572, "uuid": "16529c87-f540-4dc0-90ac-d70744770c9c", "value": "T1E5A5AE12F6D380F6D715053004BB6B3AEA359A460B25DBC3B39CDD6C7F33661A52632A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307572, "uuid": "c74f9e0d-8320-40ac-8614-7bc5d6520839", "value": "b548fcce9d87e8cc825d6c22aabc12b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307572, "uuid": "d578f415-8784-47f7-b457-11d30024f9fe", "value": "24576:8SH25PwcN2jx23LdZNtWFKVwIdaY5VFt1LuqJhDqGFeyUQPurCD8JYjSK5ECh:8lDoOTNtGKaIvfuRVy/Pur2Mgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675307572, "uuid": "263f86d7-c41b-4783-84f5-1848599b346d", "value": 2129920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675307572, "uuid": "01950635-cb89-495d-8a59-2db37552c32d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307572, "uuid": "d2ccb11e-e4fb-41db-9efa-74a63deb07a2", "value": "ipsee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826f4d5b-a306-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675348387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348387, "uuid": "e6800df6-efe8-4da8-acf8-37e911c83e94", "comment": "Malware payload (RedLineStealer)", "value": "0efdd8a137be7dd25b1f528c0743aa57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348387, "uuid": "2b27c8da-6980-4e31-8a04-41d2ac0bbb71", "comment": "Malware payload (RedLineStealer)", "value": "06313ff3bc822a61b24fd0ccd7cd896a6ef3b6457b4e5ebf7946aa3f6e23273d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348387, "uuid": "3d25540c-2fc9-44a3-b664-1a162065f95f", "comment": "Malware payload (RedLineStealer)", "value": "fb693398352637009c41e7ab3c4d367d23aa907e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348387, "uuid": "87fe1c64-8c3e-4b23-ad01-43775a4b7a46", "comment": "Malware payload (RedLineStealer)", "value": "5c3cd2f4df0bc1b7ac35935cad3b04f60a3a42d433a673e7017965f43bd822c4cb332b1c3f018a0f08d9030972065c42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348387, "uuid": "3a2e6f99-9212-49f7-9221-f570dfb7f117", "value": "T1B2647D52B2A0BD99E7318B72EF1EE7E4391FBD408E1877B61214AB1F14713A1CD62325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348387, "uuid": "a81a095c-b381-46a6-9f3f-a24f05bce3ad", "value": "e479a558a3a55c2bde918dd7ce07e020", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348387, "uuid": "254ab949-1b38-4a55-97a7-24f9423b5c3d", "value": "6144:lOL+WrVV4Vb6I36w3cJR79/CJTk637eQfnd5+WBD:YyQVGz3R3cJR79CJb7d5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675348387, "uuid": "5e881839-2596-42c4-b37a-0868dfdf582a", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675348387, "uuid": "e97aeb96-a9f1-4d30-a86d-18be0498af53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348387, "uuid": "f8839f34-fb69-4b6f-96d6-d3b9b48687f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c0e565-a2df-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675331456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331456, "uuid": "faa0f47a-071c-47cd-b489-49970a3558cd", "comment": "Malware payload (RedLineStealer)", "value": "e0a90842f358b7c0aa926eeca45e5f0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331456, "uuid": "dd7483d8-79c0-4fd1-a124-d5828691c345", "comment": "Malware payload (RedLineStealer)", "value": "06dde21a625335975829a48f2993f0ccf99a62c1756bd58f3e110aed0be12c86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331456, "uuid": "679a984d-a411-44a9-81cb-370a776da8a0", "comment": "Malware payload (RedLineStealer)", "value": "b856e94d8ff977934c94458357da7cfd1195ee2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331456, "uuid": "6dc4963d-53a8-44fc-a576-9f89e57077df", "comment": "Malware payload (RedLineStealer)", "value": "ac9f8a0c44e5d3cec78b3aa07d586d9bfc3cd28c6cb0bf86ddb5f2c9bbbd1014c4a32190032ebc6818ba673ee92c2016", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331456, "uuid": "5e14a347-2eb4-40b1-a60f-4e3735b6a4ac", "value": "T1DC74F132B9D0C073C5B611305C20DAD5BB6EA93115B9571BBB991AEEBF703D0A33634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331456, "uuid": "5419667c-a962-4e2c-bd97-8496bf4892ae", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331456, "uuid": "f1d01745-1d0a-41b4-a8be-944927a52834", "value": "6144:WpLlKLrUX5n2/4QMStIrclaI3WgWO2xlamRktDMRES5O:WpLg3UX5n2/Vvt10g2lajMR/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675331456, "uuid": "0d581fe6-3446-4088-83b5-80b482a5dd35", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675331456, "uuid": "f1f51d01-e12f-4026-a289-a8208c914724", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331456, "uuid": "e53e44bd-2fd3-49d5-9fc0-f6a3d47e13c9", "value": "e0a90842f358b7c0aa926eeca45e5f0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d08ba96-a333-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675367678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675367678, "uuid": "e3331c89-c82c-4a63-b532-6dc675fc59eb", "comment": "Malware payload", "value": "872ee416b911925c61ddd11d2f3eeb7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675367678, "uuid": "3ae26e4b-d825-4e7e-81d5-00534b65c45b", "comment": "Malware payload", "value": "07a72d61154c37817fbb112e37e8a108886857d588c3df46cce7d84d92ca8ec6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675367678, "uuid": "3fccea3b-4958-488a-9cb7-5994c44789a2", "comment": "Malware payload", "value": "0e67384a4b89fb49f8f007af35122955cbf1d310", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675367678, "uuid": "d93a8e0d-2d3c-4861-8cfc-415c947c122d", "comment": "Malware payload", "value": "41dad881aa18347d586a520b50f53bd11cb7bd3334bab9a07db7ca7568e092df4018adaacf406d6130b1cb8060db2bf3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675367678, "uuid": "b28cba5d-6ae4-4daf-ad16-f138218a506a", "value": "T162E1D72057D90F37DBB68B359CB65340077ABB076943CB5D28C8676B1D89B8A0B60B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675367678, "uuid": "ec97b324-226b-4506-ab45-a9bc5589b112", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675367678, "uuid": "0a7c6304-74b6-4b9a-aeaa-b6f45c3e73f6", "value": "96:BG+1jsTi+wX7GEmPbnfK6IoP8ZY7ZMt5vdQ6k2CttLzNt:BG+eW+wXC9bfXPgGHf3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675367678, "uuid": "7e52b818-d79a-4593-8f41-13315a4fd7bb", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675367678, "uuid": "0ca0b09c-f980-40b6-b549-84a75b2739e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675367678, "uuid": "2fac8fbb-bb12-4f36-9680-e90fc4a20133", "value": "872ee416b911925c61ddd11d2f3eeb7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa9c70d-a345-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675375647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675375647, "uuid": "6ba5978f-c6d8-4f11-b444-215b09f90f40", "comment": "Malware payload", "value": "5cd473ede67f1c61c1428ecc257dd895", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675375647, "uuid": "0ba6997d-08a4-424d-8974-743dc95443a3", "comment": "Malware payload", "value": "07c0fec3a68cbddb707dc5782a6d87f556d15ecb122db19ec522bc7e17dfa1d8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675375647, "uuid": "5eaad951-260f-4f0f-8eea-ca9bc8421904", "comment": "Malware payload", "value": "1fd8deb6ed79d968252cc8b83ad7713ea287c384", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675375647, "uuid": "8962588a-c829-4bb0-bb4d-6fc82704295e", "comment": "Malware payload", "value": "b7b4dfca013759f8d2af63873222648706b346c0b86310c08cd97fd4edae34d6a54a773e1328502b7f6c234a1707b8e8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675375647, "uuid": "a3edc12f-bdc7-420a-8ff3-f18e99ae7f82", "value": "T1C5235C4037D88136F2BD4BB8ADF2E2458679E2576903C69D6CC814EA1F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675375647, "uuid": "68d3990c-7b79-4bbc-8521-91866cf1523f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675375647, "uuid": "11b850c7-b5e5-4569-9016-258511b1d8df", "value": "768:p96mxUTILWCaS+DiMtelDSN+iV08YbygefsC2Gq9MvEgK/JnZVc6KN:p96AKWMtKDs4zb16lqGnkJnZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675375647, "uuid": "4ccd25af-328c-4ab5-a49b-156b0783eef8", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675375647, "uuid": "7ed3b387-8334-4770-93c6-0df25255f960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675375647, "uuid": "d99f56b4-26e3-4ebb-a8fa-2bbef9a7998e", "value": "bJwF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e95ab04-a2e0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675331925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331925, "uuid": "28cd6d29-af9c-410a-aeab-f1b6ffbbab4f", "comment": "Malware payload", "value": "3b9c4e0bd9f84599fe3a2a8f65d9f66f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331925, "uuid": "3add4ec2-189d-4535-81b6-93d3871b110d", "comment": "Malware payload", "value": "088e8cfdc804b9315af5da7521db657f1a702d9c8a6e91c9f9200dbf4cf027a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331925, "uuid": "72a39e23-ad11-418d-af30-7d1a0e11cfa3", "comment": "Malware payload", "value": "6a85c459ca1de66c0a9fff06450281f61dac29f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331925, "uuid": "f8d7672c-efdc-4d54-b2a3-d8816c905e71", "comment": "Malware payload", "value": "af3a18e6fd6b5a7e19845db78a5b1627aa94774ad2be61278110367a1fb34de90578bfd672ada76c9f9c2444cc3bbdf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331925, "uuid": "0ddefbb6-9ed7-4e93-84d4-0bd1384990c4", "value": "T16BC46D8B5A7C04ECD122213A185259422438BCC927D0D67F62B07977AE73E97687FF72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331925, "uuid": "4bfea615-f67a-4c27-b623-ad226c161008", "value": "b3486a043d991c4458681371746946d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331925, "uuid": "e0238e88-14db-41c8-bc14-2e3ac648b271", "value": "6144:CfMLsUTqyKP4KLbRkst7NiSQxtjzKRgz32C46fyhH2KHhohqNA2xvB2GsMTUhdoK:CSsFtksExxzKC3+6fSLBo8m2hB2+idb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675331925, "uuid": "884a7b31-6c85-4dc5-ab94-88f9022083d8", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675331925, "uuid": "2e39c970-acc3-4809-94c7-97ee3d353740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331925, "uuid": "573aa758-1525-4faf-b237-9811f828e669", "value": "ACTA CONSTITUCIONAL LLAMADO JUDICIAL 30 DE ENERO NOTIFICADO JURIDICAMENTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befbbd10-a30e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675351924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675351924, "uuid": "781f9dee-bbe8-496b-8ec5-5103f5d99c57", "comment": "Malware payload (RedLineStealer)", "value": "6d326a3a98665c76d489137c77d14052", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675351924, "uuid": "7dc632e3-e7c1-4221-b863-60949e122bbb", "comment": "Malware payload (RedLineStealer)", "value": "093c52ea1c4a4859bf3d63912bacdf22b3a225b22201a6b18f2df4e83ae2cf5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675351924, "uuid": "d7738c4c-89e8-4c74-824d-13d0140baec8", "comment": "Malware payload (RedLineStealer)", "value": "f624055ebaf1dff3fef55d4fb5013562be5fc7e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675351924, "uuid": "12c1859c-4000-4120-a61a-836c5ebe167b", "comment": "Malware payload (RedLineStealer)", "value": "b64547274e1c108c592f17541c8d7baebc68414d284a9c7a7d5e90b58a1d7700e7d751ed9009c9da4159dcccbc89f8dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675351924, "uuid": "19bed399-d993-4b03-bc8b-1a29d676b961", "value": "T12A94BF02B3A0FC49E9368B738F1FE7E4B91FBD50DE5867765218AA1F14701A2CD62325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675351924, "uuid": "924424f6-f9e7-4546-a2eb-07d32b8afa61", "value": "e479a558a3a55c2bde918dd7ce07e020", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675351924, "uuid": "406ca18a-49b0-46cc-87d5-8507121b50a5", "value": "12288:F5DM0uXYzyJ8CmOl5LTr79CJb7d5Muc4:fM0uXYI8riTr79qb7d5MF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675351924, "uuid": "39bc38cb-bc2e-46c2-8353-af1a6caa360d", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675351924, "uuid": "f6d4d870-550a-4141-abca-985dc26a89ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675351924, "uuid": "59e5ff35-3c9c-43e5-975d-49d5eff22389", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9aef1fe-a2b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675314979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675314979, "uuid": "724b50ab-bf1d-44e8-9a83-cb0147cbbe2b", "comment": "Malware payload (RedLineStealer)", "value": "f106764e9ce10d2213fffc4e8e01c064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675314979, "uuid": "c17dde88-9fc8-4dc6-9a02-3e6ad7743b20", "comment": "Malware payload (RedLineStealer)", "value": "09cd10b5fa6e6fadbf9cb53fb2bed5ea2dffb8869a9e5eacaf859e0882283704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675314979, "uuid": "6754a0e5-11f1-420d-b9be-d946329581e0", "comment": "Malware payload (RedLineStealer)", "value": "c061da7592ed6640d4be02a3f4c9ee9cf60f51a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675314979, "uuid": "cc594150-c719-4b31-a0d5-7aef49bc5ebd", "comment": "Malware payload (RedLineStealer)", "value": "ad33dad2a57fc5d77d873dd9a4f7ee2f70d4d7a3ae643db6cd28c2c65c810f8372b97bbdfaaa5c94daeb45097b56437a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675314979, "uuid": "910b645a-ce88-40aa-9587-62d4f62a6068", "value": "T12A74F12136C0C073D5760434A934EB96BFBFB5311A38B4473B581AA9AFB46D0B739356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675314979, "uuid": "b5aa1a28-2aa4-4d7a-ac63-abdfb4e1f293", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675314979, "uuid": "110f6397-1275-40d2-b61b-4ed33d29cf2a", "value": "6144:rl4b+L2ZFJ9A9WvCt4xrUpBmTX45uveGDVpkvvoM:rl4qyZFJ9ArtErTI5uveGDVmHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675314979, "uuid": "ead158c8-4c15-4434-9048-deaf1007d08b", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675314979, "uuid": "13ee882e-83ef-491b-8a2b-f0b41df2e7d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675314979, "uuid": "10d703e6-ec56-465e-8665-514128fb8e58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a626cdd-a349-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675377096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377096, "uuid": "65c24f9d-bef1-4db9-8a58-2f9eaa8661e3", "comment": "Malware payload", "value": "0c5526b4349f9563a2f69213e17095e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377096, "uuid": "372ebe76-e6df-4bdc-b19c-6cb6ba82010c", "comment": "Malware payload", "value": "0a0950028e032cca5fbd7231dd154248e7a7650260434f1df73bd1385540efb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377096, "uuid": "30b72a94-2a18-4bda-b32c-1def4e3c19bf", "comment": "Malware payload", "value": "11b7150a70d433a9c0761cd6193d086b74f30513", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377096, "uuid": "cb6c8e53-1021-44fb-a8d6-47734cdca056", "comment": "Malware payload", "value": "5ef5717fa03bc8febe38001e22fafa6b622074c81d094144e32ae1d82194e9b569a2ff559acf6ad4df59cdc33304f84b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377096, "uuid": "f3c21d61-dca7-4441-9e8d-d18320e71297", "value": "T17094AF42A2E2FC51D621CA728E1FDBF47A1EF5914E686F6A52185B3F1972373C1E3210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377096, "uuid": "ca0fb24b-72f8-4edc-9711-0985d4d7cb00", "value": "2ff60b2f756b6533c2643b340c02a5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377096, "uuid": "c2d9b477-e1df-43cd-8ca4-eb0c31bf7323", "value": "6144:y9v0L0Kihd1eoSptFxTavllF8BNBPqE8Izaf+y5rJ3lwKwpxaJ5jV6ptCbNKNc:y9v0Bij1eoMjata/kDleef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675377096, "uuid": "3d6d3045-96ef-4646-ba27-c00e55aa5b47", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675377096, "uuid": "ce86ffa8-2446-473a-a10e-a6dafebf6932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377096, "uuid": "2f0322b2-0c82-4619-8165-b1c09dd1933e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bf958b-a30a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Dharma)", "timestamp": 1675350221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350221, "uuid": "e01c81cc-0f14-47a7-945b-a7771e32cef1", "comment": "Malware payload (Dharma)", "value": "07a14116ac737b484efd8184ee716109", "object_relation": "md5", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350221, "uuid": "01e4ffe5-df6c-41b0-977d-7e176bc51be5", "comment": "Malware payload (Dharma)", "value": "0a747a5f771168c0c32e944da6d6d996f24284e4fb44eaea562b21266a9e3ac2", "object_relation": "sha256", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350221, "uuid": "21866d84-f0a2-413f-9c91-578e9eff18c3", "comment": "Malware payload (Dharma)", "value": "18a51e12e7f37dd04429482e219883bb044e2e42", "object_relation": "sha1", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350221, "uuid": "0e515974-3e46-4f0d-ac81-d825b8e41d8b", "comment": "Malware payload (Dharma)", "value": "4a0f6ae7ccc5c1ec477e2893750a340018a63b2aa7b64d468620d1619ddfe01d4ea70ffb1b0fae25a7c1c537ed561b18", "object_relation": "sha3-384", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350221, "uuid": "f4fbba7b-7b44-4319-971f-88ea68e02b6d", "value": "T1C2938D28D661C138F8A350FE8BF656BD9D640B201307D4DB97C11D89ABC69D6FD32A32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350221, "uuid": "a68a5906-86cb-4a40-9d5b-79131538efac", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350221, "uuid": "b3f31b12-4bba-42bb-82cf-5d99db74562c", "value": "1536:tBwl+KXpsqN5vlwWYyhY9S4Acc+zVDSmrJA0OGfzbrB5e:Hw+asqN5aW/hLpwpHTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675350221, "uuid": "be7f4311-a2a8-4832-b090-facd22df16b3", "value": 94704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675350221, "uuid": "6445bb4c-a086-486f-a362-ce0020880a4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350221, "uuid": "daef9993-8814-4ffb-9b78-a024fb1bbabb", "value": "2023-02-01_07a14116ac737b484efd8184ee716109_crysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd65e376-a305-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675348110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348110, "uuid": "2d72c209-3617-4bda-9e05-0c74e71158c0", "comment": "Malware payload (Formbook)", "value": "0f7e537b0f4198b037d6437fa495e041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348110, "uuid": "06afe82a-b697-4773-afd1-90c631bd8a66", "comment": "Malware payload (Formbook)", "value": "0aa6c6cfa3661271552e8514315048868e916764fcc181bf464e8ec61a3c3e7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348110, "uuid": "d546b7c7-1a94-468e-af83-5449ae86619f", "comment": "Malware payload (Formbook)", "value": "c22b8f1ff822049223417457f682ee33b58ebc84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348110, "uuid": "6443cc53-3da8-47f2-b6cd-8817a70b99aa", "comment": "Malware payload (Formbook)", "value": "d8cbcc8e18ffca3e967cdfef297eabafb561375f34c9429c444d79c5ec9dd81fc990e138301a2d43a4172888169e033a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348110, "uuid": "b9695c8a-fdd6-4f46-a595-782619b54a7e", "value": "T18B64F05B79940804CE91BBF9A8A1504E6B317C970B60C38799F47AA45E723E7EDCF10E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348110, "uuid": "a6046f38-214e-4be1-b493-260d412a0bd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348110, "uuid": "ac957ca2-3f3e-4b73-a708-25794a62431c", "value": "6144:L5pBekSl6tBeh6Q5Bh5nVGl5nRscYNYzMpvZZnB56EVDBI:17etmB4RNgnRKCMhf6EI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675348110, "uuid": "e48df6b6-1509-4132-b7ae-2c8c72fae625", "value": 306920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675348110, "uuid": "9041f542-bc4e-42ca-806a-ee0a7cfd8d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348110, "uuid": "7bfe34c0-40c2-4f2a-9712-956a1a3d36a4", "value": "JHhGF6363.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913313e4-a2ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675309327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675309327, "uuid": "d6d0cce6-ea5a-453e-bfeb-431fe008ee38", "comment": "Malware payload (RecordBreaker)", "value": "2e5cdf478e113a6ca6a5f71d4ecabfa1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675309327, "uuid": "9b31f6b6-29f8-4453-a167-b1611cccb196", "comment": "Malware payload (RecordBreaker)", "value": "0ab1e0e461397dbcef2da057f0be7e77faa25a98404787048df615efcac2eadf", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675309327, "uuid": "8244fd2b-5fdb-43cb-aa6c-2c5f53fbf7dc", "comment": "Malware payload (RecordBreaker)", "value": "a190a3d3d059f733f800bf1a43b94ef8c140a199", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675309327, "uuid": "547b62f8-32be-4076-9279-8c1909e81522", "comment": "Malware payload (RecordBreaker)", "value": "48d4f938e7264f280add8a6a379bbad6101ce679e57e947a0cedbcd95b574f5bafb328da73dd543172960584a901c157", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675309327, "uuid": "41574472-4f11-4c10-9dfa-c4714e771bdc", "value": "T1FC66235EF9032F49C336D86F4A8E98243C9702BFAE426F17717975639AC498A703851F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675309327, "uuid": "c74164c9-9f1b-4994-8108-585cd54eb1bc", "value": "196608:z0AQGi9o59BzrUSOrKmTv5pw0CGPTrKVWIM6:QGKYrUSO320CG7OVWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675309327, "uuid": "9038cfea-261f-413c-91d6-dc98928f63c1", "value": 6685500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675309327, "uuid": "81f6c2c7-40d8-4d34-aae4-2d134e9041f2", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675309327, "uuid": "3696852c-8ab3-440f-be4f-ce74298aa264", "value": "Setup.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2911209-a327-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675362695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362695, "uuid": "8987cce5-fe9d-4aa4-a018-c61d521a4822", "comment": "Malware payload (RedLineStealer)", "value": "8729eec94866b0ce480978b1cebf1999", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362695, "uuid": "b3fdea25-3138-4d01-88da-fd04e6e7d692", "comment": "Malware payload (RedLineStealer)", "value": "0ac3594e1aae7fbdd14309264d1a1ae24debff9fba4016a98a86abe84706d327", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362695, "uuid": "5469f13c-1641-4e1f-ba49-4ea67c0a7c56", "comment": "Malware payload (RedLineStealer)", "value": "e3ef8723d59851bce6e1ed41e96da73cc9b04762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362695, "uuid": "ba1a45d1-98f3-42d3-8f41-69895b3cff7d", "comment": "Malware payload (RedLineStealer)", "value": "efddaa9bc3b61a3887d7a4f090e8f3ebaf4ea98edebbef9f01ecb0077185c3c64b6b046cc5d4052e0b9a3b7a5c622c5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362695, "uuid": "96f35bb8-7a6e-4979-81ad-389b0350133e", "value": "T18594B012B290BC58D539CB718F2EEBE4392FFD508E5877761338AA9F24711A1CD62325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362695, "uuid": "9ba4bc86-1794-473a-8be9-ad4e7f1555d4", "value": "64f2017133017378e6738b9a4be235bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362695, "uuid": "375e21ac-925f-401e-81d5-ec2cce7cd2a4", "value": "6144:90x4L3hODoSfRKzpn4jnvJQskiE3w7kev9/CJTk637eQfnd5fbmMWB:90x4zhorfgISskf3yP9CJb7d5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362695, "uuid": "cd170323-843f-4401-a127-258779b178d4", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362695, "uuid": "289d2e4c-8acf-4cea-b400-eec622915e8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362695, "uuid": "cf3d6b83-086d-485b-9b10-ea00d1d4bbe4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c8dfbb-a325-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675361578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361578, "uuid": "83284cf0-50ca-4767-b3b2-0bfa725dc376", "comment": "Malware payload", "value": "f3e4675d6a5574c4ab3d3ad0d4ed4c8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361578, "uuid": "8e3d9c84-f351-4237-ba47-0b61a0e678c1", "comment": "Malware payload", "value": "0ae8cb83250572e33623328a73061ce387d9204e5bcf274de7b609815302d89a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361578, "uuid": "ee54c56b-c55a-4471-a8cc-2b086f864bea", "comment": "Malware payload", "value": "0c6969e8d31727585b920076038ba21b02d38f57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361578, "uuid": "b7f90d3b-598c-4af4-a762-3322761a7f46", "comment": "Malware payload", "value": "419fb3ca95bf1b5de48774d4a3fc2f13ec9d8603b6dd5d755da6e361774f9a90b4b2945e7ca9e509dce1d61131dc74ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361578, "uuid": "1ec6c2b9-6e10-4514-984b-1b2e5070f7ba", "value": "T1F9B4F1217545C036E69612304EE6EBB15D3ABD355B26A8C73B84763E2FB02E2E774307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361578, "uuid": "3f2ee684-22f8-4aa2-924e-28837dc9549c", "value": "6dca3e9fb3928bbdb54dbce669943ec8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361578, "uuid": "ba45c510-5918-44bb-9097-d6f7605836e5", "value": "12288:UU5rCOTeiDDMzmxCMWiH1hi4qbjlR0F0d+NZ:UUQOJDDMzmxbWm04qHlR0F++N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675361578, "uuid": "4efb7681-c62f-46fd-9a75-d362852c8c35", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675361578, "uuid": "769c08b9-6bff-44fd-8e70-2b4c98688e39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361578, "uuid": "75f7c0eb-1581-4854-866d-254047317d2e", "value": "WinWord.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685a8c42-a2c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675321285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321285, "uuid": "b3bf959c-2b89-46f7-814d-8e9b41cccacb", "comment": "Malware payload (RedLineStealer)", "value": "0e2f23e9e9711230ef7d10373a10c635", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321285, "uuid": "29407d45-b2bb-4287-8d56-8e4a11f5c65c", "comment": "Malware payload (RedLineStealer)", "value": "0b7804cb7e24879a4fe9268bc4c427f5200b99b89c4fab051c6e7500bdeb812c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321285, "uuid": "3dc6dacd-b377-404e-be24-0c20a07a059f", "comment": "Malware payload (RedLineStealer)", "value": "9f1f3d5e9cbdb8003f241dd30c27e28fc84df8a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321285, "uuid": "359318d2-a9ab-4667-ba32-96e3d706ec3c", "comment": "Malware payload (RedLineStealer)", "value": "904d22422587490f272a9664745a065b67725725431f41f213565f50d938d67d0b3c3ba3c516bfb04f7235e318728440", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321285, "uuid": "eab9f41c-0c9a-4ce5-9c86-453a7b009d03", "value": "T1EB7402327080D032C42A61705973E9997E7EE63029798A3B77AC17AE9FB06D16737347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321285, "uuid": "788e2c62-3d4a-45a1-970a-36d9dbd7c77f", "value": "5b3e1365fd24e4232cba105b88665e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321285, "uuid": "2e2e1bb2-70a6-4377-9673-22e486c9a9ed", "value": "6144:13bFCLaAvsdg/MjX6O8APax4kHByIysADFRxLe9sczWGUq:13bA+AvsaMj7aqpRD7xC9TC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675321285, "uuid": "fabac179-aded-478f-b07e-c22dfd270102", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675321285, "uuid": "4cce2b5d-6d6a-4270-9a69-275178cfa7fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321285, "uuid": "946e9fb0-505a-4f8c-b127-3f632e5ba6b8", "value": "0e2f23e9e9711230ef7d10373a10c635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2778b2fd-a2d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675326759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326759, "uuid": "51b5c4c5-0829-4f67-933a-220ca95ca785", "comment": "Malware payload (Amadey)", "value": "614e756f59595ee8326b8793882dac81", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326759, "uuid": "c76fb559-088f-4921-afb2-64245127198c", "comment": "Malware payload (Amadey)", "value": "0b97b425dd937d18b70c297a83cd03e29c4740ebd344279bc2ede072ce4be879", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326759, "uuid": "8afcc4df-39c6-4935-a7d2-e6eff571cc59", "comment": "Malware payload (Amadey)", "value": "867f3c241cdecb026d591153a55fb9d203a82fee", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326759, "uuid": "86dbe797-e66f-43d5-bdca-cb4c2f4c58cc", "comment": "Malware payload (Amadey)", "value": "a4123baa2511c0a71219e4949be016f0dadfb99b6565ee3b78e503d69d4e7abcffbc9cb4235f550be3048f0c42bc0c95", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326759, "uuid": "608d06e1-3a61-4c05-8f46-0a8b63782a9b", "value": "T1B7649E0273E1BD48E9368B729F1EE7E4391FFD508E18F7B61614AA1F18F01A1C962725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326759, "uuid": "29834f58-af9b-4b6c-8ae9-7f0f8505e781", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326759, "uuid": "793c653b-a534-4ceb-8713-1bdd3456a117", "value": "6144:N1LmkbD9WFX+vMJEci/Dp9/CJTk637eQfnd5vB:X7DG+vGmp9CJb7d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675326759, "uuid": "040d48ce-c1fa-4e43-9d15-5ec69751ac6f", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675326759, "uuid": "2766f281-bbb8-495a-9f8c-d927548d89ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326759, "uuid": "7294f98a-27c1-4d13-bba6-d4f1cb77f69b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886d3afd-a2a7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675307595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307595, "uuid": "f211849b-f918-4bd0-ab15-6cfdea3e3088", "comment": "Malware payload", "value": "465f6c16be1f568f5f1c3c2fb3252fb9", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307595, "uuid": "dc6dce65-4dd4-480b-946e-b2cc10965af0", "comment": "Malware payload", "value": "0b9e2923f442b718fca90af4fc50a4a7ca77089b98b1bffb9abb5e091ff44162", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307595, "uuid": "c081cc3a-b01b-4bd8-9419-ea20902c1cd9", "comment": "Malware payload", "value": "078286bef60b2973471ff6db532493213933ed49", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307595, "uuid": "cb165d4a-4e7e-45ea-b442-05375153cccc", "comment": "Malware payload", "value": "61db6908ff1e33ae504c36bf9bd7c437428c1c888f2cd0ca5943335e0eaaa7ac550cc5bb0f9e7b28e0d7d7468c5d25db", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307595, "uuid": "7c4a9b0b-c27d-4f1a-a256-9ada612afb26", "value": "T12231CB250BD31269D172C239BDBA230FCB15F88BC5469F2E84C0E54A7C51501BD69F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307595, "uuid": "68dcb923-dfaa-4406-8f9f-d961c736150a", "value": "24:84obBJcUA0+BTRYlMa2JM9eAVpccgQ68CluXhxexhxLabTkCm:87JcHhT+lz2JFAV4QAlaoLasC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675307595, "uuid": "2d076cad-56ff-434b-9da6-96e477f6e203", "value": 1842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675307595, "uuid": "95c0c155-0876-42e9-ac2f-bcf0bb8bac1e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307595, "uuid": "5b938868-55bc-4a6d-bdf5-0dd90e9f5d2e", "value": "shortcut.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9e6100-a2f0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675339113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339113, "uuid": "6b7e31dd-6e8e-456f-8467-e3644498ffd0", "comment": "Malware payload", "value": "677dec699db8397c8f580db64a983860", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339113, "uuid": "dac779e9-7bf0-4397-890f-f20bf6c2ce83", "comment": "Malware payload", "value": "0c681bb569c2199ef292be4ef136f07ad285dfeab6286b2c63b8829e3fd9a092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339113, "uuid": "1b3aec83-db82-4365-87ab-95534f592bbd", "comment": "Malware payload", "value": "2b335d731dd449b43ada1e7564691ed9ef2e48f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339113, "uuid": "a9105065-7500-4374-a831-b410c9d473f8", "comment": "Malware payload", "value": "d2dcef5505e91baf0a0c129422ee3a2e3e3f2c1a7145e58c62f8bfd4ed039da9292a5e9e14ac95eeba4d075a10b64c6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339113, "uuid": "3db9e179-1a4a-4be3-9e4f-f11c36e973c3", "value": "T1D32733B9635088DAE8D9633BCC9FD45926D5B82603A8E4CF837525441E73193BE3EF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339113, "uuid": "99e6d4b8-0af1-4800-bbe7-824262e9843e", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339113, "uuid": "f2a3262f-a085-45db-b391-c83c61192b77", "value": "393216:pZAlqYXJBVtt6Y/m3prDOE1AgslcW8567i35Anj0K/:pWlqYXJB30YKWl6W8567L4K/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675339113, "uuid": "550313ac-612d-4591-ab81-56a49026352f", "value": 21209405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675339113, "uuid": "82c49c76-198b-4af8-9ddb-e0296a2b1a93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339113, "uuid": "3315f20e-51b3-46b2-919f-2e481dcd8591", "value": "Osiris.Build.3.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8245274c-a2a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (VirLock)", "timestamp": 1675307584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307584, "uuid": "bf19d473-b751-4b13-933f-c6d006c6e396", "comment": "Malware payload (VirLock)", "value": "9974751ab28f43a6d969f499cc4fc8aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307584, "uuid": "8ad1ae1c-d5a1-420e-8ca2-e2d3a7a7bed3", "comment": "Malware payload (VirLock)", "value": "0c7245c195740d0ddb17351bde07f2322b97ba1031ba08d1b7eb0028c1f607a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307584, "uuid": "09e6405c-1610-4989-b1f1-258120e48c44", "comment": "Malware payload (VirLock)", "value": "68b44f9375f44dcbf7845aca5c0fd89471983295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307584, "uuid": "cf453d94-1eda-4df6-bcc7-ad2527247d49", "comment": "Malware payload (VirLock)", "value": "2bda6d7066561c2db53f9fb6475a2d46f25db162a0d2c75de6517bec0555212216458c66aa87ac73c4f4b29ef05ce868", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307584, "uuid": "469ef550-2164-48df-bed3-31dd8f5e2047", "value": "T1CB145C4C25E8F70CAD6896FC126F6607919DB5B838E65206D7B9C2F614EF448AF3700E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307584, "uuid": "4f350f71-40f1-41d4-b2ed-51fbc4b22d6d", "value": "3072:0tdfiRBO68jzEQhRq5rfRuusQ7s9PsqHpOdXqaN8bEDD+yd:+fiIRq5rfRuzFsqJOdaaN8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675307584, "uuid": "8a557152-02c6-412b-9995-d0967c40d532", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675307584, "uuid": "fde7598f-4ab0-4a92-92e8-c88acf12cc28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307584, "uuid": "4f1499a4-d89e-49a6-8dc8-7919fadbb4ae", "value": "logoff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0917787-a2e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675335660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335660, "uuid": "9efb7e52-4e14-4d6b-b59c-3c8a9b666a13", "comment": "Malware payload (Rhadamanthys)", "value": "c9afe5085553d1b7b388cc818b7b5a09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335660, "uuid": "e7a20b14-c9c2-4a0d-8e4a-2d6fd43deaeb", "comment": "Malware payload (Rhadamanthys)", "value": "0d981758903be30af41eeac59d061eff8322e0c84624f31be40b8f5c66779626", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335660, "uuid": "6edd5a89-b2fc-4a3b-a203-2e7a78126b42", "comment": "Malware payload (Rhadamanthys)", "value": "425e3328364a93e49a8036bf3413134146e7e5a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335660, "uuid": "a133572d-181a-4413-8747-a51a40d2b0b6", "comment": "Malware payload (Rhadamanthys)", "value": "37e1902039ac84faaff4336d11efba0e6e0ae1d1811851463422acd1e4ecabfaa12a551ee426b2eb40405d0d5de4f8e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335660, "uuid": "01585523-7e56-4de3-add2-8f103f3a4df4", "value": "T1BC648E02B6E0BD48E9358B718F1EE7E4791FFD108E5873B61298AA1F14701F1E9A2735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335660, "uuid": "1bab686f-3bde-4bbb-b5f9-bfac0efb301f", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335660, "uuid": "c5e40502-0210-4864-b2ff-92cf473f80e5", "value": "6144:5ILfkIN9ncp+P0gQaB3dc9/CJTk637eQfnd5KKTB:qhNR3P73e9CJb7d5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675335660, "uuid": "aac5de89-895f-4655-947d-7a70aeedf858", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675335660, "uuid": "dc56c541-19a0-45e7-8376-955a0298d0fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335660, "uuid": "f1018ad7-19fd-42b9-819e-218c3a5a8247", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db5d322-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675337051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337051, "uuid": "18fcbf3b-5a05-44fd-8b51-9a43c8e3c674", "comment": "Malware payload (SnakeKeylogger)", "value": "685912ec974732b199f663f893fd6c94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337051, "uuid": "154044a9-fd8f-4849-82dd-5a78d4139e1f", "comment": "Malware payload (SnakeKeylogger)", "value": "0df9a586e1104370c6ce9b15471e0696591db791b970a5c2ee0fddfec82a1cc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337051, "uuid": "ef377540-4a61-4ba9-a553-3fbf205cc358", "comment": "Malware payload (SnakeKeylogger)", "value": "47bb8d6899f71d4fa6addbc349de1f3640d06b8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337051, "uuid": "9d6168aa-7b41-4c9a-9f82-df84098de201", "comment": "Malware payload (SnakeKeylogger)", "value": "b23c2420bd926234dca3a8f161584bff387f7465b569fd0c06ed94093279a20049d3c5041bc86e9adba180fa358d1595", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337051, "uuid": "b5582666-9c5e-4e8a-95fa-77b81300042a", "value": "T17BA48D87354486ACCE6942F7A217818423A5DCFFD518E7096FD932D35EE5FA20C22B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337051, "uuid": "71448172-4bac-4745-8775-b253d4d0f641", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337051, "uuid": "e2d3026e-508a-4cd7-a37e-6cf38bba38e8", "value": "12288:UbFDutOc6duxKLoG3cMnq/fMSZb8ih55qOdxDufo4v6nnjqKoe:TCifM4b8ihrqOdBuH6nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337051, "uuid": "a48c490f-499c-48b0-8df3-2afe26de7cb6", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337051, "uuid": "4c4d79e4-1449-4126-ac8d-12e79880f4bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337051, "uuid": "b1147ce8-31df-4e2b-91f0-97ca82da5dab", "value": "Invoice Payment Confirmation_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631c93f8-a2e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675335879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335879, "uuid": "1612d165-a2af-4009-a5c6-4f4290fb9f44", "comment": "Malware payload (AgentTesla)", "value": "1645439fb45b606276cf008b4d680722", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335879, "uuid": "138b80a5-2e8e-486b-a0de-a76f1d9bf0f5", "comment": "Malware payload (AgentTesla)", "value": "0f7bde20ec6bbce88216a782c38d8ca27ad03c0fac09b1a8f73a9e397d35f021", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335879, "uuid": "36c65e72-caf0-42a4-9b41-d5f709dd0074", "comment": "Malware payload (AgentTesla)", "value": "94514ea33c40684207affc8ad455faaa358e4b3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335879, "uuid": "7b3d40cf-8fec-4546-900c-0f77a46100c0", "comment": "Malware payload (AgentTesla)", "value": "ac0add40c2aeda359362d2682453bc3a7c36391206f4ecdc469fd4cfca9b552ac95a618a5c698de211678f5542443d0f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335879, "uuid": "52ac5b84-3abe-431c-97c5-218408d60d68", "value": "T1B372B07E0E0A69ACF953CCB279C35D29F43650D560B419ED91F37DA24432AB8CE78A09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335879, "uuid": "10a1f91c-2991-4596-bf90-b9335cb93866", "value": "384:OKK16I331nGRnna3Eodj9x039k7p17tkoaYTawYQ8WeQoFsBBd6j:Oh1bDdjTE90p17t/aFS8jnFu6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675335879, "uuid": "c05f571e-985d-4f9d-8841-a8e410b649aa", "value": 16166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675335879, "uuid": "aab8622b-0a96-45a3-ab68-981d7f20ea5b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335879, "uuid": "e6ab2a0f-e01c-458e-b2d1-dec987907ee3", "value": "New Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270b797c-a32b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675364125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675364125, "uuid": "99c640e3-3b89-4a1a-9bf8-abc67fec9a3b", "comment": "Malware payload (RedLineStealer)", "value": "d8028bbb7acea0336f7a6460afc91ef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675364125, "uuid": "38eb1fb8-edde-4981-922f-82874bf24e57", "comment": "Malware payload (RedLineStealer)", "value": "11ccf4ee0cb1a1883267f31068a7b6c1e05c0c1068d5731b543cde26f66fe3df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675364125, "uuid": "2b80e5f5-d046-44e0-9a54-3d2cffb1d4ec", "comment": "Malware payload (RedLineStealer)", "value": "88e29390d07fe9e146b4c1cf1167ec0079c0ac61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675364125, "uuid": "5f586817-438f-4dde-b64c-9be3a03977cb", "comment": "Malware payload (RedLineStealer)", "value": "24480eb1622429ed7deef50e3828027b1b3bd4c16741f1181826bac6f1bce5f7cc2c3da2ee24d1288909ca6eb8f860ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675364125, "uuid": "fc7ceeff-3fe1-48ac-8725-f45a5f48a242", "value": "T1C414C053ABE84033D9B51BB058FA03D31B36BDA16D78836B27959D4E1D73680A53233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675364125, "uuid": "d6b767e4-ac3c-4269-8fb5-2a930aab664a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675364125, "uuid": "9bbe387b-b16c-4c40-97b4-53fc1cd68ebb", "value": "3072:WOhX0N7+f1o5GWp1icKAArDZz4N9GhbkrNEk1ssR84+aX5DD0Wv7VdcXF7/:7hEN7+gp0yN90QEDs+9y7S/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675364125, "uuid": "5a63aa48-0cf7-45dd-8bc2-2769c6e282c8", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675364125, "uuid": "5ed39f15-a3ea-49ad-84dd-d172be4c025b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675364125, "uuid": "f51cce11-74ad-4705-a608-36ec1837395f", "value": "d8028bbb7acea0336f7a6460afc91ef9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74f012f-a29d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675303486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303486, "uuid": "fc67f7e1-a507-4da3-97ab-d9b147054181", "comment": "Malware payload (Smoke Loader)", "value": "89324ffe8efed35e265ec3b034db4a8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303486, "uuid": "b767975f-7ce9-4d45-a404-5d0eb87d0f16", "comment": "Malware payload (Smoke Loader)", "value": "133ea80cb718d1c5c4c818a986f9cdc0d7281ea095bafedd8120e2c023b7b5eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303486, "uuid": "23968772-b434-4a7d-8853-51118ff71302", "comment": "Malware payload (Smoke Loader)", "value": "5f004bb4b6d7dc1016ce811d1dca3b2c8e156b78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303486, "uuid": "d2f493d3-2938-4d30-ae6b-b5536889ecdb", "comment": "Malware payload (Smoke Loader)", "value": "1adfe5f458c47e28fe1af664df1b3adbd4b222b2300d28d97e41849a67ac6944d603c332b5708cafc4e3e1a8dd5bec33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303486, "uuid": "8c965146-5530-4448-82ca-8d737eecadbe", "value": "T1FD34DF323AE3D072C16B10305C34D6D5BBBEA5315679990BBB9826BE9F702D0672B347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303486, "uuid": "cfae5858-5b92-40f2-aa5a-fa992a82dbeb", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303486, "uuid": "31d143dc-447a-4a66-8a42-b0b02f77d4fc", "value": "6144:ctFg6iLoR9BvlWwRgXblddGBCfE6vv1e9+:ctFsk/BvlWwRgpzGBuEcd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675303486, "uuid": "17453ee1-ff98-4ae8-8fe7-091cd59b24b2", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675303486, "uuid": "3891a115-8d20-4bd0-bd54-1bf2bab91ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303486, "uuid": "3457ecdb-e82e-439b-a1a4-276e26612473", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703cd8c0-a31f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675359094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675359094, "uuid": "8bbf5a5a-91d8-4dc1-932b-43ba816e3f0c", "comment": "Malware payload (RedLineStealer)", "value": "b304fc50f4f253ed957ff8cd1195d73d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675359094, "uuid": "8d33d5b5-5870-4f7e-a0b7-c408b0e4be1f", "comment": "Malware payload (RedLineStealer)", "value": "158c8551c7fe29b678279373003ed965594cf3a18cd13d95a57b74736f37fa5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675359094, "uuid": "4a92a527-d51c-4136-841d-6662485df4bd", "comment": "Malware payload (RedLineStealer)", "value": "9a9506c6fd46575a7a4df88631bcc80966e4a93e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675359094, "uuid": "af3ad2d4-e379-4509-b611-3c3b12bf0e69", "comment": "Malware payload (RedLineStealer)", "value": "3c776e773b7f3c2386410eafa456f61dc2ad7421197e09d5031e7376dd8669fb3da8184405f19618d52fdaa1157353f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675359094, "uuid": "6bc8d681-666a-4b2b-ade1-999502df992c", "value": "T19C94C002B2A0BD59D5324B729F1EF7EC7A1FB9404E58277A1319A71F14713A2CD6232D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675359094, "uuid": "2623fb32-b22f-4508-8ae5-70bc9668e3be", "value": "64f2017133017378e6738b9a4be235bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675359094, "uuid": "3958148b-1727-4031-87f3-41c9b132de90", "value": "6144:NHwY3LPEOsNdq3wCA+XggIzyORnKdzVev9/CJTk637eQfnd5Ug0wWB:NHwY3LEPbqgCz4zNJKdC9CJb7d5BN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675359094, "uuid": "2fa1b956-b865-4d47-b4c0-c4a7b4cb2dbd", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675359094, "uuid": "8c992110-d85f-44a1-84dc-0f0f51e61434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675359094, "uuid": "91ae5274-2dbe-4ab8-a88f-30c45493c7a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef59bcce-a2cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675324947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324947, "uuid": "ba98a42b-0fa0-4b5a-9f52-7732441f251b", "comment": "Malware payload (Formbook)", "value": "f4d0c348ddb22b023bb20bfb273b2880", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324947, "uuid": "2538b4ce-32c6-4102-a7f1-6591057200fe", "comment": "Malware payload (Formbook)", "value": "1898f22fac7a609e186050d787f60be2d8427ad8d24fa66f44c0ddcc17cb72d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324947, "uuid": "e2882018-7ea2-4eac-b82e-3d79eab95b64", "comment": "Malware payload (Formbook)", "value": "d1e67e3e5bc7dc5b64bb12b27ae9a1c6931cc3a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324947, "uuid": "04f0b058-1844-45d5-add9-aa38c6bcc2ce", "comment": "Malware payload (Formbook)", "value": "1ceabdd2e9e92c7b3300a9cd0e35d47ba3a7faf60fce23deb7058d72d339172d349fe676789f2fb45c62547b5a40612d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324947, "uuid": "ebe19194-7643-41f9-afe3-289e697f8b28", "value": "T1216412413780D45FC6E26B361E7D929E4EF66D3269A12B8F17F06E5F3563203C81A329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324947, "uuid": "117ed198-20b7-4a36-995e-41c49908669c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324947, "uuid": "3629631e-eb47-4f92-8ef5-609c34c0d6e8", "value": "6144:2Ya6yXMMeOqKjtedI7qzQqRyPXCV1VtSH7E3pfEk334O5sKZ3SlYM+/EMgl6MpaV:2YkreOqKjR7qUDP4QA3KkzsKZK+/EMg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675324947, "uuid": "b6020a5a-ddb7-440c-a9b6-99a06204dc46", "value": 330002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675324947, "uuid": "d72911db-6dda-4032-876d-b194f8f033a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324947, "uuid": "5ba12a0a-5cd5-4303-aca6-eb533f6fc59e", "value": "f4d0c348ddb22b023bb20bfb273b2880", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c093d2-a30a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Dharma)", "timestamp": 1675350223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350223, "uuid": "496e4805-58ca-4f5d-b0ac-0fc950f37fe7", "comment": "Malware payload (Dharma)", "value": "064251fa4f795bad5cc025d836b98923", "object_relation": "md5", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350223, "uuid": "3d0aff0c-306c-4473-80fe-1d63c5ef7589", "comment": "Malware payload (Dharma)", "value": "18acf8a44011f072a29dd6a6254c36eec7dc4f7ef7810980bd237ca3942d904f", "object_relation": "sha256", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350223, "uuid": "0afaf1dc-7b42-45d6-a586-3a08434c8a32", "comment": "Malware payload (Dharma)", "value": "4671e6fbb237826e7f6b24f47fd1a510c591b7c8", "object_relation": "sha1", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350223, "uuid": "a1e19469-72fb-48be-b7dd-663400571c25", "comment": "Malware payload (Dharma)", "value": "62326c8aaf34ee67c2b633b88e21ccc3dbdd6c3a603d07c07c824c306ffe9b27dcd72ab7a30e6b4bf1df87393e4d8164", "object_relation": "sha3-384", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350223, "uuid": "1a37ba20-9034-40ea-9861-fe87ca62d3ff", "value": "T19F939E29E920C035E8A350FFCBF646FD9D684B201307D0EB97C06D89AB955D6F931A36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350223, "uuid": "9a45fc3f-b705-4f43-a6b8-ddacaaeefa42", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350223, "uuid": "b137ffdc-3fd9-4322-aff6-94c23f1316af", "value": "1536:tBwl+KXpsqN5vlwWYyhY9S4ARhAfVapAu6oN+sP0izGGt:Hw+asqN5aW/hLbhAfob9siNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675350223, "uuid": "efaf0341-73e8-4ba5-a295-02ad188ff465", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675350223, "uuid": "e4b09ded-7054-412c-aba8-8afda0d3870a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350223, "uuid": "4fe280b7-fa56-490e-8c84-79db35c34866", "value": "2023-02-01_064251fa4f795bad5cc025d836b98923_crysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa11656-a2df-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675331757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331757, "uuid": "1f3a4569-dd4e-45f2-87bd-fb3f921b0e91", "comment": "Malware payload (RecordBreaker)", "value": "9753def21127105443f13a1c76ccfcee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331757, "uuid": "b4ad1052-3b4e-4569-bc5c-b28b303e7504", "comment": "Malware payload (RecordBreaker)", "value": "19e18baac87a1805b385449ef3f945609b6e1c4a9cfd912765a3c1934637cbfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331757, "uuid": "a3722003-7831-4145-9a25-3cec8e4bb7bc", "comment": "Malware payload (RecordBreaker)", "value": "6a48f5595097f4d44668504aef0a3207d67c5c5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331757, "uuid": "b271462f-4a28-4a2b-8fbb-7eb0c8a58b0f", "comment": "Malware payload (RecordBreaker)", "value": "afe5282f6869adf8ddb9f42f09d751424446d15a80686dff09a49bca9c4438ea905b3f251cb5ae2530185633d485454f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331757, "uuid": "8616d0b2-92c8-4a1c-94fb-8d0e800ed33d", "value": "T1F16623B3A2696004E1E4DC3CA13BFCD871F7196ACA40983974EAEDC62876FE1D123557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331757, "uuid": "30b56f0d-63ea-43d6-8314-fc7c94873072", "value": "11ea24073ee65343ee563e3160c77fde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331757, "uuid": "196b70d5-8d73-4e03-9708-617b6bb6babb", "value": "196608:POLaJJiSb4tlUVHQf6bSU5EuklXBAuFiti:POOJMXUVHQg7kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675331757, "uuid": "7cd67100-a4fa-4bf7-8d8f-e72d59f7211a", "value": 6871552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675331757, "uuid": "456f6f10-0d2b-4f33-9911-44bc7332b6ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331757, "uuid": "851da5c1-3d0e-4f80-b1aa-c9b9b088e408", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a197b593-a2c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675321810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321810, "uuid": "4ff79474-505e-4e2c-ab79-f7fcc0b4501d", "comment": "Malware payload (Amadey)", "value": "8e3a84fe51240b2f9a1e981e153b9c57", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321810, "uuid": "ef904e7b-abe2-4967-90ef-9f45c7e76f74", "comment": "Malware payload (Amadey)", "value": "1a260322bd17696d664dc7e8023e287113d28dbeae9f0d9e0b6f0ab8e23dde10", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321810, "uuid": "dbbff33b-9f46-4bbb-a768-7a3488ce7f75", "comment": "Malware payload (Amadey)", "value": "b9ab34555604eb20d5e6ab3d3c729adafd43bbc9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321810, "uuid": "89e737a6-6699-439a-9f85-30ec290edbd6", "comment": "Malware payload (Amadey)", "value": "fb43e31a3b183c56c5cba8c724b8f0142adbcfb14a4b91d6244cacd6c099de362170e8ca139dfe9e4ee613f6a8e60579", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321810, "uuid": "bf62c008-db78-421f-9493-12ada98e6fe5", "value": "T1CE54F12379F0C072C5AA44305C20EBD97AFEA5310675590F7B981BAE9F707D1673A38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321810, "uuid": "ba97805e-45e5-40ce-96e5-ad653bb8a040", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321810, "uuid": "00c9cd8e-9d26-497c-a134-dda7745c812a", "value": "6144:CpGJ8Lk3B3oSvcjS4e0nCX4V7r/mezTyZM:CpGyo3B37Tw75z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675321810, "uuid": "b60f3868-49a5-4391-ba47-53162bdaa32b", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675321810, "uuid": "6a6b34d4-0d2f-4803-8bff-cc0327067cb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321810, "uuid": "6d88a02b-b495-4384-89a6-da75d9ac3763", "value": "8e3a84fe51240b2f9a1e981e153b9c57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77949bf-a2f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675342543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342543, "uuid": "853f9c42-85ec-4e73-ab8e-f7ca284e5ee3", "comment": "Malware payload (RedLineStealer)", "value": "efa90555870d3191324367498ab987ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342543, "uuid": "53798813-478b-4385-b367-f1694c22e858", "comment": "Malware payload (RedLineStealer)", "value": "1aeb33640cdae7af62f5b6c137b677c166f315d055feca472bd9affea63d0601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342543, "uuid": "ef446233-edb2-43e3-86ad-7add3e28695c", "comment": "Malware payload (RedLineStealer)", "value": "c95e5175035938812070f7d29944f7c38ed479b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342543, "uuid": "b3ca3a18-1178-48c3-9639-7df547e002f7", "comment": "Malware payload (RedLineStealer)", "value": "70c63e355063eb3af555075dd2f3b0e32fe9c5b5ab2d19480b632117f42d0201dc83013d470bd4b81af705fcd05e01f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342543, "uuid": "a5fb25dd-b0dd-4d18-9c8f-2bd15390b94e", "value": "T19F740B887670FD9EC867C47F8A681C24E6636466570BA203B05317ED993D79AFE070B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342543, "uuid": "4a54601c-3151-4d67-8982-6d42902e1158", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342543, "uuid": "593a8aca-aa19-4d64-a5a2-fae7cfeb31ef", "value": "6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675342543, "uuid": "7af87252-98da-4c81-bf7f-a2278fc39949", "value": 344682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675342543, "uuid": "99ac4220-c43a-44c6-a554-50651b8f61b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342543, "uuid": "d76fd398-6cf8-41b3-87cd-b3c2f7dc60bb", "value": "efa90555870d3191324367498ab987ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9691996d-a310-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675352715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675352715, "uuid": "6ac11a20-0c96-407e-a13c-af094a3f8a99", "comment": "Malware payload (GCleaner)", "value": "610e63fe7e8393fba55ba1d250341de7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675352715, "uuid": "fd4327fa-4d65-43cf-b0fa-de3cfc870a7a", "comment": "Malware payload (GCleaner)", "value": "1b11bd2ec58af5014de2bb5ff8b979595e3ef236ba743e6f3e223c7edfe23d10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675352715, "uuid": "fe470115-3f04-4667-b06e-c5f30645afda", "comment": "Malware payload (GCleaner)", "value": "04131c595eef0db69201d85fce44abd5939c3d85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675352715, "uuid": "04de949c-c5a8-4ab7-b3eb-361630429265", "comment": "Malware payload (GCleaner)", "value": "9f20d78129c2a57cfcd8bd3963efc36c0ba7d2a8ce8ff990ac591858296752dd02b8593ced445d1817f907449ec06fd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675352715, "uuid": "d229b815-7540-42ba-96cc-73e24e3384eb", "value": "T1AFA53334B6D6C6FFE7304E71163F6284D7377DAA30A85162292853AE0B731937D16A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675352715, "uuid": "29b4dab0-cf85-4d7b-a25a-cf4da3aae745", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675352715, "uuid": "20f6fc04-06f1-4e1c-b65a-7ea1d47827f3", "value": "49152:bgS74oGuwqDegInKVKt/s/EKVCJ3YRoUL0TMU6HqLCgv2MR:cg4o7wqir6K+/EKVCJmobRv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675352715, "uuid": "9524649f-9e87-47fe-b321-1922aa6dadf0", "value": 2088652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675352715, "uuid": "7b81f97a-1cce-45d3-9804-255e96692c37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675352715, "uuid": "b000a3d6-89c8-4ad3-b7ae-67cd4672dc19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6d148b-a31f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675359032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675359032, "uuid": "6d006c25-a9b3-49de-91c5-2767adbf5c83", "comment": "Malware payload (GCleaner)", "value": "38d5c7c30e4184926d2f02121912ad94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675359032, "uuid": "ef587b2a-e362-4fc9-a4c6-81ca5da08cb4", "comment": "Malware payload (GCleaner)", "value": "1b49776770b1eaace2897399c989af85f7702fdecc8d6b5e0b6c07feae2f3584", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675359032, "uuid": "6d03e699-c035-4b0d-b7c5-30f405c8f14b", "comment": "Malware payload (GCleaner)", "value": "1e1f0a2464839d64e5a7082e8d7b558e0078e2b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675359032, "uuid": "90e825ec-a336-4b59-863c-ecdadd7b3f32", "comment": "Malware payload (GCleaner)", "value": "c4fe67b6fca7ddc1f4fb0ecb07443809be9be51e63d1d3911c0470c6f3379787f8635e55912f7ae45d8b7b58f0b1269f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675359032, "uuid": "df557716-8e77-4461-a066-80ad9d618fa6", "value": "T1D6A5331BE4768936E2728D713D312940C731EEAE142825F8339E77962F3BBC1256E356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675359032, "uuid": "21577145-2241-4cd2-9ad5-da9ca01defa5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675359032, "uuid": "79074270-40d1-4320-9e78-b986b9b05970", "value": "49152:bgOe86PoqiBqzVyA1LX2jLc5hjmjKm0UVbnJobqvzh5C73LCgv2MR:cD86PoqiMzUQ1hSKvinJobMh5CXv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675359032, "uuid": "7cbec368-c191-4c68-b5b9-cf5f06f66f37", "value": 2103798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675359032, "uuid": "387c2b3a-5f2c-4bb4-904d-03b4d2eca6c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675359032, "uuid": "08ede034-a39c-4d74-a239-30db62f1c4a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145a0fdf-a31a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675356792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675356792, "uuid": "ea4ada97-cc98-4b6b-98a3-883d5f48ea90", "comment": "Malware payload (Mirai)", "value": "13ea32f0630fa72a02a477735f6e4534", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675356792, "uuid": "d5066e1c-1e35-4bd4-a0a7-3e4aac4a1659", "comment": "Malware payload (Mirai)", "value": "1c4eab7d107c3f3fa507c2720c9d4503d50a4c3c448946299338e6d55dcda192", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675356792, "uuid": "6b3fb927-7a18-41fe-af66-7dbf94ba4775", "comment": "Malware payload (Mirai)", "value": "250ca7f75a37820d7faa0f6cbdc583cd5884041a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675356792, "uuid": "f7eab083-0547-4f64-8c7f-b7917aa17e3a", "comment": "Malware payload (Mirai)", "value": "12c30d2b1243da9be00eb7234f607e3ebd66321e048dc31a005f1aece5ce616e784a7392a4969cdf67908eb31ff980e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675356792, "uuid": "df26e877-631d-42eb-a5e1-47f3c6300e88", "value": "T1BEF2F16312A1DFA6D93D84762C3BB44F0A21F52EC9C9CF53AECA11AB7483E6407493C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675356792, "uuid": "40956679-08d5-4359-897c-68def79c8e7c", "value": "768:p4mdHTljxZZZocoC9LvY38oez1XqYnbcuyD7UfyqS:yWjxOJCNY+z1Xrnouy8qqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675356792, "uuid": "6f7313d6-b328-462e-b26a-ce7c8cae09f3", "value": 34880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675356792, "uuid": "0dadb73f-e1b2-40cf-9573-30b4ce33d7d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675356792, "uuid": "630e7fcf-8df6-4f15-bf86-f39d0cf5d5ae", "value": "13ea32f0630fa72a02a477735f6e4534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8798ffa5-a2f1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675339376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339376, "uuid": "39ae8c3b-4139-48ab-b1e4-327d27aee0dc", "comment": "Malware payload", "value": "d96e58813b9065ef39bf512713248485", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339376, "uuid": "b0f498f5-db8b-4a62-b2e4-cbd4048a85c7", "comment": "Malware payload", "value": "1cc23de557ea180f1edb02754493e5d895a662a27cfe9848c968de9a5e33d8a6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339376, "uuid": "451b60bb-03ad-4c2e-ae3a-eb6f31745299", "comment": "Malware payload", "value": "2afc6de7b71ffec4beb3af896a152c36709a3a17", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339376, "uuid": "d585d1a6-8e5d-4063-a351-fac4d9326fd3", "comment": "Malware payload", "value": "108a8d46afebffe5e385e529b041942129ac5a223f67ed475837475533ee279b7746ae41c180494f8b27ded5e00ee6ae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339376, "uuid": "c4ba1a5b-e954-46d5-a301-35a3ed2bd1e0", "value": "T15B45F811F600A018F1C3213339E9179BC9277DB48FD940C7768699D5E7A92E299FB3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339376, "uuid": "1a88758a-1fcc-46ec-9bbc-856ec18b9892", "value": "622c2eb34f4b3398c5f60a739a4808ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339376, "uuid": "de794efa-1c0f-4b01-97b5-c7d2c166b97a", "value": "12288:hOllau37yN7pla8VsYDOmnSrSlRoS1ll6iCJguZUT0XY83f:haNYDarSlH1l4/XY83f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675339376, "uuid": "ef90ddb3-e482-4dc8-8635-c2da2d792304", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675339376, "uuid": "1d49839a-1f86-4e85-98c5-012f04421473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339376, "uuid": "43563359-bb95-4a98-a03f-848fc754a19d", "value": "rat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ba2772-a2df-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675331454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331454, "uuid": "c8325b40-a77e-4c50-8d9a-de77504618a0", "comment": "Malware payload (RedLineStealer)", "value": "37b1a38d404ca22f8b3a57590130fc6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331454, "uuid": "227ade26-da32-4525-ba81-94723c4eb6bc", "comment": "Malware payload (RedLineStealer)", "value": "1d480df533e3b8393bddaecd85b153fe55072329cc5d52f78f7d99af8dcc5769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331454, "uuid": "53022ea0-bd2f-4361-8366-7604017b2dd6", "comment": "Malware payload (RedLineStealer)", "value": "c70e883300b09226a8f986342743efcef93ea4ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331454, "uuid": "81a1575b-76b1-4a7f-8fee-3c903d00c2c0", "comment": "Malware payload (RedLineStealer)", "value": "54cae25a91c20cdace5929ca414b30f39155a5ac131bf94544b352ed2222d9e004d2eda61848f97d22846c055c5af4bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331454, "uuid": "02b3109b-a609-4bb0-a583-ed20993c024a", "value": "T19194BF0372E1BC49E5318B769F1EF7E47A1FF950CE58B37A1224AA1F14701E2C962726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331454, "uuid": "4f3730e0-5909-4f76-a86d-db0a3a468469", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331454, "uuid": "0632eaa3-8874-4e80-b4b9-9c0b041fd350", "value": "6144:LoLkZz/90T7xgAW1kVidOYFM+ab+xjVJKc7Sx5KfxI9/CJTk637eQfnd5XI8bB:ES/ccJFM+ab+xjVwcY5KfxI9CJb7d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675331454, "uuid": "2efadf73-1bb5-44f0-b22a-c16511e27af6", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675331454, "uuid": "5d6f6235-d93c-4977-926f-42c61f1d185c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331454, "uuid": "aa02ad3a-d4f5-46b8-ae7f-92ae2db095f6", "value": "37b1a38d404ca22f8b3a57590130fc6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73feff6-a30a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Dharma)", "timestamp": 1675350220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350220, "uuid": "d1cde70c-aec5-4c48-83e6-8dcefd27f13a", "comment": "Malware payload (Dharma)", "value": "a3435d1839ded089f36516c52e94f5d3", "object_relation": "md5", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350220, "uuid": "5d3c5473-177e-4ca6-83f8-9ef8712b911b", "comment": "Malware payload (Dharma)", "value": "1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788", "object_relation": "sha256", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350220, "uuid": "b7516ce8-fe9a-4683-8714-1165d189ff23", "comment": "Malware payload (Dharma)", "value": "ffa7bf12d73d61c7cd09070f2d680c1b0eec4990", "object_relation": "sha1", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350220, "uuid": "e3a86790-b493-4f15-b3b4-adf4883a78c9", "comment": "Malware payload (Dharma)", "value": "b2c28e99bc6a30eba9d18bcf971ae6106e8f37f5d0e5f3cf19f4131a6343417e1329051730b2062fb89ee491835b86be", "object_relation": "sha3-384", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350220, "uuid": "34489373-0f91-4922-8d40-50793ddc5647", "value": "T1C7939D29D931C435F8A260FFCBFA96FDAE740B10130794E797C11D49AB864D1F932A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350220, "uuid": "99357f38-5e60-46fc-8501-6cc02be8cc4c", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350220, "uuid": "2d4fce34-68cf-466d-b193-2583353b0aad", "value": "1536:tBwl+KXpsqN5vlwWYyhY9S4AwGOFr82UvQJwK:Hw+asqN5aW/hLe3rrJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675350220, "uuid": "e934f6df-2fdc-4483-b4d6-2512a8f57c59", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675350220, "uuid": "d2ad93fc-8da9-43f1-97b7-2735e55bf016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350220, "uuid": "8d5fa012-70a2-4c65-85a4-ddac30c839e0", "value": "2023-02-01_a3435d1839ded089f36516c52e94f5d3_crysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce9c9bd-a315-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675354659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354659, "uuid": "4a971b03-58c7-499b-9432-41297c4089cd", "comment": "Malware payload (AgentTesla)", "value": "8d5d8f11be76cfff938cc3d5dc419db2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354659, "uuid": "aaf6e2d7-10df-4a66-be9b-bb71538f47db", "comment": "Malware payload (AgentTesla)", "value": "1e1f39d0a125c4efd7bd8e306182ef3a4c23704a299f3d05a501419651f9302d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354659, "uuid": "e8196521-b045-4b27-ae1b-5ea0ce4ed4fc", "comment": "Malware payload (AgentTesla)", "value": "f1ee83a2b6caf01c8d5af77b92bd3d064ef498e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354659, "uuid": "aec9c5b3-fd80-4b85-838b-10ea82c120d6", "comment": "Malware payload (AgentTesla)", "value": "f43c86d1f97e0167c0d9e4f8e283f3465b98bb579d3007b7dc709174d530b4666beb8b4be78a13202e23c5787ae30f05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354659, "uuid": "acdf8b86-0d44-4e3a-8b19-adbb1aa19fbe", "value": "T1E6158D8737B1A8BEF687407544283F886FA07113BE46E25397373AD4DB098FBBA94151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354659, "uuid": "47f38a65-2960-483a-a82d-30032acd0298", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354659, "uuid": "72aaa4e9-920c-4f1b-bab5-4f476dc6a1e0", "value": "24576:fGsPNzxHCsfBVOhmw4JO6F0xMpqG4yPa:FDOhSWiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675354659, "uuid": "4a585295-3766-4ae3-b209-4cf4a2fdec3f", "value": 910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675354659, "uuid": "6f3929fd-3a7c-4759-b9be-9633562938d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354659, "uuid": "715009c0-d313-4a49-bef5-2d9eac7d9b15", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b4134d-a2f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675339883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339883, "uuid": "28bf5f79-02f9-4a8e-a4b4-24bbd8b0fb85", "comment": "Malware payload (RemcosRAT)", "value": "80f21e9ff6743a7e35fdbafcc5b1a9e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339883, "uuid": "d54b4fb6-e21e-408e-93e3-82fc94bf1165", "comment": "Malware payload (RemcosRAT)", "value": "1e412b5ff0ae94b987740547ac33289b8bd2f7caaccd6e629cfe57d11dc14995", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339883, "uuid": "761a7464-d553-474b-bbbd-904106411232", "comment": "Malware payload (RemcosRAT)", "value": "67fa41516863eac519e9cd98ba79bc9ee86b33d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339883, "uuid": "1ae0f1e7-6656-404d-8c54-eea376d614ac", "comment": "Malware payload (RemcosRAT)", "value": "2f006a72cde178e6f061638db1f4641aad900ef80e0f8e04cc4cc44ff352a426cf1cef8cba6809ddbcc9eb702b698c49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339883, "uuid": "0ced60aa-f243-417f-b50c-435dba06bc18", "value": "T1B745BF8737B1A4BFF68740B154283F8C6FA07113BE46E257973739849B098FBB698191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339883, "uuid": "f106464d-261c-4779-91b9-9e8d65ce07dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339883, "uuid": "67acdfbe-a4b4-49d1-b022-62f6a1c4caea", "value": "24576:TFc6F06MfqZGSz3RbK0aQl+5WyhgjsnC5JCk9RMpqG4yPa:LW6MnMRVKhgjsnC5gqCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675339883, "uuid": "8a43728a-d3af-43df-9a25-a6c88bfe4b1b", "value": 1211392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675339883, "uuid": "001fca37-14fa-4047-b837-8abdb42ec496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339883, "uuid": "9894716e-09bf-422c-84a1-9137e497466c", "value": "80f21e9ff6743a7e35fdbafcc5b1a9e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c439af-a2c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675319452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319452, "uuid": "a6e9e268-55ba-4d3c-97e1-a62d647f6580", "comment": "Malware payload (AgentTesla)", "value": "203d1bc57ea8771959daa9d077964062", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319452, "uuid": "155dc5ba-6e07-44a5-860b-1480fccfb812", "comment": "Malware payload (AgentTesla)", "value": "1ee6f378c6c5c69819c17ca913e0006a033281dc78a57cb7f171d2bbf254fcc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319452, "uuid": "da65ae17-057d-4641-a6f4-9e7e692d6cd0", "comment": "Malware payload (AgentTesla)", "value": "21932c4c913dd557a0b975455c6cade43d16260e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319452, "uuid": "53dcbcff-ebf5-4ca4-a927-acab4ae93105", "comment": "Malware payload (AgentTesla)", "value": "330fe530963a6bc5d4940940bafa5bb825a0ab6d12267e7891d5eedd6673c014dd7f2b6f9e7ef5fe818858fff671dfcb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319452, "uuid": "b1c9a22d-c56d-4d32-ac1e-6736d6c0bd1b", "value": "T1B4158D8737B1A4BFF68B407554283F886FA07113BE46E253973739C49B098FBBA98151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319452, "uuid": "ecf389bb-b971-49d5-928d-8cf8c2006a17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319452, "uuid": "a95b7ea7-1599-4eae-b8aa-e8e668a59bd6", "value": "12288:kKZX6Fy2MwnHpCbJpOj2RZjT1yASaEXOSvUkjGYVW9EAzo3pqG4yPaNVbDKqlYqy:VR6F0gpCFpOj2HcpaMjGhpMpqG4yPaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675319452, "uuid": "e14cb8f4-2eef-4989-90ed-bb02f0ff9450", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675319452, "uuid": "5f642a7a-9890-4016-879f-6be85520eb64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319452, "uuid": "b7485841-228a-4848-9b8e-fbb25c58cf3f", "value": "Order Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89982016-a2de-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675331219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331219, "uuid": "855c9707-1350-4d2a-a754-485d57a3202e", "comment": "Malware payload (Quakbot)", "value": "96c16b2ad41f468567b0206216bc7e12", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331219, "uuid": "1c74581e-4035-47ca-bda5-86f56e8138c1", "comment": "Malware payload (Quakbot)", "value": "1fc609cb8e092b587826b300535cea12be24960dfa6ebab11c2104736cc3bd8e", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331219, "uuid": "358756e4-766b-47d7-b5bb-62f54eee9506", "comment": "Malware payload (Quakbot)", "value": "3b53e8bb5ba7246d43766747456c962ac77fd7df", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331219, "uuid": "b8f67712-3f3b-4f1c-acd2-64e49d67867c", "comment": "Malware payload (Quakbot)", "value": "8a67eea5a1f5568ecda208982f2cdebb139d92ee358173b371dbb5fd038f68b1c569536f13d714f9ba62c423d7616933", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331219, "uuid": "2015ae22-8de7-41fa-8e3f-7c7ac4e61821", "value": "T1C204D10126F64AE5DEE47BB24DE3971DAA2BBE27E262035F4BB5666D4D60310CC0470F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331219, "uuid": "bb9feaa2-b092-4dcb-9c2c-78448c06f990", "value": "3072:TaA0YRw9/WITtTWR7IbNzvL1ahgeuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCCg:ja9xytedL1Qg04iERBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675331219, "uuid": "72d3b8b3-ec3c-474b-9901-86abccefb13c", "value": 179828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675331219, "uuid": "88a171c1-3119-4a8a-a88c-592286333540", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331219, "uuid": "5bbfbc30-2ac6-4472-9ef2-493fcd57872a", "value": "ComplaintCopy_31535(Feb01).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a2ae02-a34d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675378883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378883, "uuid": "039d3077-8e2d-497b-b4b1-0218b96405d1", "comment": "Malware payload", "value": "54989769b0719f683749b80200d849a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378883, "uuid": "c5efd164-53a2-4ae5-b4ac-1e7c715177ad", "comment": "Malware payload", "value": "22c09a40766f9b02168bc15584c27c1003e5fb896b481d79b52ec20a2ff40ce3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378883, "uuid": "59462918-fce1-48b9-85e8-e1fe97446427", "comment": "Malware payload", "value": "58f959286e84adf05dd03583bd1e619e8f786a4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378883, "uuid": "fb1ba093-a69c-421e-9f41-cf0ed969962f", "comment": "Malware payload", "value": "49b7088f4c40ea4d67e1dbb58d5b6d016ff16d8707e6eaaa002a33b16571d830831eef44d37ebbb7e3b657974af45d58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378883, "uuid": "dc28bcdc-e800-4942-9824-7dd3fa2bf826", "value": "T1A4A53306E4655233D0A2F77A1D24B647FB97FABE2A352219709FA24F4E963C0458331B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378883, "uuid": "06bd4588-a4d3-43f2-8427-99f0c15d2cf9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378883, "uuid": "d496b8d8-895d-42c4-8afa-157b33163070", "value": "49152:bgct9RuzegwZy3Z6unChuo5UtVEsRF1XXcAriBXw2mLCgv2MR:cQRuzbZni5UoEFZXhaWv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675378883, "uuid": "56c00ba0-1b96-40a4-ab70-8818fc5ad161", "value": 2120384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675378883, "uuid": "ce8dee55-e38e-4d6d-8266-a9069a042208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378883, "uuid": "bbc394c2-3215-4e4e-b2c2-74b805bc06d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0ab21a-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675337130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337130, "uuid": "8cb39344-a73d-43a9-b8e4-59e8d46507ee", "comment": "Malware payload (Quakbot)", "value": "ddd09db61d8f6565ba41c20695ea3ac2", "object_relation": "md5", "Tag": [ { "name": "1675326103", "colour": "#11EC06", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337130, "uuid": "376f320e-fd79-4404-99ab-e8a478b78a70", "comment": "Malware payload (Quakbot)", "value": "232ec42b51df281533c557d9013aa5bbeff130bc6e0cb8de7ef1cf965ed81eb1", "object_relation": "sha256", "Tag": [ { "name": "1675326103", "colour": "#11EC06", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337130, "uuid": "4b7ef49e-b709-4185-85dd-44e327b45734", "comment": "Malware payload (Quakbot)", "value": "7fe4eb7f1ccc59763e352defc3298f0c208f171b", "object_relation": "sha1", "Tag": [ { "name": "1675326103", "colour": "#11EC06", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337130, "uuid": "0203437e-c289-4a4e-b6d0-27e746d8ade2", "comment": "Malware payload (Quakbot)", "value": "592e29361c6844158266a10eb5b3000247533a2b4291a3ba25d2f9ce819b40e1552a7945b7253ea6b6685f2c46adedcb", "object_relation": "sha3-384", "Tag": [ { "name": "1675326103", "colour": "#11EC06", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337130, "uuid": "c1dff7a3-2011-4fdd-a812-fb5eb9066bbc", "value": "T1C035AFA2F2B14837C173263D9C2B9365982ABF113D286C467BF51E4C4F396817A352E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337130, "uuid": "0988d79d-2f87-4045-af11-8eb50c414702", "value": "42ed000be09992833541110261c2d8f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337130, "uuid": "3b15b89c-7dca-4245-af0a-8173c8cfad93", "value": "24576:aHjOfF1vLCeGI4e9GqEMAinTjc7c6LvWxGXaEA5:aAjDjt4cAAfc7bDWxGXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337130, "uuid": "334d0ec0-0c61-4f5d-8915-545a8f61d7df", "value": 1069788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337130, "uuid": "9a912c68-260c-4498-9863-103a7629d92b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337130, "uuid": "7e40b505-d878-4013-878d-f8c696a15fa2", "value": "01.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8fdd12-a2eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1675336864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336864, "uuid": "bd00351d-d951-44ba-9c61-a8bce24f6997", "comment": "Malware payload (SystemBC)", "value": "a985b674e4b66b84636979d92733bf86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336864, "uuid": "ce4997e0-1e2e-42f5-909e-9a6bd103e9c7", "comment": "Malware payload (SystemBC)", "value": "234097c41e0648bebb19dee2f2f3c841cb0beabb10c81916b1fcc3ff9ae0ab83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336864, "uuid": "38487fdb-1e1f-44b3-864b-e18b154bd2f1", "comment": "Malware payload (SystemBC)", "value": "3d12c15334752a71b53a2e78e08b92350f77d523", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336864, "uuid": "c607c530-933b-40c0-8924-fa4157daf078", "comment": "Malware payload (SystemBC)", "value": "ce48234695f9cd7cdfb97793f1002e3e32d133addc320eb74faf8e762dc711a98832160ff355a19db0eddc7e7123d8ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336864, "uuid": "1c37cb75-d46d-45e3-89ba-b625b019dbb2", "value": "T1C105C001E39C8255CAA41FF599F247686BBD9E7D2088E3470DCAB9CF39F13614039B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336864, "uuid": "ffb61d35-5b74-4e32-a8a3-6b1ae2a49e99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336864, "uuid": "eb150977-372f-48d5-a456-800b3c95185e", "value": "12288:iprjUCS0M8mE4Cy0XC+4HVjDTiuqLywotlnH9/dwUnRe6B6iC9It:iZ9BTL41LOLyNZdwUnRe6B7CKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675336864, "uuid": "a70ae372-63d7-411e-b937-111ba9d3d891", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675336864, "uuid": "449a9c6f-a4f2-463e-a30e-f0821eac2ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336864, "uuid": "e3944ea4-ef70-4f32-85c3-dc629d460202", "value": "a985b674e4b66b84636979d92733bf86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8764196f-a2f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675339805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339805, "uuid": "f3cb6be4-2cce-406c-8426-0abe11c89029", "comment": "Malware payload (DCRat)", "value": "c63632e5940f81ce752d52b052f827f4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339805, "uuid": "b1a42671-6d0c-48a0-a615-2dd4f18ccdf6", "comment": "Malware payload (DCRat)", "value": "2465b991a6cb57b013f7c4690ce52930bd02bebe3dc24f5ed8bb3488fb52915e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339805, "uuid": "39d450d3-b47d-4048-9b31-2da27ccc3ab2", "comment": "Malware payload (DCRat)", "value": "c43f68916ff21a7d4a47f3e43e4fc234dce6fa89", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339805, "uuid": "43ffffa2-21c0-4cf4-8129-716c7e725b6d", "comment": "Malware payload (DCRat)", "value": "4cd8d196fe0d6cf48500a649bb9a793154d3665229849fdc44f0b946b0ffada02ad3e7b0575007c0e7e53b7a6bd71199", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339805, "uuid": "759cbceb-be6d-4f3a-b306-3d5657e00bd0", "value": "T1B7557C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339805, "uuid": "ec8b6923-4558-4f71-b2f9-d3e237e90d92", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339805, "uuid": "f706c3fd-a087-49f6-9aee-c8c44f26b038", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675339805, "uuid": "df13f8b1-a960-4aad-a98a-ec21b30b218a", "value": 1406864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675339805, "uuid": "90ce3a47-bf31-455b-9874-0b32b72c8ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339805, "uuid": "1d2c892f-f4f0-4a71-a760-93fba52c8b4e", "value": "c63632e5940f81ce752d52b052f827f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8918d8c9-a2f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675341955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341955, "uuid": "aba7fee2-adc1-41f3-ae80-8dc73cbf5a70", "comment": "Malware payload (NanoCore)", "value": "e587236cb6e5ccf2497ab08b245f724f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341955, "uuid": "a62e3553-3f1e-4a77-bd62-81e883516fbb", "comment": "Malware payload (NanoCore)", "value": "249a4af8064c560426fc8aea6fc23ee47a24ba800628d805f9eb0653b8e1d4f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341955, "uuid": "164edc6c-0b38-4ba5-b762-e1431585866c", "comment": "Malware payload (NanoCore)", "value": "8b9f158fd574c4e982ec73e2368ebb4f6e4b566b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341955, "uuid": "15f4c48e-18a7-4cb0-9b6f-a07537a4039d", "comment": "Malware payload (NanoCore)", "value": "a0118b06891dbe397bb7172040705e4ca6dca48469515d84febab99e2c02aa1be8972087e9c6a5ac662b8371c3874974", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341955, "uuid": "ff30e498-f825-4404-9d2a-1948c95083da", "value": "T13014CF2677A84A2FE2DE86BD702251168379C2E398C3F7DE28D451B78F167E10A471D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341955, "uuid": "64a8f763-cbe1-48da-8299-0b456da5ae0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341955, "uuid": "1a6406d8-c895-4ac3-a935-b0693aa3bc19", "value": "6144:nLV6Bta6dtJmakIM57s7UBmOKqVotp/wK328:nLV6BtpmkBQmGuAK328", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675341955, "uuid": "a5adafc8-ef01-4d10-8060-8ae20176cffd", "value": 208192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675341955, "uuid": "2dfed5d4-377a-4d6d-85d1-c58110d0054c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341955, "uuid": "a27d56a1-5749-44a4-a54c-f1d62421d44f", "value": "Trojan.MSIL.Agent.fpar-249a4af8064c560426fc8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc63d7ae-a2f3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675340350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340350, "uuid": "84055346-54cb-4af5-a589-a1fee0e53e9c", "comment": "Malware payload", "value": "1922124cd71ddb184f3168e10591e7d7", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340350, "uuid": "c9cc72d5-5e59-4bcc-98d0-09420368d807", "comment": "Malware payload", "value": "24d763cf9d9768c55996a99ab6f735bdf0a6b101f544448b552df41e4fcee9c2", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340350, "uuid": "f7151e70-5f39-448e-afd4-e3a295229dd9", "comment": "Malware payload", "value": "7bf325b2d8936bb5ea712e4056b79d32c105b22b", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340350, "uuid": "ed6a0e79-7260-4acf-8d6e-f11305847898", "comment": "Malware payload", "value": "19f803461be0a0120333c75fd69715e666d2e405873f4799a7348f06b7c1a9bfc52d730cc76b1211ddec71e3a02bf15e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340350, "uuid": "30c4803a-fc58-4e54-bdb7-9390095d3bdd", "value": "T121329F52D682A92CD757947DD19981F1468A2948A386EB8F1CE4B32C4F017FB83CF3D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340350, "uuid": "67563a65-5dde-4d59-b661-f0e3bc4807cd", "value": "192:ushLqHCckbDxVquxvqNBrtA3cgLCVX7va8/TdrWt2FdamjtKnF/W:pAtSDxc8vqNA3/CVLvB97amj0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675340350, "uuid": "c96f6e6b-3f71-4639-97f8-0f5f33f2519e", "value": 11261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675340350, "uuid": "00c04eaf-b651-4d8b-baec-0b4b56e9759a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340350, "uuid": "e5b65568-6eaa-4bf8-ad56-448867ffa7d2", "value": "MOBITOWER .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330a5bb7-a2e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675332362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332362, "uuid": "86e4f42b-7812-4724-9140-5100b54505f4", "comment": "Malware payload (RedLineStealer)", "value": "9be4c94d3e2ce6f9589f7833b5405730", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332362, "uuid": "695388a8-4d60-4549-a61f-831afd4463d7", "comment": "Malware payload (RedLineStealer)", "value": "250f05183329680ee72afa9443073a442e5428c9c14efaa4e3c6185d75727211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332362, "uuid": "edcf25bc-39b7-4218-8759-af431399c73f", "comment": "Malware payload (RedLineStealer)", "value": "b6be760d8d59c2393a71cace68d3a578ec79f080", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332362, "uuid": "572d56d7-5712-463b-a11e-b32d517a33a3", "comment": "Malware payload (RedLineStealer)", "value": "4449a36f971abca69c96b3aa7e655cbdd6d8f6016bcbc140689ddad9e609729dd8f5d8a04a1c51f442d64742de97c82e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332362, "uuid": "546936bf-4591-463a-aa0c-3045951a3b3f", "value": "T19F94BF0272E0BD48E5328B718F1FF7E47A1FF9518E2973B62229AA1F14701F1C962725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332362, "uuid": "83832931-33ae-48a5-87dc-2de6c5debb5c", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332362, "uuid": "f6cf4ef5-2dc6-44ba-897b-be6ed026cb44", "value": "6144:8SLFgCB9o0nCxBnH3naucBYl1JvRuALsNL/aV9/CJTk637eQfnd5MdB:XhBaxNatYlPvRdYNLyV9CJb7d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675332362, "uuid": "95e07bb6-a61c-4a98-baca-4f748e4d356e", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675332362, "uuid": "f412211b-814c-45bc-8e12-530be31a7e15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332362, "uuid": "cf5fe584-ad39-48f3-b71c-3885305b5932", "value": "9be4c94d3e2ce6f9589f7833b5405730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ee6155-a2c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675322168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675322168, "uuid": "0a6e3f5f-aa1c-4558-b259-e7cdadcaa562", "comment": "Malware payload (GCleaner)", "value": "a77c256d458c466a500ec7ceabad8892", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675322168, "uuid": "a962d003-c352-4cd0-bd36-e83052816e00", "comment": "Malware payload (GCleaner)", "value": "2591ca19c57ef1a5427850b524b6d280fab1d1784913041f541e31f9273bf524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675322168, "uuid": "9dc9a6d4-0ab6-47ea-ae92-b1f7695eae40", "comment": "Malware payload (GCleaner)", "value": "fb493172644fb4fb533d5b98ac0e73eb1f5cf0c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675322168, "uuid": "a7010555-1d03-423c-bb53-a0f920bed8fa", "comment": "Malware payload (GCleaner)", "value": "af4858ba26666de2a152bddec841b73cb6828e112706d2bf08c8c19f934a333ec77301ccfb0d614c0bd6bb4a0920a2f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675322168, "uuid": "464b7922-c66f-4caa-986c-7ec666d4f09c", "value": "T172A53307E1604C32D072B6351F78968099A73F2D7CBE7143725E22AA1FF762065AFB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675322168, "uuid": "b95d6f8d-9a65-4a79-b074-f67b07d3d9d6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675322168, "uuid": "39731c7b-ff23-4bc4-a10d-aaa577a385da", "value": "49152:bgP9tlQ1EYtvIQKT9Z6AZNqIDsoH4lBdqbKdPQogVSUZ8LCgv2MR:cnlQ1EYtw3j609sVBdqbuzHUiv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675322168, "uuid": "473fa802-763c-4dea-bd06-09ac47298015", "value": 2102005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675322168, "uuid": "1d350378-ef26-4034-9c72-1c72a6b74841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675322168, "uuid": "feb9d13a-ba1a-41a4-accf-0164a73fe25d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7cf7ec-a2db-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675329908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329908, "uuid": "a1fe1750-37be-49c0-b6cc-1bae6fc9527f", "comment": "Malware payload (Amadey)", "value": "79278226a7d1b351c2384485148dbe5a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329908, "uuid": "925be727-618c-46f0-9977-bdb3d0d5f7d0", "comment": "Malware payload (Amadey)", "value": "2770144498bacc04d521d9c973e729007ff2c3694a353b979aae191f854ca59c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329908, "uuid": "54e14059-d9ed-46f8-9813-ce7497999349", "comment": "Malware payload (Amadey)", "value": "fececd329447a0b6bf838756e3c5107db6ad3e33", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329908, "uuid": "9112cb29-9fc3-4a1c-a87f-ead6b5c358c1", "comment": "Malware payload (Amadey)", "value": "27bc3f362d9f7f09b430003d91ca68e7d70696479ad23fee8d4afedf3ba2a7204f3da8a890c293bbc4bd633e14510cf0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329908, "uuid": "78576d17-ad4e-4a2f-b29e-98378d274134", "value": "T19474AE0272E0BC49E9358B329F1EF7E47A2FF9508F6C67762214AA1F14721F1C962725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329908, "uuid": "448af3de-e53c-42c6-8661-f8f68e499ab6", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329908, "uuid": "3d3a4984-9f76-4eae-93d7-f6f4627963f4", "value": "6144:qTbL6m+z9KZwGvE9MCFYf7eAYy49/CJTk637eQfnd50SB:c8zoZwQE9MCFYf7tL49CJb7d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675329908, "uuid": "74f79c71-3a76-4dfb-93b8-55c55eb1379a", "value": 360960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675329908, "uuid": "8f9088f6-7bb4-4788-be3c-fc2b05f94903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329908, "uuid": "f63eba15-eb30-43ea-8036-812412653d3b", "value": "79278226a7d1b351c2384485148dbe5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1197063-a28c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675296174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296174, "uuid": "03a3dd38-eb5a-44f0-841f-76c691e9fa80", "comment": "Malware payload (RedLineStealer)", "value": "d5576d24ee8784eaf9219011e566882c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296174, "uuid": "287fa9b6-7af9-4776-bc91-fde5d2f5e632", "comment": "Malware payload (RedLineStealer)", "value": "27a1982fdaa71485013995aeec19307ed6ff482ab89d901e2d27e46b070b5fe7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296174, "uuid": "7ada1608-1ddc-4e0b-979a-6763eb3f1b8d", "comment": "Malware payload (RedLineStealer)", "value": "87a702eb6ada80642d69724dd469d28e8c86a6b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296174, "uuid": "ea22dcc6-9228-4132-bb26-14a03c7f12ee", "comment": "Malware payload (RedLineStealer)", "value": "224b9575ec248dde29ee84b9fca0958a2f606febcc43e7548a29f32fd61f1ce4c5dab826c3777eb6c9d0476db5070647", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296174, "uuid": "256118bb-8f20-4d24-9d8e-101aa7f4488d", "value": "T14C74F1227981C073C46614719A30F794BFBEB5315AB549177FE817AE9FB02C2A33634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296174, "uuid": "44148a2f-89e3-459d-8187-ae80a97b3b61", "value": "5b3e1365fd24e4232cba105b88665e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296174, "uuid": "6d26a445-82c0-4043-8431-14ee7cc87528", "value": "6144:e3YjeUL7q8L9PIcDxY7cMgF1tXHYrVUSw5JUld3Gmjpo7MO:e347Xq8L6IKcMg5XHg2SV/2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675296174, "uuid": "eeda7eac-d15b-4884-a823-d5fe3ed3b57f", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675296174, "uuid": "736ba861-43c4-4eaa-812c-6ad9821c4ea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296174, "uuid": "720f5478-ca39-4313-a1d5-53eb3a9b53e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0448dd42-a2ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675309520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675309520, "uuid": "636a4566-921b-4399-a491-7891ed9259e4", "comment": "Malware payload (GCleaner)", "value": "5fa4caa52dd0e59077a8792af022e95e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675309520, "uuid": "2a77ead5-0975-43ab-927e-b19c26ac53b0", "comment": "Malware payload (GCleaner)", "value": "27aac39a1548a0ac03e56493e2b7a3e64736c0a99c5674e4b93869b225919b87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675309520, "uuid": "c4937330-29b2-49ee-887a-5120e2790a56", "comment": "Malware payload (GCleaner)", "value": "e110f09b6f6d5b3ab7a42be9a46e1477cf89b225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675309520, "uuid": "b60f96c6-da2c-4688-a802-dedb9756360c", "comment": "Malware payload (GCleaner)", "value": "c4ea86b665cb60d8c7644bb929d58fea1eb31a754e70036bd5d0f18ebb27340374e50ee42e1ae78a6fbd5a2893c32361", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675309520, "uuid": "8f55ab37-97a3-4f16-9b93-7f933347d064", "value": "T1A9A53347AA5B5F3BC10B82B50CAD58617DB7BAA714B4913A314EB54F0E372904CEBF90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675309520, "uuid": "71c17aee-e2c3-4ba8-8ca9-cec3ebeb04e4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675309520, "uuid": "61aa8b0d-9e7d-4c4d-9e46-c6a6185a5997", "value": "49152:bg2uPB+hbE48jajey5bt1nM7Yg2t08CBUxgKAAnVzzGuCSQqT+McLCgv2MR:crZ4E48jafZqYx0+dAaFz8a+pv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675309520, "uuid": "bd533102-c74d-4e16-87d5-19d54d1b269f", "value": 2107429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675309520, "uuid": "c80837e1-423c-41d2-b38a-ab694ac254b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675309520, "uuid": "4ff2a0ff-9134-4217-9855-ea0adfa73736", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c55869-a2fe-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675344763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344763, "uuid": "441d4e92-146b-4069-9013-a3bceefa731b", "comment": "Malware payload (GCleaner)", "value": "e71105bad204e62a54480ff1159570d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344763, "uuid": "3f82fef6-daf6-4e14-a67a-bf6f5fb4db18", "comment": "Malware payload (GCleaner)", "value": "2848d1b76495261d04378a03ddc634458dd51aa46d43885d1453a68e806379fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344763, "uuid": "6756987a-844b-4f23-8e65-c0bdce24ab9c", "comment": "Malware payload (GCleaner)", "value": "3e74d425bbb95c1f4c68bb54c1e169ea8fab5455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344763, "uuid": "e29c604f-0178-4d53-9bc6-b7062f650d0d", "comment": "Malware payload (GCleaner)", "value": "3cb794e01ff9386e5ba2c57ea12c3044b07de1a0c491b9e945ea31e84edae6970197abdec2d22a66e6fe076402602415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344763, "uuid": "10e9718f-225f-4747-a730-d587a9b5d2e4", "value": "T1D2A53349A5634932E112CB7568345066FEF7BBFB1B38516FB2794E483E3B394780B212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344763, "uuid": "1c2c9eff-2786-4e4a-ba38-844f1899111a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344763, "uuid": "3ef77c61-759d-4a7f-9622-bbba144c5465", "value": "49152:bgySjVSBxfHhxP5f5P9I/59Nc3ip7PKjQoUhIs4LCgv2MR:cySYnfBd5fZ9IR4yFPKjEhkv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675344763, "uuid": "c3a70d68-842c-447c-a0cf-4dc0cec7fef5", "value": 2105317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675344763, "uuid": "69015977-ce5a-4424-879d-0b369bd96d75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344763, "uuid": "01e0f776-5e54-4f40-93c7-28179c837acd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f92d31-a2f2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675339808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339808, "uuid": "20a495f1-a6f0-4b27-8925-da01654fc30a", "comment": "Malware payload", "value": "057436af9d0ea4ddc51c010ccc658ada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339808, "uuid": "15c91694-7fe8-41d3-be8e-89f8fd6d6b15", "comment": "Malware payload", "value": "28bfe0d11b513460a82d3d3d2213a4b9085a607fadfc3fff38050c6645bfcbbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339808, "uuid": "a125ad9f-93ee-4ec0-ab0b-54c122d6e300", "comment": "Malware payload", "value": "b5f51249030b3ab1a5c27170b50aca40525afca5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339808, "uuid": "f136e67d-77d3-4eb1-ba58-41ee8dbbf44f", "comment": "Malware payload", "value": "3ba646172d1d2540f237fbd73fd9e73a417f0f1af8697c38a2d252cf333e432198d2e874e61355f1d3c535b3c1f8aff5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339808, "uuid": "82524f96-94dd-4f6f-b0d1-1e556928936f", "value": "T1DA6412C97994E87FCC17D03A49598D948BA67677226FE293404362DA5C4FF1B8E1C0B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339808, "uuid": "3da3f29c-264e-4361-930a-637909f82bed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339808, "uuid": "0347862e-681f-4d3b-a519-16727440b1e8", "value": "6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675339808, "uuid": "e83e1e53-55d5-403b-a738-5c28dc546505", "value": 333182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675339808, "uuid": "1dc1dec8-9118-43a4-977b-a03dbbb1fc3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339808, "uuid": "2867c138-1e96-48a1-9046-bc143c63e734", "value": "057436af9d0ea4ddc51c010ccc658ada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ee6544-a2d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675326644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326644, "uuid": "7634bc6b-9d3b-467d-bbd7-a7f16aa78dce", "comment": "Malware payload (Smoke Loader)", "value": "6e97a25f0258f7c08ea8ecf35262fd70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326644, "uuid": "01e69901-ffeb-4909-8451-bd318d14aad6", "comment": "Malware payload (Smoke Loader)", "value": "2935b22cf4d1cd82e84031196d4fb50ab47f75bd0a4cf5d652a3a0c7a05630ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326644, "uuid": "7004dc2c-8591-469f-ae49-0411c36d1c92", "comment": "Malware payload (Smoke Loader)", "value": "436f07c1757f8f7d82a4cc1f88fea5ab393151e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326644, "uuid": "2bbb9e3a-725c-4b72-b42d-03d0520d7dc2", "comment": "Malware payload (Smoke Loader)", "value": "514f9ca75a689d73fc678577c2af49ebe4397f936ca28645c72a09075ed811318748efc67d532625d914bcd873983338", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326644, "uuid": "90bd07c4-096e-4413-8e65-87a720571c11", "value": "T11B648E0272D0BC49E9368F729F1EE7EC791FF9618E18277A122CAA1F15701F1C962725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326644, "uuid": "46b85092-0313-4444-a4c5-a194b8d0565b", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326644, "uuid": "84f79e09-080f-4f68-b546-99d59c734d47", "value": "6144:KKL50V19SKzRAi9AJZMx9/CJTk637eQfnd5auB:Fi1wiy89CJb7d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675326644, "uuid": "f580b1e9-629d-425d-ae5a-77808cd05cd8", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675326644, "uuid": "fc571505-5f8f-4c23-9a04-339c732972e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326644, "uuid": "15d060f8-8640-4d6d-a2ad-561df324d647", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de58f5c-a2bf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675317912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317912, "uuid": "bbc9fd16-9474-42f7-b9c7-8ec02fdd12d5", "comment": "Malware payload (Smoke Loader)", "value": "d2fe82b1b8277439940685b31716dec6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317912, "uuid": "a71e6877-d57f-43dc-b6c7-c3c46d43ffcd", "comment": "Malware payload (Smoke Loader)", "value": "299911e85d53857fd1f8cd3052e03c867783d797440402490315c6c5a52b39d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317912, "uuid": "42a32640-0e94-4367-8d21-60664025a1b2", "comment": "Malware payload (Smoke Loader)", "value": "5b1de010cd6e4d81c58e640a7903283518fb6321", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317912, "uuid": "1fa1dbb0-1723-4db2-b9f8-8be289497a2e", "comment": "Malware payload (Smoke Loader)", "value": "e6dc12b4a9de90b0169c9865c8f29bf93c6ba43791ddd71d05000d9aab0f2289ac70c9bde9801b14b54a9705befa90bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317912, "uuid": "10d64983-0de1-4da1-b69b-efe1616300d5", "value": "T1BE648E0272D0BC4BE536CB718F1EEBE47A2FF9608E5977BA1214EA1F14701B1C962725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317912, "uuid": "28e511e2-b64e-4540-b324-d4590baa9676", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317912, "uuid": "e64e0d3d-9d07-4e7f-b62a-a3a5bc4cc2bb", "value": "6144:mxLeK8N9pQYxFkEZmU4XlQ8Dbd9/CJTk637eQfnd5K27DB:+iNZ34uoR9CJb7d5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675317912, "uuid": "4cf945eb-0563-4a10-865e-034f05664d34", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675317912, "uuid": "5ec3ea01-2b21-444e-8c63-2d95a4bec570", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317912, "uuid": "d0feca9d-2772-4ae1-81cd-73c862b9ef43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c989ceed-a30e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675351942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675351942, "uuid": "5d5c552d-7866-4e96-b867-f70b450dc6af", "comment": "Malware payload (Smoke Loader)", "value": "2a33d1186ba472a035a8cf5ac155d75d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675351942, "uuid": "a2e062c5-bcb6-4681-b25e-0596766d0318", "comment": "Malware payload (Smoke Loader)", "value": "2a0909942567576c54381140af8bf10440cbddcd5a6bfa7c7edf1e64efb208eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675351942, "uuid": "e666ca94-681b-4097-adb4-f44ea8686bd6", "comment": "Malware payload (Smoke Loader)", "value": "c05f3ba453ccc0cd6b6eaf76e4766590e8e95fad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675351942, "uuid": "358e5017-9d54-41b0-86a6-aa08ba5423e7", "comment": "Malware payload (Smoke Loader)", "value": "cc0e842408f8221807c76df18509220b53dc6e8986c799774736e59a7e6579f54c9689b23ccba67a7c1afde97716bc9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675351942, "uuid": "03d74687-6dc7-45e9-972b-c4de24a2d24d", "value": "T1D0648E02B3A1BC59E6318F729F1EE7E4391FBD708E18777A1218AA1F18711A1CD63725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675351942, "uuid": "675331be-a753-415e-9f72-266e9d9ea033", "value": "e479a558a3a55c2bde918dd7ce07e020", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675351942, "uuid": "9f87af49-b299-4ce9-bcbf-4167e30b022e", "value": "6144:l6LCKrXxe+EcBqgcf09/CJTk637eQfnd5rpbPWBD:oOT+Zj9CJb7d5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675351942, "uuid": "97d4c6b6-367c-4d65-9dd0-888a5a41f728", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675351942, "uuid": "7cb8da9c-47d4-4c3b-9158-9b3188b8cb2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675351942, "uuid": "438f63db-2aa7-4c86-a698-b01c7c021cbc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d274e4d-a30c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675350928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350928, "uuid": "34742dfe-40d2-436f-b4f8-ca422d0977dc", "comment": "Malware payload (GCleaner)", "value": "fb64d3a65439c6c93c6a9e9141e33043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350928, "uuid": "94305f15-873f-44f7-b154-9a043f54d932", "comment": "Malware payload (GCleaner)", "value": "2c81ef2c59bcb22035ff5760f4b43f9e3543475a1e8701b233544788f7e85378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350928, "uuid": "5b801241-8d83-457d-8ec9-1e060920adec", "comment": "Malware payload (GCleaner)", "value": "95c48946a8fed8dd624623777699bbb9a0b330be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350928, "uuid": "3aed8ecd-71c3-4ddf-b13d-26f0075411f5", "comment": "Malware payload (GCleaner)", "value": "154ab4e05a0172141ea4ef9b4d108caec7c9bc421d4a87bb14f594ed2810195cdff205f707307e198082332f47e323c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350928, "uuid": "d9209231-2ea7-4578-8ca8-69d7781c1ad9", "value": "T11EA533179973C072D293E67A976C9906EF637E322174230D701CBA8E2FB7251E815F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350928, "uuid": "61ca349f-e6b8-4cc4-bc9f-91a1d0f54eb8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350928, "uuid": "3cbca692-28a9-4551-9377-d3a3bb0a508d", "value": "49152:bgtYGF1Ww53mijs1aAvBxek1a/Unf7c/m+J5J7nLOjGQdIvuKMuLCgv2MR:ct8as1vmkAUfcmaZL+1lOv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675350928, "uuid": "9fc9040a-b50c-41e7-a3d7-e44b10c8bada", "value": 2108329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675350928, "uuid": "7e86eb79-7cd6-46d9-9c12-8645ae2d3d41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350928, "uuid": "b88d5b93-f79e-41cc-94f8-b8873a302339", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a908a516-a325-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675361766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361766, "uuid": "ecbabc73-6ad1-488e-a8bf-6703fed24e2a", "comment": "Malware payload (Mirai)", "value": "cbaa0c75b49fc83e9524533e0128e6dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361766, "uuid": "6fa27e6a-f5d6-46ae-aceb-f6cef3602f90", "comment": "Malware payload (Mirai)", "value": "2d4b830aa6ad0216767c2f662ed9f6517033325992c49a4db065ff2dc50ad50d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361766, "uuid": "2881379d-2b66-49a5-a16d-37d06bb936d7", "comment": "Malware payload (Mirai)", "value": "b9ec96635ec3065690e498cfb25e7cdeabe7ab0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361766, "uuid": "44fc13ea-1860-4768-b342-2e7cb7fba125", "comment": "Malware payload (Mirai)", "value": "48fc58a6eb45e00433a3d69278cd1f94dba151ea1458c4426c0b2ed5cdee5e66cacc5c089278f55eed5fbba6d719f902", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361766, "uuid": "9647246d-316e-447f-9a5f-c3098321d52f", "value": "T1E8337C89D343D0F0E943457011AB9B7A9636DE3A5061EE9EF7C57E22EC32A12E41B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361766, "uuid": "54542209-8cb2-4777-92c6-db183066083c", "value": "1536:v5vuedsTuBbgz5h1/ckLuh/X0Rw8UX31k9/n+vBry:hZsTuBe4kyPe9ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675361766, "uuid": "f8157e9c-9678-4fe5-8ae3-ad27e405f55d", "value": 53980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675361766, "uuid": "69fe75cc-c2cd-4c92-b42e-e8bf9bc208bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361766, "uuid": "ca4029c2-27b5-4494-a674-6c6b7b3e96dc", "value": "cbaa0c75b49fc83e9524533e0128e6dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a605a61-a2cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675323919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675323919, "uuid": "84ce79d5-2457-4a3d-82b5-29b28f991d2a", "comment": "Malware payload (GCleaner)", "value": "550e42d8d2359f2c7d27b3b4abf3b7ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675323919, "uuid": "052c4e63-05f2-4716-9f65-3c35e1e239c2", "comment": "Malware payload (GCleaner)", "value": "2d6184f6e493627fc2cdd3e5ec79d36cfaf24a395798f959ac81417f70ab861e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675323919, "uuid": "6f26b48a-bd0b-49b9-a029-b22b99863387", "comment": "Malware payload (GCleaner)", "value": "2a098d0b0c27972ecd5a8906ca2a3d029c97dc25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675323919, "uuid": "1553c4d2-7a9a-444d-be8c-f21c3f95091a", "comment": "Malware payload (GCleaner)", "value": "695db3d931b99a0bda1cd41d809fffb88ef07a346db8e6afb04ccd018f041d4251298fe942f55c33efb85c1cc4555de0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675323919, "uuid": "3f356299-d09f-43d9-b86b-ed58c6824d22", "value": "T136A53352F4DB8073E0860B74692895662D3BCFA918714331E46C235E8FFB5CA385AB5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675323919, "uuid": "22875e07-3528-4c99-832d-bd6ef62d7fb1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675323919, "uuid": "b76d5c10-6c17-409d-8a28-5ae0af1a7487", "value": "49152:bgbAdlZOPxixZgYynb6v65larO+jemf5pGFLCgv2MR:c8d4xi1EeC5ErO+jBG5v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675323919, "uuid": "6802e6e4-e13c-4c4f-8e30-24615ccca705", "value": 2121194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675323919, "uuid": "f01e7fee-7bb7-4aeb-b522-143742605012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675323919, "uuid": "4346f7e5-49ed-48d0-b4d1-4d6758c32980", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e5d180-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675337096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337096, "uuid": "b1bdc072-bbc4-449d-9c35-bec1ffea7e51", "comment": "Malware payload (LaplasClipper)", "value": "72c0564ecefc376463c23b9a82ee0f77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337096, "uuid": "994d8307-eb48-45d6-9721-48820a1bf800", "comment": "Malware payload (LaplasClipper)", "value": "2d6253043dd8950da3eb04b202d316b0386e0d7576dadc61206af9bf17f7c223", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337096, "uuid": "51d8d1b0-6520-4270-b1a0-57defd2efb5d", "comment": "Malware payload (LaplasClipper)", "value": "5f40f6a9b3bb9eb468d4ca1c520ffa2317790d71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337096, "uuid": "9a462b84-1634-4be1-b06e-2da385751aff", "comment": "Malware payload (LaplasClipper)", "value": "83ca35d773e8c05879b9d05edfc6334c3212258b0f561fb5664e21b96d958d1f5c0b92bb8f5facc4646026d1a033613d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337096, "uuid": "566ad7b2-f8a2-4a2a-bb18-21f7c7a466df", "value": "T1CC95121276D1BD88E5354B729F1BEBE87A6FBA20CE0C67751224AE1F14701A1C973336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337096, "uuid": "1d1ee028-f1f6-4c76-84a3-e5538f68c30b", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337096, "uuid": "365fd125-3c34-48d0-9bc1-91f0b738213e", "value": "49152:xaUGBS0p4WWkgfVenOdxIB0yUB+xLVthqb7:YUq0kyViOdivhqb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337096, "uuid": "621d6127-2721-4319-bd23-80125c284c55", "value": 1987072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337096, "uuid": "0d56e9b4-5d8f-4672-8a70-1c4337a0f5e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337096, "uuid": "67547477-83a2-4dbf-9757-9217bf51ba95", "value": "72c0564ecefc376463c23b9a82ee0f77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fdc00f-a2f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675339890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339890, "uuid": "211c921c-a88b-4a94-81f0-56bfada7f3e5", "comment": "Malware payload (Smoke Loader)", "value": "dc360b4d9cb67a8a9213fa9e2683492b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339890, "uuid": "a416d1f6-33c5-4906-b4f0-49333dc1eb1c", "comment": "Malware payload (Smoke Loader)", "value": "2f11eff5d67edc9794560ddbd850ab8ab111ac3cc74b81622badbe234b7b3a48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339890, "uuid": "c717455c-9708-423a-905b-ad674ce2a2c2", "comment": "Malware payload (Smoke Loader)", "value": "35ba2a2e5b0307140e1dd1a0e2d04dd87bf489c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339890, "uuid": "22e5a37e-ccda-4ac0-8955-cca79c69aae7", "comment": "Malware payload (Smoke Loader)", "value": "a0940e32ba0be1125645477eff26b40639d456d34c8933642a8b0f3119bea4474f755e7bd8e9edf6ccfd74ea951513ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339890, "uuid": "458c4158-3398-4bad-8de7-f439dd6418e3", "value": "T1AA649E32B2D0BC48E5728B719F1FEBF4791FF9508E18777A1215AA1F14701B2CAA2725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339890, "uuid": "c101b947-da60-4e05-b2e6-c838d272a7c4", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339890, "uuid": "b1799938-c5b6-4fc2-94de-8228483c5eb7", "value": "6144:l1LmkbD9jQ59kb/jA3hhb9/CJTk637eQfnd5eB:P7DaTkbEPb9CJb7d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675339890, "uuid": "dd03ba7a-6519-4ae3-ace8-c42af869e544", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675339890, "uuid": "3319ba9b-6536-464a-922b-8fc2f27b614e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339890, "uuid": "ba562584-6776-4746-a7be-9be755fc299f", "value": "dc360b4d9cb67a8a9213fa9e2683492b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1adf200-a2c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675320656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320656, "uuid": "b52ec4af-0f31-480a-b35a-e850650c2963", "comment": "Malware payload (RedLineStealer)", "value": "038622c6279b62272933d5e86e1056bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320656, "uuid": "1f01c076-0e40-4410-b37b-9c41da1e5db7", "comment": "Malware payload (RedLineStealer)", "value": "303262122fa39fdf8381e625e4def3bbb70a08f6ace6f8da04449438c606a3ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320656, "uuid": "a683fa6f-de57-40ef-8d0d-d0a3e208b6e6", "comment": "Malware payload (RedLineStealer)", "value": "d924ada192f407478ff86a2f826783ab92598f96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320656, "uuid": "dea1bdbb-a07b-4c99-a28b-b41b6e15e060", "comment": "Malware payload (RedLineStealer)", "value": "4caeb66eaabf41e3b6aa869c8d3ad9f4a1041bdca88e6abb1ad375964d1bf93735d72cd6d297cfea4020bc8cfc424f92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320656, "uuid": "b46ce751-abea-46c1-8c86-e7868820b074", "value": "T14B74022375D0D032D56705306E10EA92BFBE7A312575E9573BA807AA6F706C0BB3A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320656, "uuid": "d928d487-e8ee-4d9e-9f3b-f758db80bad6", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320656, "uuid": "56e16712-bb37-4805-9bba-b711317f221f", "value": "6144:JtYrfgLSe3HNS03+/m3zSJ+TFIzu2s1pG95aGJrzqXK:JtYkGe3HNBzDSETFz2vrz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675320656, "uuid": "c9b6768e-94c5-4bed-860b-38dc2f414022", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675320656, "uuid": "96b214c4-9482-4ea8-81f1-f85d0342707e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320656, "uuid": "a33bc65e-db25-4b9d-8d1b-c5fa4bed2e59", "value": "038622c6279b62272933d5e86e1056bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801d0520-a2a1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675305004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675305004, "uuid": "1f3bcf1b-7396-43be-8842-b8b8f4144ca8", "comment": "Malware payload", "value": "50d70e6b2d7fa484c282db93a54f46d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675305004, "uuid": "de103c89-dab0-479a-bddb-b14808c1c8b4", "comment": "Malware payload", "value": "3058e7f271b2fd3b5553d6aca77d673fb69d7c80f495e6782d7a8d13beb4b666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675305004, "uuid": "f9b2b43e-8469-45e3-a789-977bc788a076", "comment": "Malware payload", "value": "0d4be2befc256d63f1740eeece8bfc56a01dd716", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675305004, "uuid": "0223eac8-272f-4af5-8942-bc3f96955008", "comment": "Malware payload", "value": "fe45770a3dd8f08e6dfa493e7cd3a14d70ab8862ec335beb674b24925d29930065d6ed37ace705a8359a62836b55dc0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675305004, "uuid": "b9857f57-6d8e-43bd-9c7b-4e65c2feb168", "value": "T16DE49D217693D439D67102F54D2CAF9A652EBC250F650EEBB3D83A2E4D350C11F31AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675305004, "uuid": "72aecb06-f7d6-47be-9bd9-776f1c01b96d", "value": "9ee9d45c8bce32778339e6520a9cbf08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675305004, "uuid": "49b5c003-1550-4c42-aab9-ff90dc42db4d", "value": "12288:Th6axSsrwiIB4N7dbvut+OeO+OeNhBBhhBBO0+q6jopbM2kvRhQndKba5ssMUlJQ:Th6WSsrJu+AsbM2+QdKcl8fRLJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675305004, "uuid": "37fba83c-bf99-49d0-9dc6-5c08444f99f7", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675305004, "uuid": "cb500a1f-f545-49f2-b2d6-b2be2227c8ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675305004, "uuid": "05c3e67c-8ec3-4220-9ce7-2702ecbab97f", "value": "SecuriteInfo.com.Variant.Fragtor.195806.6459.9689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495c56f4-a2f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675340130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340130, "uuid": "70d34c01-945e-441a-a2ce-6f4a4b270665", "comment": "Malware payload (GCleaner)", "value": "8fd2e25dd86f8e5494eff78187c603c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340130, "uuid": "69a573d1-c8e4-4491-93cc-c7c07cbc2470", "comment": "Malware payload (GCleaner)", "value": "30aeee9e6e2ff1dda677957a82c663b88d1d1d24ce8a1b9b7eff5fe15d7b1914", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340130, "uuid": "827cc0ff-631a-4252-b805-6fdcfa0a386f", "comment": "Malware payload (GCleaner)", "value": "3f4b256f408de66d4b055850c2fb1597e13458dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340130, "uuid": "80c36d43-2d0c-43b5-896b-351c5d25c4ae", "comment": "Malware payload (GCleaner)", "value": "2efabe463fd11e79c5ab766f9f8895de63c272b20f1c562c755bc4f8df19db5110a1319d30d0ef0db06a29c9e6bb21d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340130, "uuid": "8d0d4def-39de-43fa-8d82-095b63af5f15", "value": "T151953306E02BC0B3D241CE776C229A14EF72BEAE05B56210FA5D066E5F765407E1B7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340130, "uuid": "17b87cfb-632c-40c3-95b1-098998acb7d5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340130, "uuid": "ef8ac48a-e22e-4a64-a891-5520b885ee89", "value": "49152:bg4tBqfWXxGusPYMQymMZhB+6JLuugNeg/5KkZEWkLCgv2MR:ccqfWhGusot0gei5KP3v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675340130, "uuid": "39b1770e-66da-46ab-b159-940863c7b679", "value": 2036445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675340130, "uuid": "a3f6ecca-9b47-452d-a9cb-a07956aff30d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340130, "uuid": "138d5edd-3288-4928-a56e-f08f6a76c4dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3e6b7b-a28f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675297348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675297348, "uuid": "caff3e74-9b1d-4382-a3ab-dd290ae7bfef", "comment": "Malware payload (AgentTesla)", "value": "6171ed1c9867c7389e1f7c4cc838af33", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675297348, "uuid": "a709e362-d46c-4fdd-a789-bac815d33448", "comment": "Malware payload (AgentTesla)", "value": "3191fe463f8c9a91ccf9ed9a81daef803f9c184fcb093b24ffafa1f2f318eb64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675297348, "uuid": "b54eb7cd-f873-4d1e-9c68-d1027be48b54", "comment": "Malware payload (AgentTesla)", "value": "03f056b66330b236518f8e38119672a907e05ba1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675297348, "uuid": "4658b0a5-bbb8-4ae4-a33a-96dbf3f7766a", "comment": "Malware payload (AgentTesla)", "value": "9ba3c058af8f0d6983313f9b715eb5eb3fd9206292ab9c2ef549eeba9e0339e9bca197537b8763c0a04a9cc0d0c382fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675297348, "uuid": "824bd4a0-3a4e-4898-851c-d9c2134df230", "value": "T10BF48C8777B1A8B2F6CB00A5142837CD2FE0B103BE95E2579B7B79C0A7058FB7698151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675297348, "uuid": "78058e58-7b89-46b2-aa15-d108299e2042", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675297348, "uuid": "aa77376d-fa3f-4b82-8c64-b2c5074a1fc1", "value": "12288:Vtz8L6gu+xMRSR5SysLMiKynqd9CnFrwys1LfqG4yPa:oLzyRU5QMduGPNfqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675297348, "uuid": "20edabb7-d360-4eaa-adcc-c5070d535bfa", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675297348, "uuid": "e9e84c12-f27a-483e-8aa1-5c2eeb5f4adc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675297348, "uuid": "5c7456c1-cccb-4f90-9c11-a9ee618ee5f7", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834bf9cb-a315-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675354831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354831, "uuid": "319abfbd-aa15-4a37-9169-ce69e091de32", "comment": "Malware payload", "value": "ed252b2aeb7ba67315c8f7ca6200e218", "object_relation": "md5", "Tag": [ { "name": "1675352134", "colour": "#43F4DF", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354831, "uuid": "de1d9590-78cf-4944-b799-86b3dada06d6", "comment": "Malware payload", "value": "319db59d8a4addfd6956413af7da48b33cd355cbeb9ca90a191ddf57f45e681d", "object_relation": "sha256", "Tag": [ { "name": "1675352134", "colour": "#43F4DF", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354831, "uuid": "6ab83183-0756-471b-891b-4726746be3c8", "comment": "Malware payload", "value": "96e34a66cfced7d75db9f1c81036ac56ed2d7042", "object_relation": "sha1", "Tag": [ { "name": "1675352134", "colour": "#43F4DF", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354831, "uuid": "ceca48ac-852f-4663-831d-e8b1d8aeb2ac", "comment": "Malware payload", "value": "a96c54a66b3ec3755620a95d0cce87ec2c359e4a8e4962d2c5240140a528a34ca7090b8430a199bb3855716e7959f88a", "object_relation": "sha3-384", "Tag": [ { "name": "1675352134", "colour": "#43F4DF", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354831, "uuid": "8479b114-699d-4c5f-809f-70667527352e", "value": "T149E3D0323AB84681C3B42BF25AE67F0A6A2FEE1623571B1F57A6521F4D90244DD04F4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354831, "uuid": "1ac3c529-75e6-447e-b336-264b65572cbd", "value": "3072:uGbAVfBWQdmUeG33oEkIrrJFxeauCm35hvuWt4AJERnyNenUWHCoTCCCCCCCCCCe:uiAVfBAa33o9krJeDz4iERB6ZS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675354831, "uuid": "6a76d507-10fa-4ce4-999b-1432587ab228", "value": 150272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675354831, "uuid": "fcfc0fa5-15c7-4652-8355-d5703bb85b3f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354831, "uuid": "74c298f6-d0b0-46d0-ad93-3b52f3119a25", "value": "cancelation.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7bec94c-a2c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (BlackCat)", "timestamp": 1675321096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321096, "uuid": "63991fe8-f897-4b12-a9e8-c207177e8dc7", "comment": "Malware payload (BlackCat)", "value": "b00b5eb046fe27f645b2a9b7aecc0205", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321096, "uuid": "9bf64388-7e3c-4cfd-a652-feb8809ecd65", "comment": "Malware payload (BlackCat)", "value": "326993f7e516c7a9608bb8bdc9a7ae162ca485f70a97ede3fd9ba137878c66e5", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321096, "uuid": "26233e0d-c959-424b-abd4-87a400ae51fb", "comment": "Malware payload (BlackCat)", "value": "cade2b4fd89e611c335edacc749ddc33899b95f2", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321096, "uuid": "d9cbf7ee-4052-406f-8b03-bd1e5c16deb8", "comment": "Malware payload (BlackCat)", "value": "d932aea95a03da9f4cb32f145d55a1351c827a593ccae4f901bcc59c693b4fa251e6835c148d451edcbabdc234586d41", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321096, "uuid": "979bb06b-b6a9-44cd-8b48-3a4e7222eb50", "value": "T1E5C66C96E847E9BDF76E3070B47EB73199E4082850576D7BDE86C8B1A28E7313C4811B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321096, "uuid": "2a95a2e5-79f0-4ee8-94a4-04fac3f0643b", "value": "7d614df4d986ee3d7de768c8be4d1b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321096, "uuid": "8882da0f-6628-45d8-b3a3-02c7ae907be0", "value": "196608:RAzfOpZutBRpns5DV442yHzazu0sGkDEnNffjCi:RdpstBSDVIywky7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675321096, "uuid": "70508eea-724c-46ab-9c22-d058f6fc2e2b", "value": 12280839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675321096, "uuid": "9e9e159d-895f-4d9c-a69e-806bd203064e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321096, "uuid": "ca2ff755-772c-4b47-933c-ad1fe29d45b0", "value": "b00b5eb046fe27f645b2a9b7aecc0205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06a05a0-a2c3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675319741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319741, "uuid": "e2b5a42a-2a74-4102-9b9a-da2e96523fee", "comment": "Malware payload", "value": "d460bcc48367bfdde6e0807fcd1883c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319741, "uuid": "7711d48b-d7cb-48eb-984c-03929d5751be", "comment": "Malware payload", "value": "32bf8defc88393a58fa2dc13e24408fa8676d47d21893a48d9cc461a30817a1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319741, "uuid": "1511d08f-3c8b-41f7-810b-1ea305636ce7", "comment": "Malware payload", "value": "4b679b1674797cf4dca6c56127e4e5a6e0aa3f07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319741, "uuid": "6eff1072-b645-46dd-8b85-21db08f75f63", "comment": "Malware payload", "value": "d80da554d22097d20b5518a95d8e6d17101b3a003ba9ad080e1609c6ff69be55328b60131b9e1e431fbaf7704c57013d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319741, "uuid": "714febed-9ebe-49e5-a919-c7c5987a5571", "value": "T12506335253E65EE7DE1487F20EEC4C27D861A1C0C1EBB880552179BB7761BC286ED0AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319741, "uuid": "f62542e8-7f25-4b06-be2d-a9cee20ebb12", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319741, "uuid": "7b448dec-2df3-4b75-9ffb-09477b545d18", "value": "98304:B1cbo9r8ZRlPKLAbxoxzSiv3Vc7q/wjeRs4t14:B1cboGPJK8bOJm75p4n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675319741, "uuid": "6b660353-8fec-44aa-8aea-073faf5f9bb5", "value": 3755406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675319741, "uuid": "eb394d6b-f317-4137-82a6-127106ae48f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319741, "uuid": "518c5426-d842-4414-b9dd-aa80d4c52d0a", "value": "filename.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bca772-a325-11ed-88f6-42010a9c006e", "comment": "Malware payload (Simda)", "timestamp": 1675361846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361846, "uuid": "84d91b6e-fef9-4112-9352-52c24c87fdab", "comment": "Malware payload (Simda)", "value": "41772f673922776b63baa54113cb01be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361846, "uuid": "9c6fa556-b3d5-4928-baf3-899b65d9f89b", "comment": "Malware payload (Simda)", "value": "32e6d94faca82d6d7967fc96fbe1f14c59385218d222d15e6e1db04c9242c806", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361846, "uuid": "44b9ea78-7d10-4abb-93e8-13ff385be6e1", "comment": "Malware payload (Simda)", "value": "8f779dbd065136c3fbfe92e76f7aa0920f6d502b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361846, "uuid": "5dada8e0-1d56-46e0-80a2-88f13d222947", "comment": "Malware payload (Simda)", "value": "8fd2a69943fcaf9e181decd7106417cf8dc3d11da60527d8d88bb32f05c9a0b903429f410d99143f483cc7ebabdc2dbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361846, "uuid": "facaf3d9-242f-4fea-b7ab-61005bd32f01", "value": "T1D2D4CF51F185C176E4F116B296FF7B2B106C69654718B8E3E798AEC92C740F23A3C287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361846, "uuid": "e5658b6b-3668-4dd5-981d-1be9e2467b66", "value": "e4284c77d0ddfc22d080aac379d5f31d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361846, "uuid": "c4d64830-9c35-40eb-8eae-635514585d2c", "value": "12288:GwmWTR1arYnEKosuzY34CZ3DQvSkNL9qyFhJy56d/eoyXjn9W:GwmyRcrYnxUzY3NZ3DQvZNL9X7Zyz9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675361846, "uuid": "4df74b2a-de1b-49c9-b883-892c6c562a41", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675361846, "uuid": "85fd0a02-0048-4c95-a431-36dd78cd5774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361846, "uuid": "844e41a5-bd51-44da-81a5-af6e0d48eda9", "value": "AVG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1442123-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675337298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337298, "uuid": "fc5a66db-ed01-4398-8683-0158b6284c14", "comment": "Malware payload (GuLoader)", "value": "d26b9137f31c1c7296ea710bd71b3a59", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337298, "uuid": "51889bf5-44c6-4bde-b36c-7c247f26c2a4", "comment": "Malware payload (GuLoader)", "value": "33146615b36e5718c7e8e69269f3c5cdf3ec72b525e24550da62b360f1360d30", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337298, "uuid": "45d45b38-bcb8-4920-9e39-f9c1634b0a4f", "comment": "Malware payload (GuLoader)", "value": "b37fcfde9230d8854a8bedb13203beffeb71df21", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337298, "uuid": "cb019c91-7d6d-4595-8ba4-73a20c74694c", "comment": "Malware payload (GuLoader)", "value": "e107ecec7e59ca87da59dd2c56820b876cc19d07fb93884d7e1a0aef212098d9ba36d2796f74cd187145a9ae4137b8c5", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337298, "uuid": "0b0d35a7-91e5-48cf-bcd5-e5d5fa9adda1", "value": "T1AC948B53DA902A21271B4FEF94C11E694D91191A360F48990EB2267E0F4E2F4FEF727D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337298, "uuid": "be28a586-f37a-45ab-8a19-9879845a7dc4", "value": "6144:JCj1ltFlJ1KxZheePFmYAcM2qQLIcK6wa31LBygR9T8nMs85HaUb4bWPJxxRBtps:Uj7tHP+3zzqVcK6egj4MJ5HaUbhv3ps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337298, "uuid": "0d5737b8-3a05-41cd-a822-fc0e4ffb3bba", "value": 421396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337298, "uuid": "e1848fde-16c8-4b4f-ba1b-e6e01840713b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337298, "uuid": "faef409e-48b7-470f-a413-34773edd9e52", "value": "reciept_ 0014010303102_JPG.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12cfe655-a328-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675362802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362802, "uuid": "f8751200-475d-459e-a1f9-314391d84174", "comment": "Malware payload", "value": "6b46b63b8fbd5147dad103c7fa8144d1", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362802, "uuid": "775c87f4-f865-4ec9-8b26-e82ade0e3cf4", "comment": "Malware payload", "value": "336730c99affb33befc42729db6448ee8b6bdb07657fb49d301915f8c2c6b2c2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362802, "uuid": "7598c39f-525c-4fef-93c1-5d67c1303eab", "comment": "Malware payload", "value": "3fae56c4ecd94dba310f84d73e750f36aa256f48", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362802, "uuid": "996cb3d4-6d1e-4266-842b-8636fd187ebe", "comment": "Malware payload", "value": "e5474945fa3a84ac0fa1452d849994c7ff2d5f7ced7ee8226687c822c7e45d08579b4c1965a4d4c5625255392241d571", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362802, "uuid": "d6950e16-2678-4a98-9da4-6533f1201891", "value": "T169D6222275C5C633EA6F8330552ADB7B51F97AE0377380DB53D8992D0E719C08276E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362802, "uuid": "da016f3a-c278-47f4-8714-46d5b1951ac0", "value": "393216:OPJBf6wAMQ8MLCCBtBOy2suKLRyfWVC8:OPJ7h3wBtBXruKLgWVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362802, "uuid": "edef39a4-46ff-48fd-be1e-4d8ffe838f61", "value": 13090304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362802, "uuid": "5639275c-ae38-4b00-9966-080dc6aea24e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362802, "uuid": "0644d7e5-ef6b-4020-bbab-706a257c96f0", "value": "SecuriteInfo.com.HEUR.Trojan-Downloader.OLE2.Powedon.gen.12531.31665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9171cd46-a2b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675314052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675314052, "uuid": "0e62ca34-8c62-48d5-b61c-d2aabdf9aa99", "comment": "Malware payload (GCleaner)", "value": "93ac6ed8377087709b4f265ddb908b60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675314052, "uuid": "345c0fc9-4b23-4c31-bbb7-f4e60ff743e1", "comment": "Malware payload (GCleaner)", "value": "33cd416103dd4f4bb10414ac46d02d1c923e398cc29fafe5a0fab084569a048c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675314052, "uuid": "552774ed-52e0-4f09-862c-bba7b554b415", "comment": "Malware payload (GCleaner)", "value": "68b05337171bf2b5db67b9fbd81abfc81ec4ae9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675314052, "uuid": "5ce93ea2-d3b0-4309-85b5-8a41077e0935", "comment": "Malware payload (GCleaner)", "value": "a180161ba294891de9c81e3eec29b11c08879db43e0964ad55bd9273bc4ecfe2ab9ec007b09ce1cb17af814444435b10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675314052, "uuid": "250aee90-5472-4d1e-80f1-55d345d36afe", "value": "T127A5334ECCB1847BF362463DAC345E906E273B575D3C956C742E35084F3B2A6A8263B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675314052, "uuid": "8f09b7cf-bc7c-474a-9e32-fb4ef9daa75f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675314052, "uuid": "7d4e11b9-542a-47fa-9351-d54b0815e77e", "value": "49152:bgOCagozm0Fa4/QhTJWRbH1GHE6j/rSc1tF38+H2vLeQMGfBLCgv2MR:cOCoQJWxH1yE6j/ecxFLQRv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675314052, "uuid": "29538a15-e2cf-4206-bc2c-4884e81b08ef", "value": 2066403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675314052, "uuid": "3506cd9f-da5b-44b0-912f-44383c0d7328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675314052, "uuid": "089bfcbf-4386-4c14-86ea-0ca1a9fce900", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036ab770-a2c3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675319397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319397, "uuid": "fca44552-6576-4686-b509-33c7de102f78", "comment": "Malware payload", "value": "1be9358d0cb93d559cd2dd3ddeaaa172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319397, "uuid": "0ab3ece8-cc60-4ff0-9569-ace35379f584", "comment": "Malware payload", "value": "34e8cacb1911c922ae623cab45df4daff3389b39355dd4c87b0d8be860fbbab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319397, "uuid": "4972728a-e35e-4c04-bb78-4b61df223045", "comment": "Malware payload", "value": "a67c707b840d598f9e1295778fd7493e61d88e8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319397, "uuid": "3ca506f4-30dc-46cb-add6-25a18f3af88f", "comment": "Malware payload", "value": "221bd162b81aa4a0bd5243366cc0c1359a8092cae71fea0924853985e167419fc65e8ce03e71bfb8d9f4d234b5e748e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319397, "uuid": "bb38c3a7-a3a7-4438-a2df-71951ae43171", "value": "T134E2AF5B39A91033DFD1113109FABA4811AFB5710FAA7CD3B6D0A9480AB47D2DB3624F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319397, "uuid": "7ad82c75-f2bc-4e2e-afbe-0374781e7a7d", "value": "dd7dc30f9643916024e5f96fadeee9e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319397, "uuid": "c7fb8cd6-e0d1-4f35-812f-5b8a4a792a29", "value": "768:xepHn5qsE0KH0z/IF9kNQiWCQFbuoQH1NzenUCWRVEE9Uq:UJ5I0KUzQIUCQFC9HnzenLWYE9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675319397, "uuid": "aa52b678-ea36-4544-ab3a-a281aa201e57", "value": 33516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675319397, "uuid": "d9c40e9e-3d62-4b16-95a4-ec225daecb20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319397, "uuid": "00bf2f46-fa77-46ae-a10b-a2189d297c7a", "value": "data.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf609ac-a2f2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675340004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340004, "uuid": "cc084e3f-0cfe-4b34-9b4e-39a194af7197", "comment": "Malware payload", "value": "e61476f0c7fb9ad16e331ff206a7e73d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340004, "uuid": "3e1d0d36-ccb0-4049-9e8e-b89d63f693a9", "comment": "Malware payload", "value": "35012c842c98cae07d09ad13f9de4f61b2bbb0ddeee617af1ed761e1488857e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340004, "uuid": "87ff7aef-ec1a-41d4-8f56-ca0db5cf7f29", "comment": "Malware payload", "value": "3402f4ffb56ffdfe5727d01c9e4e1f19862366e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340004, "uuid": "c8cc4bf6-bbe6-4433-8323-c27f9158067d", "comment": "Malware payload", "value": "cf64446e5d22666a25a4afe306318b9c39bdf0a93a3eebe6b1d06e10db8cb6f3c626491aea759e895a0a4b3d8d4342dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340004, "uuid": "2d9af049-c315-4f68-ae3c-9bbbe6f0ff4e", "value": "T1EF9584A0FEDF10F4EA035C315596A23F5B21230A9B38DED7CA640F42D577AE2097652E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340004, "uuid": "192a5403-f372-46f6-afdc-2f35db6da4f3", "value": "49152:mynSK5EsNuNc4Jyj+NTpGktKDJ3Me01iVp:m9KmsNuNIjnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675340004, "uuid": "9dc936d6-c0e0-4551-a3c8-85ffad57194b", "value": 1931833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675340004, "uuid": "1629fba0-df62-4bf9-ab2c-4be2817a1b0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340004, "uuid": "ead78be8-2eb7-4639-b3ad-fddef28d63ad", "value": "e61476f0c7fb9ad16e331ff206a7e73d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40076772-a31b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675357295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675357295, "uuid": "fb831fc1-0462-4934-9fe1-b402542d6077", "comment": "Malware payload (RedLineStealer)", "value": "7835adbbe5642fb1e32578dc0b793791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675357295, "uuid": "e573a8ac-6b92-47ff-9d15-d773e3846fb5", "comment": "Malware payload (RedLineStealer)", "value": "3597e76c5d7d649f8c5b6f745bf79063156a4da75cffce27a60d6b3cfde4a95d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675357295, "uuid": "7bf57a8d-0a88-4ad5-8693-c70e5745c76d", "comment": "Malware payload (RedLineStealer)", "value": "45d60d907692a4d8301b8444503f0955d0f49814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675357295, "uuid": "f548b9c5-4972-46c7-933e-2cd917a4c42f", "comment": "Malware payload (RedLineStealer)", "value": "3618e636eceafc3c95bad5212e370d589202aa39b4e20ead2704c95ee428bbd19b5751be52a9db88040f4b9128ff7582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675357295, "uuid": "5860d054-3efe-4f8a-ac3c-0cc4685dd547", "value": "T17494B062B2A1BC59E532CB729F1FE7E4391FBD508E1873B61228BA1F14711A1CD63724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675357295, "uuid": "c95e5c03-41e2-4323-9ece-93df5a490d8e", "value": "e479a558a3a55c2bde918dd7ce07e020", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675357295, "uuid": "08354bfb-f8eb-4c19-ba5e-db4cf13821c6", "value": "6144:nlLRmAYk/nOKMr3BKcG1e3X5Vgy+5QDORxN9/CJTk637eQfnd5iamOWBo:l9J3MzG10bk5tz9CJb7d5GO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675357295, "uuid": "80b8b592-a879-4999-a1bc-062ba3c0d655", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675357295, "uuid": "20fbdc44-85d9-4e35-8a32-7e672a026843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675357295, "uuid": "85f69c71-e8f0-491c-8450-002eb5bab943", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d374fb82-a2e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675333061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675333061, "uuid": "40ae5fc7-04ee-4a76-830d-f7ffb43dc7b5", "comment": "Malware payload (AgentTesla)", "value": "9e4e62b952af5d184d76b3feff339c45", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675333061, "uuid": "becce978-ec28-458a-9f11-7abee2870731", "comment": "Malware payload (AgentTesla)", "value": "366ce72f1e9bf13241e2a3eff6e38e02734a1ea17667c4911c5d09905461644f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675333061, "uuid": "9e101595-b558-486c-93d0-fd9aeff5e5c3", "comment": "Malware payload (AgentTesla)", "value": "fad9c805d12fff5d4d7fe15d7871d41db91d2478", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675333061, "uuid": "a6d65ca1-526a-4b8e-accc-5985f0f81b14", "comment": "Malware payload (AgentTesla)", "value": "6edcf4199b9174cb75c6f4328a29608598ab3a08d2687b9e3bf3a7661bc882294b23a6dc551d03157af203ba92119432", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675333061, "uuid": "5d40b26e-169b-439c-8a80-1cc41845ab40", "value": "T134D4D53D19B613E6C338FA7186E18420B6EE61923703F968DDE65AD14F025C2BECE51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675333061, "uuid": "e6841272-433a-4df1-a782-866e7f5ec273", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675333061, "uuid": "a316f470-88e0-43ae-ad2c-a5092e05cf7f", "value": "12288:d2g+C+2SlLVseHKNTn7tunA+/kSiVljwXqErzq3d7wfghQRf4HREJiVqJk6T1odI:d2hjseHKNTn7tunA+/kSirKqWONURf48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675333061, "uuid": "46ab3836-e430-4496-b72a-2a093537e84f", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675333061, "uuid": "5f7227de-d9f3-4edf-9d40-d6311bfc59bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675333061, "uuid": "e76b92b1-9182-4f09-9d5b-b411ee7fabfd", "value": "MV VINDONISSA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec40e239-a2d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675326660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326660, "uuid": "68b118a5-1ad1-4c34-8468-a3b3c4a96cc2", "comment": "Malware payload (GCleaner)", "value": "7bd65adb3d6eb6963c2e1eb53f47d888", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326660, "uuid": "1488ff10-a951-4835-b1e9-b49338741d82", "comment": "Malware payload (GCleaner)", "value": "382ef403e766d59abb559ac7ccfabf429d792a051a5ed6465cc7d836dd8015de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326660, "uuid": "b05f718d-028e-4d1d-b70a-ed8c32f3149e", "comment": "Malware payload (GCleaner)", "value": "99fcb7bbb8d9c0dea8a4a6a3b1d783708dc12dae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326660, "uuid": "de023000-fdca-4173-8643-b031c7bc8e8c", "comment": "Malware payload (GCleaner)", "value": "2e01584d397863ec2b0b2d5876d86b2345bd720c93cce17d60bcf0ca61dcceb53f98817ac085b71750378d315da30ca5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326660, "uuid": "1a9edc83-cdd4-43aa-9acc-b0bcaa4b5082", "value": "T1E6A5330921F5E9BAC3919738183C44506BB7FB6D317372293A6C3B8F8FF25996E49601", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326660, "uuid": "e62df96c-cfc3-4c63-adb4-2899c41c069d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326660, "uuid": "14db9ea3-6f0d-48ae-b78e-c6c5e243218c", "value": "49152:bgxON0THpvhhoQIFyAj3E5Rn4yExrCf1zmMxvBZwLCgv2MR:cB9vhOPFyAj0rE5Cl5v0v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675326660, "uuid": "c368ffe0-09c1-431e-b440-13a158f2b9dd", "value": 2064841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675326660, "uuid": "a9b6db4c-fad6-4132-a442-4d228e2f4312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326660, "uuid": "d49fd11f-efb0-443c-879a-cd7e79fc5512", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2faa7d48-a306-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675348248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348248, "uuid": "565e7fbb-5779-4c9b-829a-91a1e24614c1", "comment": "Malware payload (RedLineStealer)", "value": "87768cd45992b45729a2da1f578ebe74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348248, "uuid": "b057c3d9-ffce-42ad-9904-2f28e1336753", "comment": "Malware payload (RedLineStealer)", "value": "3938fe655fb2c6eed2ef526642501ab1476f7820b25ea312e3204224a28c0141", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348248, "uuid": "fabfed8f-ce48-460e-baba-c3130e9005fd", "comment": "Malware payload (RedLineStealer)", "value": "d06a20d494d01229d0108df407c2ea40ae5af442", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348248, "uuid": "67200f20-e40e-4365-9232-1ba704f29fe2", "comment": "Malware payload (RedLineStealer)", "value": "ba98874411c811cd5b09ed254214479ab5d81ec1ead68d93d1b6756659f4045774dbfa80ff5728ae80221004b6ec1866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348248, "uuid": "7755c48f-993d-4fb8-b890-05c81179620a", "value": "T11D94B042B2A0BC49DD318B72CF3EF7E4791FF9118E59B7BA1218AB1F14711A1CA52325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348248, "uuid": "53f4f7a5-6ce2-4bc2-8b7e-1f07ce9d13de", "value": "e479a558a3a55c2bde918dd7ce07e020", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348248, "uuid": "f5fa6df5-2fe8-4fe9-ba92-67f446f04966", "value": "12288:MtiMkgP2LzDIv9min01tImh9CJb7d5i4:3gPYzEvEO01Wmh9qb7d5i4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675348248, "uuid": "14ae41d5-b57e-426a-8124-fa05954fb6da", "value": 418304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675348248, "uuid": "c63d7594-4fb1-4d63-96ff-afcb64a7b1e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348248, "uuid": "4962ab44-f3f4-42bb-ae94-6263d8e07621", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8f4463-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675337054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337054, "uuid": "af34d99c-1fba-4625-8624-335dfafdf183", "comment": "Malware payload (SnakeKeylogger)", "value": "af98d8808748719451087843ded8b403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337054, "uuid": "88e65b65-5650-4172-a49f-84d727f81321", "comment": "Malware payload (SnakeKeylogger)", "value": "3948e9e5750dccfb3cf569a29155246a8188281de1c3603cabf74b2704ef3610", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337054, "uuid": "6ce97ffc-651f-4a20-aa39-6ca46164b117", "comment": "Malware payload (SnakeKeylogger)", "value": "e85718ce3564c2bbf4ea2fc5c94c7afbba39c148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337054, "uuid": "9889f7a8-9376-4d26-a085-d9e440556afc", "comment": "Malware payload (SnakeKeylogger)", "value": "7a4191a597e6bce6f7df20d1b24425a1a259ddb7740967c8ff5f19a42cb3d9de8c5582b29ccb55373ae29b0c69e834e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337054, "uuid": "9f352226-cb11-4d42-9570-41a47472dd5c", "value": "T1FDE1D81163DD8733D9E68F759CB2A7450778AB015D03CF2E35C852AB6D5278A0BA1F70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337054, "uuid": "486464e5-1bfe-4bea-a9e0-fe72b891fa32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337054, "uuid": "8e5d0a94-a364-4a9c-aefc-7aede92013cf", "value": "96:ONgKd9GjtcqmKTFA5ZlAHjD1ZY7ZMtLHFietEkAUPtdSozNt:Oma9GjyGODCDDtHF/zAUPCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337054, "uuid": "2b44c79b-864a-4e64-bf71-29e9794f3cbe", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337054, "uuid": "40ad546b-0493-4536-9b35-c26a7fb8ed06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337054, "uuid": "140c9538-ab41-4a7d-9135-5a12f8535c22", "value": "ddd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6f47b5-a30a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675350066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350066, "uuid": "042dd094-6693-48cb-b1c3-6cc9a64527c5", "comment": "Malware payload (RedLineStealer)", "value": "ae81d0c154590286c5f9828ee564c51c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350066, "uuid": "1cb84306-f6aa-4df0-a12c-f2f970407473", "comment": "Malware payload (RedLineStealer)", "value": "3974a362e78341a13e78747c30cf901c007fb0bd3beca1f8162389d9ac486a21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350066, "uuid": "6ed39c1b-e0ec-4ce1-8769-295f5213e9ce", "comment": "Malware payload (RedLineStealer)", "value": "d3197dd3dd26d73a64919da120b1195a770e0983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350066, "uuid": "0ef807bc-c590-43c2-aba3-f1d55a298282", "comment": "Malware payload (RedLineStealer)", "value": "0a457798d276585b5ba42a4c943c83cedf7212e00c7038fc3f7131618fcc4320fdde303cd3a07b8f755aeeb791186364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350066, "uuid": "6c034138-0e03-4e97-8a8b-8930311f0e3d", "value": "T17094BF42B2A1BC49E5318B729F1EF6E4791FFD408F59B3762228AA2F14711A1CD62325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350066, "uuid": "65601b3c-308c-4ef7-9a77-fe0599772eb6", "value": "e479a558a3a55c2bde918dd7ce07e020", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350066, "uuid": "69ee5e31-bb39-4b8d-bf74-6ac3410f64e8", "value": "6144:knLD2AeGKz5p0ouoH4aoEywGgMqyPdzyCJOTe1e9/CJTk637eQfnd5u8dWB5:an85moQaoEywdMqsBhOTj9CJb7d5Hd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675350066, "uuid": "ff5e438d-3aee-4df8-bf56-f45047abef2f", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675350066, "uuid": "2a054453-0aef-439f-8794-7b90064cbb56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350066, "uuid": "977fa9ed-0abb-4068-bf19-26aaf1ae9d11", "value": "ae81d0c154590286c5f9828ee564c51c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0a090c-a2b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675312303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312303, "uuid": "c530c37c-c91d-43fb-a1fc-2c4bda77bbeb", "comment": "Malware payload (GCleaner)", "value": "39258eed7b6830a2eb92405f7cd5872f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312303, "uuid": "105c1f4f-f194-4f84-bd6c-7875296d99bd", "comment": "Malware payload (GCleaner)", "value": "39f3eeedefa4c77052d4dfb577d4f91da7e7107735c0d0f06fe867a573faaa20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312303, "uuid": "ec21b13d-2ed6-480d-ac28-e75541f3f5f7", "comment": "Malware payload (GCleaner)", "value": "e2ea50eea4267e4391bcfa13bdf197c58a969025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312303, "uuid": "b217c067-ed2e-43ec-a05e-8ca11bb5e67b", "comment": "Malware payload (GCleaner)", "value": "20eb0c4f3b6689f0f025e20307c9692f75f664bde929a3b48251dfc795123c1de5855bc5eaf5185a4ed7d89381bac536", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312303, "uuid": "f87e5b24-7445-4b1e-b3c6-ed88b93eb583", "value": "T12A95331B62FFC836D0A21B32AD2606647677BB676934120E711D356F1A373A1F70E386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312303, "uuid": "12c57df9-d0c3-41d6-828a-d7e2d04828c3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312303, "uuid": "81f9ea22-fe69-4a53-884f-be23f502d73b", "value": "49152:bgAs+wHOL9DUTKDZ+La6sSsPVXOye8Z/eJaqHpULCgv2MR:cCwHOLmTKMLdsS+xoxEv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675312303, "uuid": "7f38bf23-74bf-4f19-adf7-002672d608c0", "value": 2057132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675312303, "uuid": "febc5cf7-8386-46ec-a740-74ffc6d9f333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312303, "uuid": "be1c82e9-1edd-41d1-bdd0-36380a31608d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca17912-a2c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675321641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321641, "uuid": "212f63e4-d70d-4e1f-8115-7e4665f4c01b", "comment": "Malware payload (AgentTesla)", "value": "6276ac59876b87cd3c4d016f7f1a7696", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321641, "uuid": "de73c870-bb0b-4358-8108-c229139d6dc8", "comment": "Malware payload (AgentTesla)", "value": "3a7eef995236c7e9b182cb440127021ea5b5e105f54a900c11b7c1bb47512f41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321641, "uuid": "2fa43a23-43b7-42fd-8127-9fd1cba3ed39", "comment": "Malware payload (AgentTesla)", "value": "6ea22d1d1145c8835b990e67477f4efa3f001c91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321641, "uuid": "271bbf85-42d2-4e73-8945-bbab52a6be26", "comment": "Malware payload (AgentTesla)", "value": "3d230de645fb5201793e6785486d2ef7babe012269a9d0acfbcfa4fd11f38787b557004311c998e63b4f70ee6e7f674c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321641, "uuid": "27839588-20cd-4399-9d59-af6c29f555ec", "value": "T1B30401C4AFEC6C1BCD0ADB3978ED58285BB0F2287A42D3E75148D1598F423C56F4A693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321641, "uuid": "dfebd15a-48ef-4537-beee-a2817dd647b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321641, "uuid": "26d36829-f83f-4e55-8da5-fe5545360cbf", "value": "3072:7XmJE2+seOFkfyMGt+1+i7cWAkZ4yBulkf9z+Cn64ajFd3rremC0gYm6:7XmJmWE5cWA2BFTgNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675321641, "uuid": "e6c2d84f-6c7f-40ef-ae09-90b97bb1f422", "value": 186600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675321641, "uuid": "4ab974e8-7303-4da6-847e-271fb6584019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321641, "uuid": "3b20749f-031d-4205-9e4e-8e84904ef3e6", "value": "AWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab79e27-a2b2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675312323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312323, "uuid": "5a69e72a-0fe2-4480-811f-c1bff0c5b4e3", "comment": "Malware payload", "value": "b21ed9e935fe5a63756a249f66e5841e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312323, "uuid": "d4be1be5-1d07-467b-84c4-0000563ac864", "comment": "Malware payload", "value": "3aa2da4de504de5580d7d03e5c69f0f4c4d4f3c62686e275e8b4785136db2435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312323, "uuid": "cff0ba02-9a68-44fb-80c0-675588edddf5", "comment": "Malware payload", "value": "20c5b33376199a32225be12c40d4051df5bf0c5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312323, "uuid": "f5f807ff-caea-4799-aaab-096bf1d29c7a", "comment": "Malware payload", "value": "520c37e86d2b369e02d8f96defcd209860e2cdc4c97125fe1a7a356a6e9c7f10e874315332a2ae71328fc10816dfbe02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312323, "uuid": "3e1b6891-4db4-43db-9fc9-0b09d94430f3", "value": "T13B7633B2BA90847AC650AD381D101FF66798E79F1F632D636384D42CBFBD858D021DB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312323, "uuid": "e4bc90e3-9693-4ecf-8334-5e29f4935192", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312323, "uuid": "3134506b-d04e-4ca0-a1fc-65b7ad9e1eb2", "value": "196608:91O7H/vBlE4l6/+QjW4F3X838BzNYXTbXLSzmLoebT0D4YA:3O9lHM9WLsVNYDb7SiLoeMD41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675312323, "uuid": "e2d0e871-5a0c-4b71-ad09-ea0eacaaf638", "value": 7606159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675312323, "uuid": "b6be2471-b341-440f-9a52-de998abdc01a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312323, "uuid": "ee3877f2-3329-4aa3-87ed-ecdf36304dc3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96418f80-a2dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675330811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675330811, "uuid": "b1691da0-1b38-4013-b6b0-de64b23a419f", "comment": "Malware payload (Amadey)", "value": "ee2343d7f7fea757f8e52c8c6e7544a8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675330811, "uuid": "db691fc7-5942-450f-a455-81f74fa7534e", "comment": "Malware payload (Amadey)", "value": "3afce361856c31f7665e29156f285c5fda62162804eb74fbe22902f92744fb19", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675330811, "uuid": "ae018b21-4746-4b4c-af13-fa7055707a6b", "comment": "Malware payload (Amadey)", "value": "ae6c9eb1772356f235069284418296600833ad22", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675330811, "uuid": "a7144210-30c6-4504-9902-d5127987d729", "comment": "Malware payload (Amadey)", "value": "87e6371b3e09ab9e320cc1097218be54b320c01a3f9e44113a7defe7e5ba8f2bb0d229cafe462ad09438174ba0b00f59", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675330811, "uuid": "bdb04b08-ab29-4875-83d5-3772bf6b4e30", "value": "T125749F0276D0BD48E5328BB19F1EE7E4FB2FF9508E5977B61224BA1F24701B1C962325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675330811, "uuid": "ae85e0f0-bb1a-4dcf-9905-c15a480c6eb7", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675330811, "uuid": "3e6a7e68-7fc0-4771-b267-78503028a0c8", "value": "6144:aTbL6m+z9wQBdbcHyRDB2FV6s6jWEnv5i9/CJTk637eQfnd5nYthB:s8zCQB9BRDsvEnRi9CJb7d5nY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675330811, "uuid": "043e3581-7030-4b8e-b59d-58bf9df80e3b", "value": 360960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675330811, "uuid": "66e05484-18d5-4d01-94bb-76378302ba6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675330811, "uuid": "410471c1-8417-40b1-9c38-697a0c7693a8", "value": "ee2343d7f7fea757f8e52c8c6e7544a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ca2704-a2cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675323956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675323956, "uuid": "6c6fab11-7f6f-4b84-8a3e-6ef6c60661de", "comment": "Malware payload (RedLineStealer)", "value": "6cf2655af693736508e2dae8b2f337c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675323956, "uuid": "78d7e04c-65e3-4d07-92d8-7f71762dfb88", "comment": "Malware payload (RedLineStealer)", "value": "3baf17a23a490f68f9a92415e0bdcd81162f3fec71775de9442817edfdff8a2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675323956, "uuid": "dd88338b-c6bf-40eb-9377-aca2b9c0740c", "comment": "Malware payload (RedLineStealer)", "value": "1d9dba4f6d6a90e65051b3cd8fab265293097254", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675323956, "uuid": "ac37582a-127c-4607-b4ee-774a02cdb486", "comment": "Malware payload (RedLineStealer)", "value": "abaef28c022f4bf49486cbab504103d177b7dab3ce1406bbbb9b1eae7a050fe1f12618f656ee01d0892baa3e9b402e4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675323956, "uuid": "6e660f7f-fc81-41c3-ad17-b6ae4a851032", "value": "T15C94C00273D0BC49E5328B729F1EFBE47A2FF9508E5967F61224AA1F15301F2C962725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675323956, "uuid": "ffbdc0d4-f3ce-428e-9ccf-b446b3be9898", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675323956, "uuid": "9303defc-9079-47a1-acbc-94b32ef97da7", "value": "6144:z+Ld6kR9TAN1h/dRX254GnKttJD9dVdrrJCR5ewj9/CJTk637eQfnd5oB:aBR5Azh/TNttRdCRFj9CJb7d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675323956, "uuid": "3dfb9e9b-adac-4138-bb65-dfd69ba27c27", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675323956, "uuid": "2ffa95fc-170b-45d5-9626-44bc85452b18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675323956, "uuid": "72fe9286-35c9-4499-b0ba-015b14ffa252", "value": "6cf2655af693736508e2dae8b2f337c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4101d7-a2d3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675326606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326606, "uuid": "de528842-b0ea-4609-8405-497811e4f3b0", "comment": "Malware payload", "value": "3f908fac6e1662d468bbd728eb591c3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326606, "uuid": "ebf49bcb-99ff-4eeb-b53a-d508253d2027", "comment": "Malware payload", "value": "3bf757f9a576de77ad878001996993e27520a8ac085e72ace6a129020f0630d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326606, "uuid": "44bc2626-6b9b-4878-a0aa-f2c723fc178a", "comment": "Malware payload", "value": "7643f9ed6de57db669cb220431e482e0ff66cb75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326606, "uuid": "c8d25cec-5356-46db-ac66-2dff1eb19823", "comment": "Malware payload", "value": "0e511ff1563bee2234bcebbec07346e98223be1a48857834418bb2a948210e93bd431e94a3cb90d9e715b67068cc4df1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326606, "uuid": "bdc9e2fc-6f76-4255-9d14-87b9ea9efa14", "value": "T1E5739E2239D0C073C497A4705860CB91AEBEB63156A5844B3BAD177E6F303E257BE35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326606, "uuid": "04c67ecb-ebd2-4bc5-9042-dcd9b5756885", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326606, "uuid": "b4feff1e-8738-4bc2-9450-822f918d904e", "value": "1536:xNM+nO4b6g1JGE8ILOMtdgBxliA5f7365RqID:xNMQtR6ILrtqxNeRqID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675326606, "uuid": "e51f1f45-1646-4003-81b6-e008fb554b45", "value": 76744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675326606, "uuid": "b5016a2d-0553-450b-bc1f-b8820590bf20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326606, "uuid": "b8a839d2-dadb-4155-adff-52ec00bf4282", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df99ee4-a328-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675362821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362821, "uuid": "ef5e2873-0cef-4693-b775-c2f4d155f4fa", "comment": "Malware payload", "value": "d1a4dec6641daba2f6422735021a7ae0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362821, "uuid": "884eab3f-a8b6-49ab-a355-42d230bc8f33", "comment": "Malware payload", "value": "3c9f14598d89fe5813cfb226049eca920ce824cc269f3293dce2c625330768fc", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362821, "uuid": "28019c6d-cdfa-4733-b983-7691b337822d", "comment": "Malware payload", "value": "9872a0cbfdb9ca1cb9714695388511a2f9b1b62d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362821, "uuid": "5bdb7e3f-5397-4f8f-bdc6-5b12af60fc02", "comment": "Malware payload", "value": "922742d1d0c8aeed39912bc92ffc4b61932ffc15e754009a831e775773b16406cddf6284f14b781a529e8e65da51c176", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362821, "uuid": "9cb65cb5-5a45-44bc-b897-bad2199904f2", "value": "T10DC59D2275C5C233EA6F4330652ADB7B61F96AE0377380DB63D8962D0E719C05276E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362821, "uuid": "57421893-cdcc-4a71-8729-4b403670756f", "value": "49152:ABWYUMV3eVougT8AFPsJ6ma8zotlmfwrgxMy+y29IAan6DrC4vLNgmUESIEjPMN+:3YUMV39eAlAfwrtyB4veHjPMNaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362821, "uuid": "897a13bc-2a63-463c-b4b6-19f890f02fa6", "value": 2517504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362821, "uuid": "9bad9c62-381b-4b67-8dd5-69315b14ab78", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362821, "uuid": "514e406c-3173-47b7-8462-831dd013c94f", "value": "SecuriteInfo.com.HEUR.Trojan-Downloader.OLE2.Powedon.gen.9287.31400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2056f500-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675337055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337055, "uuid": "81bd728d-de68-4cf6-92d1-93d11e92cb2a", "comment": "Malware payload (LaplasClipper)", "value": "6a94a1e18c7b6a01aaa49dc523f377be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337055, "uuid": "e823d4d5-6981-420b-89ea-e0ecaf16fc44", "comment": "Malware payload (LaplasClipper)", "value": "3d153eec10415da5bd11428eafd70b13b2db77c145b3a98a4d0e1c55a3ec4af6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337055, "uuid": "23962072-b715-4ef1-9ef2-02dc63c513af", "comment": "Malware payload (LaplasClipper)", "value": "734fe1fc1686663374acdfcac3e64a994abf1f24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337055, "uuid": "4ad62e2a-fd44-4811-951e-8c42d6c0fb6b", "comment": "Malware payload (LaplasClipper)", "value": "61ca5f93b7136c6c03dfc3d9c147e14e4c7abdaa0a2d2de7524f485fd7895592bacd4ef66ce1791702b93aff540273ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337055, "uuid": "3f3c388a-db9f-4b2c-b846-e8cd093ba39b", "value": "T12585335575C9C972C9457A770D65E280BDBCDC80A8B889D23F0CABDEAF20DC1776630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337055, "uuid": "83af7c2c-d6e8-40dc-917d-bac537d38d11", "value": "20540b45038474bafe70cf1c181e44fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337055, "uuid": "5599e941-08ca-49a4-9544-31114c877235", "value": "49152:WOtLqPBs0+AiLCNt4yFlSx4KO/9hvruN1fMoq3qAljaz:WrBs0ZNR9hlwN1fMobAljaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337055, "uuid": "92bb5a71-2fd3-44ee-b8ac-99b0cb4fd681", "value": 1828864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337055, "uuid": "85136e9a-a8d7-4cfb-9643-1ffbb0bbc62a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337055, "uuid": "15b8938f-e179-49c6-90cf-6df47b0a6b51", "value": "6a94a1e18c7b6a01aaa49dc523f377be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a2fffe-a2a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Download.Upatre)", "timestamp": 1675307531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307531, "uuid": "d6420556-9f0a-4fc6-bcf2-4a5eee37d0ba", "comment": "Malware payload (Download.Upatre)", "value": "8f84d63772a6cf26c6347dcf84f8152e", "object_relation": "md5", "Tag": [ { "name": "Download.Upatre", "colour": "#491166", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307531, "uuid": "46fb083c-a7ae-42e4-bdb2-d337e5971da8", "comment": "Malware payload (Download.Upatre)", "value": "3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3", "object_relation": "sha256", "Tag": [ { "name": "Download.Upatre", "colour": "#491166", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307531, "uuid": "bd6436f5-97d3-4608-81e1-70e2761dfd97", "comment": "Malware payload (Download.Upatre)", "value": "5fd02e0feca98db01fd4a08dec8706dbf5c48645", "object_relation": "sha1", "Tag": [ { "name": "Download.Upatre", "colour": "#491166", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307531, "uuid": "a6d8fcf2-034a-48a5-8194-862c985745b7", "comment": "Malware payload (Download.Upatre)", "value": "d75154315e98e93a1692aa23d37208e42c9d4e9f8287adc9c6e309853c84bb9314ff831d531b70cce3c3cbfcde80ed3b", "object_relation": "sha3-384", "Tag": [ { "name": "Download.Upatre", "colour": "#491166", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307531, "uuid": "864c12d8-584d-43c3-9fde-1ea381cc3a6e", "value": "T14A83E0786BE91672E3BBDEB5C6F641C2A935B8227C12D80D009A53450833F56EDB1B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307531, "uuid": "76ada4bf-04af-4330-b0f3-dbb6a3aa6109", "value": "9470ea6ce8a031743fbf1e256278f573", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307531, "uuid": "ef8d854a-1177-40a3-ad1c-d6b46696ef6d", "value": "1536:ZzFbxmLPWQMOtEvwDpj386Sj/Rs580gizi:ZVxkGOtEvwDpjc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675307531, "uuid": "d699a00b-6a44-49df-bf63-3132e163300e", "value": 84008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675307531, "uuid": "c5416140-c581-468c-aa04-395a0a5f0920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307531, "uuid": "114f34b0-534e-40c6-9dba-976b64611cde", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b356d4-a32b-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1675364289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675364289, "uuid": "1df8b372-83a5-499a-a1bd-b8cdbdf683a7", "comment": "Malware payload (DarkCloud)", "value": "01b147dd3f43915a4ccea10670b7afc6", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675364289, "uuid": "e6a575e9-d554-41f5-b126-992b1fbdaa6a", "comment": "Malware payload (DarkCloud)", "value": "3db582b8add878e04aff568409b841041e707851251fea25b80016684bbf9905", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675364289, "uuid": "6204568e-eccf-4c05-bfa6-49f1fe486472", "comment": "Malware payload (DarkCloud)", "value": "6a3374b5325284cd932aa78f365d0193392d8485", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675364289, "uuid": "f5ff56da-7298-476f-9c43-067197ad6a14", "comment": "Malware payload (DarkCloud)", "value": "ab9fbbd762bc9fb4291e39683a857c46de77de3a14723e3ae9fcfe142822be3bc400afedff4a9709ca6215e78984f534", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675364289, "uuid": "08245afd-363e-43de-90c4-a8df66630477", "value": "T1A205099876261C6AE95E1D7FC8E32A29413B3EC42D18C81A9F353CDD153EDC49C91ECA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675364289, "uuid": "05e0932f-f5f6-440a-8db3-b2135b98a5d9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675364289, "uuid": "af677cc2-9848-49fd-9342-5d20f010101e", "value": "12288:2YKAF7zXICDW2EisP+qB/K4CANbfsq4G9ASn8USBav1Bt:2Yzz/WOsmWKrQ94QAEnNBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675364289, "uuid": "365311be-d9b1-4398-9dd2-e195556c623e", "value": 850596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675364289, "uuid": "73329fbb-df25-42e4-8924-46c85658cfb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675364289, "uuid": "727c5620-c11b-4302-adb7-ef8df9271e09", "value": "Outstanding Account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed99e84-a34a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675377586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377586, "uuid": "567a1738-bca4-4d45-9ff3-f278a3a69e64", "comment": "Malware payload", "value": "678cae9b8c5f23b4ea65a0af36e3d89e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377586, "uuid": "798bb163-3412-4996-b9cb-306c3bdbd5e5", "comment": "Malware payload", "value": "3db65f2401d10847249995edaf693df422ad82f8f839e7ddb8c29151ddbc1ae4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377586, "uuid": "934c1df2-6ca3-4a22-85eb-1462fdaf2759", "comment": "Malware payload", "value": "829e863e57cbd24e70f5239d9354dfcc470c9dfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377586, "uuid": "a4d6158f-40ff-4749-976e-739f86060b2b", "comment": "Malware payload", "value": "457ea8cb13c514a14e29de135d44cc6c88d3f822e8f5e497233a9164054ab5c9062a2ec865967ed2cde30012f6201c72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377586, "uuid": "12a05fb8-1c64-478a-bbbd-390686727048", "value": "T152940253B6D980B2DDB127B06CFA0BD3063ABCB25D74937B2245986E1CB2680E531777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377586, "uuid": "52e6cc0b-26e4-4d51-a972-a7616a5899f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377586, "uuid": "45272a74-9e84-4d2b-89f7-7dde5069fb3e", "value": "12288:HG76y90KbFhk77bJwu8WviXs6T8MVcwqGSC8s+qZ:/yNbbW7bJ39QgMVYGTlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675377586, "uuid": "2ccc346a-3321-4ace-948e-b3a69c8f5d00", "value": 433664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675377586, "uuid": "77056244-8056-417f-8666-eeed50d60d15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377586, "uuid": "123352c6-39f6-4b3c-b4ee-57dd136ca9f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4370c6bd-a2e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675335826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335826, "uuid": "1bc5b7a5-e74e-48bd-bac7-f04413d75e87", "comment": "Malware payload (Formbook)", "value": "25fed4e9f4d49d3c95d7a19864b7cff8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335826, "uuid": "cd965c9a-372d-4319-a0b7-b69976ae231f", "comment": "Malware payload (Formbook)", "value": "3f9ea29f95fb57c7e1bbc859e2698b9c82c1fc635108128a4da76546899a537b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335826, "uuid": "38f73e07-f1c4-47f0-83c8-87fec0b87bfe", "comment": "Malware payload (Formbook)", "value": "afebb1005a8c45cb3928bbf2b34ac37818546fb7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335826, "uuid": "12e411f3-55e5-469f-aa00-4332e8a38ee7", "comment": "Malware payload (Formbook)", "value": "8e8f47b39222519a094fecb69e5019a6c2ba694781dd531bdf1a312e6e69608a3e814ac97411c18220333ff39ee22efa", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335826, "uuid": "66ce324b-69e5-41c8-8b59-f80b08e237a1", "value": "T192F433C966DB738E35222B5B1B068BB5F209FB4C5D0C146A1CA0FC7A49B87EE4367534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335826, "uuid": "bbd501d5-5d63-4d1d-9e79-dc0fafd5714b", "value": "12288:zkm0C/DRJgsVifW6J49TySygRmcQb2RayX8mNHBXJETgxMpzANSQbHxapBHaG:zNrIe4xqFRmXsnXNBZOwbkppT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675335826, "uuid": "b3df3f49-acb7-45d2-8367-fb27562787e5", "value": 744244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675335826, "uuid": "07fca523-d39e-4577-b4e7-d29a4e3a0289", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335826, "uuid": "7b035b17-4c4e-4f22-a37c-64d35197e1a5", "value": "Payment Notice_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187797c8-a317-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675355510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675355510, "uuid": "3931cade-0f2f-4375-89db-1702cd614d3d", "comment": "Malware payload (Rhadamanthys)", "value": "ecb5a4eb83ceeb92ac361a574c8623b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675355510, "uuid": "b90c9df5-c4fb-42eb-8440-6bc4ed7d91c5", "comment": "Malware payload (Rhadamanthys)", "value": "401835e47946e5eb49f3f24efcef61e9cb3cda00d10e2e584f15a2a81f6a01c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675355510, "uuid": "00e40aa9-7e35-4255-8a19-bb87366e933a", "comment": "Malware payload (Rhadamanthys)", "value": "b8e2d87dcc68add351a2881cc930104af82a6052", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675355510, "uuid": "6cbec594-946e-41e6-a624-048c55aa435d", "comment": "Malware payload (Rhadamanthys)", "value": "5544654b49987a5f1f5e66893ed795445abcf9b2ae67aa866167198235274849c11a56d4b5c7efacd20d86d484125553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675355510, "uuid": "6941676a-b839-4836-9f85-6e5aba187b6e", "value": "T194648E02B2A1BC5BE9318B72DF1FE7E47A1FBD508E1977791318EA1F24711A1C962324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675355510, "uuid": "6c1c411d-d8a9-47f2-af13-6c1edae99fad", "value": "e479a558a3a55c2bde918dd7ce07e020", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675355510, "uuid": "24a2ea3d-d1b3-4d64-bd0c-3fab9d6e6c86", "value": "6144:9bL9vAmn10L8IbKcFQESKVEt9/CJTk637eQfnd58EWB5:9p9CbKcXSKW9CJb7d5r4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675355510, "uuid": "4b9769d8-b36f-43b7-8695-946858d545f2", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675355510, "uuid": "b98d70d2-5c84-4c6a-9b4f-6c981ff261ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675355510, "uuid": "bd2188d5-9712-4935-9a06-e04f65c233d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d671e0f-a327-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1675362471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362471, "uuid": "6d6e3843-95b1-440a-b4af-017180e41cc9", "comment": "Malware payload (IcedID)", "value": "b9bff9e98fd687086b5e1dad7c57ea32", "object_relation": "md5", "Tag": [ { "name": "1398120717", "colour": "#5CB981", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "thunderbird", "colour": "#803C1F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362471, "uuid": "ff995632-433e-403d-a9e3-9041bc58a732", "comment": "Malware payload (IcedID)", "value": "40bbcb27f601b5500428fa56d0c24617171706ed69c9e1ee205150a1e22f5321", "object_relation": "sha256", "Tag": [ { "name": "1398120717", "colour": "#5CB981", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "thunderbird", "colour": "#803C1F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362471, "uuid": "95b86e78-b8f1-46c8-a068-832eebb10e01", "comment": "Malware payload (IcedID)", "value": "47d9944f06ced9d376de8fdaa1417cd7211c74ba", "object_relation": "sha1", "Tag": [ { "name": "1398120717", "colour": "#5CB981", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "thunderbird", "colour": "#803C1F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362471, "uuid": "915d24c6-b25f-4d70-9936-80c079e0e063", "comment": "Malware payload (IcedID)", "value": "a29f7aac862cbd2dd4d4a0f4e87869e36158550273ff92492438afa094591a591810ac29dfe6355504e316e90b186762", "object_relation": "sha3-384", "Tag": [ { "name": "1398120717", "colour": "#5CB981", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "thunderbird", "colour": "#803C1F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362471, "uuid": "5829542c-1f66-4eaf-a916-f2f08fb160fa", "value": "T12205023BE5453472E746C27C28AC1B9D11A21D0162EF1AEE9936984F3CE1E377670C13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362471, "uuid": "5a7dc879-b780-4633-8c91-a8c69608bd1d", "value": "3072:WpxR7Q7+O709OQv6pMz/BPnP6tINspRmIo:WpxC097z/BPnCtispRmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362471, "uuid": "da8b9d95-34ca-4880-9580-148221058f48", "value": 844871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362471, "uuid": "b79c1b64-8ce6-4813-a39d-218107367760", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362471, "uuid": "2f095b4f-d678-49c9-9ab4-22bb3c4c76e1", "value": "Setup_Win_02-02-2023_18-14-35.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701a9b71-a29d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675303259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303259, "uuid": "62a87e8d-a42e-4ffa-a4b7-414a91c2c39b", "comment": "Malware payload (RedLineStealer)", "value": "acd00db054e2deabe863f5ff254f37a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303259, "uuid": "22438ba6-caff-4a7c-8966-704230ffb360", "comment": "Malware payload (RedLineStealer)", "value": "41623c9b63ca0b19c4eb6716f6995cbb7294d2c426435080415c65b5bf617236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303259, "uuid": "5084688b-0a13-4ed0-81a6-35c382fc8e2a", "comment": "Malware payload (RedLineStealer)", "value": "2c6220a232354ede2e767ab5a45275eaff2a34eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303259, "uuid": "10240ae3-4d0f-4783-80b0-da307b60e61e", "comment": "Malware payload (RedLineStealer)", "value": "fb67a748fec7115c0e0803359c0e81f9dceb5a72736aa4b18acd9ee268b21deb115af0cf10af2a4bdf43c24dd35f409d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303259, "uuid": "4eb380b5-dcb5-4eb1-8c67-f33df19b64c7", "value": "T1CF74013276E0D073C5A654341D20DB95ABAEB4315979BA4B3B6817BD9F302D0B73A30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303259, "uuid": "84627a78-40f4-44f6-9d9c-3eeffad7a52a", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303259, "uuid": "18deb76e-de6e-4e78-a7e1-7810c58c7e0f", "value": "6144:qpGao1LPccXkhXZIb4e49BhRWnSzZMn886bwOWtf50Vk8068:qpB87ccXUIbV4/hBlr86EOiuVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675303259, "uuid": "9ad8df14-eba9-49d2-b4a6-3b6c5bfe477d", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675303259, "uuid": "343f949e-a9b1-45c4-93d9-da4b2c49bf16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303259, "uuid": "1359d8c4-8e19-4e7b-89e0-ba9e9a3a5cb7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f25df85-a327-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675362608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362608, "uuid": "1b4ed862-7ff0-477b-9f43-30d1ef80f9c2", "comment": "Malware payload (RedLineStealer)", "value": "98a927034d9dd9074d8a4360a3875d59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362608, "uuid": "8d279566-3924-4b90-a4c6-a6265dc39be9", "comment": "Malware payload (RedLineStealer)", "value": "41680ceb22bddc68adf2ee8f21718af8f06edb778a2fe454f376be13f41ab4bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362608, "uuid": "d4a16053-5b05-4a9f-85d1-4458089f7c3b", "comment": "Malware payload (RedLineStealer)", "value": "2166255dafc666dc2c39ae6d5b67a558c13a73f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362608, "uuid": "ba612c0d-29e4-4e6e-8f0b-ac479e5b0c0a", "comment": "Malware payload (RedLineStealer)", "value": "c17628677a95f92c949c8c1133962f790b6156dbf101831812081ab148c5a4f09a5f67976e9fcde0cf95a7ba5b364fac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362608, "uuid": "7cac902c-4a0f-4471-8d60-1def94946c81", "value": "T1E0740B887670FD9EC867C47F8A681C24E6636466570BA203B05317ED993D79AFE070B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362608, "uuid": "5fd3d5fb-2b01-4b46-8a60-505c07ca2549", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362608, "uuid": "0a9eeebc-9511-48a5-873c-51e19f57a4d8", "value": "6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362608, "uuid": "bbc8d16d-1af9-486b-83f9-ac93bb5714ad", "value": 345688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362608, "uuid": "4fa54d20-e6fa-47fe-ae9a-ac478491aabc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362608, "uuid": "b7c0e2ad-283a-49b1-bd64-50349d31ca7f", "value": "98a927034d9dd9074d8a4360a3875d59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3870880e-a349-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1675377039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377039, "uuid": "71baf563-1f26-45de-aec9-f0a8ebb27c08", "comment": "Malware payload (QuasarRAT)", "value": "aa14bc7fe4a9e56d75945dee38c3cf77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377039, "uuid": "08cc8a6d-53a6-4cd5-ac70-52c7a14894d6", "comment": "Malware payload (QuasarRAT)", "value": "427decd0986270b1f3459b61c38d3abcbd68d3a1fb08ea39a9b681bb26ec1449", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377039, "uuid": "3f51f29a-856e-4b09-b739-61d56b46e071", "comment": "Malware payload (QuasarRAT)", "value": "e86fee3cf8dec6a93ce0683f62f2601f23ce2ce6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377039, "uuid": "7d2b6433-4bc9-4395-b2cd-08cb84852e92", "comment": "Malware payload (QuasarRAT)", "value": "eab6055f02226e0f10e02b1b2b2b11d8670b0a7b24f6828cb9e608248c657c8c3bb90c2d33096c66bff5a3f735454419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377039, "uuid": "ea641f61-50f3-46ed-aa50-1dcfc181ab56", "value": "T1BCB46C4027F8852BE1AE57BAE871042097F5F807B66BEF4F4A40A2F93D667069D40773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377039, "uuid": "dd121ec3-5e0f-4eab-9344-29e99073cc21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377039, "uuid": "fb167e82-3104-491e-8f9b-725c5789f4c8", "value": "6144:dTEgdc0YpXAGbgiIN2RSBTFwfEJGpRgbujeq5clcEqOb8F5egAM0+cTR3+:dTEgdfYlbgUR1u6pJAz+cd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675377039, "uuid": "1221f782-b2eb-4340-be02-cc3b267cbca7", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675377039, "uuid": "05fd95d9-6428-4be7-a7c7-5b415d9255dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377039, "uuid": "28ad9023-87c4-4580-9780-15a9efebde5d", "value": "aa14bc7fe4a9e56d75945dee38c3cf77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc5289a-a2fe-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675344859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344859, "uuid": "dac614a5-665a-4162-892c-7f7b91c48334", "comment": "Malware payload (SnakeKeylogger)", "value": "abd5d4f26361fb7282be7236e670b9ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344859, "uuid": "83c13cf6-200a-4b36-bd14-5c941ecb2cde", "comment": "Malware payload (SnakeKeylogger)", "value": "428463a16424f99ba21f0eee386e75a1567a2db7b393bf131e04e782899feb20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344859, "uuid": "9925a1db-e266-4815-af42-dc72e6dbc047", "comment": "Malware payload (SnakeKeylogger)", "value": "f8474ed93ba265268177ab10eadb237befaf174b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344859, "uuid": "24273055-cbe6-4984-93f4-741cd33b76f5", "comment": "Malware payload (SnakeKeylogger)", "value": "65a024ffed8a4c75c4946ec69cd3a68739c23c4e25c835e210960c701c96011a6825a233e72212a00264740fc3dc3cfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344859, "uuid": "1a31ca8f-ab1a-4070-a93d-35b857b70cfd", "value": "T15A058D8737B1A8BFF697407154283F886FA07403BE46D253A7373A949B098FBB798151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344859, "uuid": "846ef29d-37e8-4753-b1b5-7d652cf608df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344859, "uuid": "d5b928c6-3193-47b6-bdbc-4b01bd804e55", "value": "12288:o57mb6Fy2Mxzo3ZvOFuZfZFdk0XPzNbd+bAHM7Tq8JhTqG4yPaX4UOzU4QCk:o5c6F0xMZPZxNJQKqGyTqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675344859, "uuid": "8caec1e5-6703-4c50-9390-41eb5135c9dc", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675344859, "uuid": "7367002f-7459-4b28-8f8c-072ca7866fc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344859, "uuid": "c64abbc0-66fe-4cb3-92b4-ed935635a94f", "value": "transferir factura 1003045556.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae9a29c-a334-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675368050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675368050, "uuid": "240707a5-2bbd-485d-a9a4-2be61ebaaa06", "comment": "Malware payload", "value": "d39cd68f7a07820a8d717669b807f9f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675368050, "uuid": "7574cca9-3e99-4b3a-8f2f-64e86be59c00", "comment": "Malware payload", "value": "42f0b022f20356e8eaa48856c2734df304b1d5b73ad75432bc2f0746f8f32403", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675368050, "uuid": "e6103dc0-f7bf-4476-b5d7-c414c9027f7c", "comment": "Malware payload", "value": "8208da9f93d1a6682cd2fe007bd2e4fbc9896fc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675368050, "uuid": "12f4d8ac-65c4-4ccd-8f6a-ed6e6cbd8c84", "comment": "Malware payload", "value": "fa46162f8dbfb02bfe999a94dd8cf69e525db854d9c22d196382fc6d833c2c4d31e39a850a431169ba724a329da50a92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675368050, "uuid": "b1c5a74c-784b-4797-a43c-0e61c41cd198", "value": "T1A3A5330FA163C9B7D10266FA79618213D3B06B7535BE1221334DB3AB4F7B6C0619D2E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675368050, "uuid": "c6b5a70e-3b81-4d14-8e89-6b91fd8425c1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675368050, "uuid": "79bad12c-a121-4fb6-81c5-c4562b0ab953", "value": "49152:bghMCW8ui0RxSD39nhBtfw3Q+geo5w7ugJe55eR+3LCgv2MR:cWCMi0Rxo39nJfw3Co055pv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675368050, "uuid": "e40fa141-99bc-4d03-b94d-dfd6ef5b2e50", "value": 2082305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675368050, "uuid": "63be4d3b-81f0-4c2c-9902-5eb192b84245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675368050, "uuid": "52511740-9132-47a8-8d45-cd4814e63cd4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8acdc1a-a33e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675372583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675372583, "uuid": "275e73c8-da5f-46f1-ab2b-0ff0d0d4197f", "comment": "Malware payload", "value": "5d4eabc74e9164d5eedf788f55bf61cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675372583, "uuid": "064fcac7-66f2-4b7e-ad21-b89dc0cdd790", "comment": "Malware payload", "value": "439ccd94d3a218b5243fc7f212ab5378a0ec4e8fe62be9d6c7907cc478fe0c46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675372583, "uuid": "b142e837-4af8-43c7-b581-2158d2486c70", "comment": "Malware payload", "value": "9dcfe26000dd4c77d13b949b9a65523e834abf4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675372583, "uuid": "cf2bc952-bcd7-4187-89f2-e4f1ac5f3008", "comment": "Malware payload", "value": "a8f9647aea803d2f2590340494ad0ca271928e12f3550e8420c5da53a030ae134bee3f7c4edda1aab6447a7c37ef6e13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675372583, "uuid": "2febd644-0211-48d8-b166-15613ee0eaf3", "value": "T1B3A533069020CEB0D3009D796A7995616C92FF7EFAB0311BA25DB18E9F33296D47D327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675372583, "uuid": "0879e536-2d93-4870-981e-1a6c1751a067", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675372583, "uuid": "b5b9a090-a7f8-4958-a35c-732ddf2f4997", "value": "49152:bgsT/6tQ5xBGKu6qpK87ouf7Z+V8oAzocLCgv2MR:c46tQ8t6qpqctbb7v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675372583, "uuid": "ff4421ea-ea92-4a6b-9e85-d64db1b90111", "value": 2082677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675372583, "uuid": "106a9549-e310-41c5-9593-a6fed6a45ba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675372583, "uuid": "ce51a0eb-3011-4f43-af66-82379bea5ec4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93d9992-a30a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Dharma)", "timestamp": 1675350223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350223, "uuid": "8ac77652-ac7f-43f0-aa00-db5633767693", "comment": "Malware payload (Dharma)", "value": "d1b58a99f2d7875883e381f83d5ef31b", "object_relation": "md5", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350223, "uuid": "ff33eee3-68d5-491e-bac4-32cd4b5f5ff9", "comment": "Malware payload (Dharma)", "value": "43a13198d94f649ee5c587b4d5eb59b33abd89fae6e49909f8b1052059025cbc", "object_relation": "sha256", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350223, "uuid": "9c4d3fc1-5d27-4721-a467-2f3df74c2859", "comment": "Malware payload (Dharma)", "value": "bbbb3d9d08005fcdb86a0ce73dc209c5af897cf4", "object_relation": "sha1", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350223, "uuid": "eb82e033-956d-44df-8235-ba23a761e40d", "comment": "Malware payload (Dharma)", "value": "0ee4e97eeb6c49408f571c125c2610616bd26ff4af2763f024417293f230720f1b2e84dee067f7a285aafe265bfea6ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350223, "uuid": "0dfcc4b0-dfe0-41c2-80f2-70622e07f5cc", "value": "T18B939C28D531C135F8A250FFCBF696FDAE644B202307A0D797C01D8977869E6F932626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350223, "uuid": "135809d4-323a-4c9b-ae75-0051e2f0e268", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350223, "uuid": "8461ec24-d29c-405d-97f0-c5b283bd2b94", "value": "1536:tBwl+KXpsqN5vlwWYyhY9S4AnGqLCr6ISTyJxUfjfKUSQG4Kv/:Hw+asqN5aW/hLErPSTyXufUF4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675350223, "uuid": "2f6ff728-fb22-4ac4-a3b8-bd31d99d2214", "value": 94724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675350223, "uuid": "cfc6bf43-e4de-4466-9d34-2b0eddde0da5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350223, "uuid": "42964f09-9ee2-4a07-a1ea-a842f534e543", "value": "2023-02-01_d1b58a99f2d7875883e381f83d5ef31b_crysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fec712a-a304-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675347497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347497, "uuid": "73cc54de-67a1-4495-883c-ac9cb4dfc95e", "comment": "Malware payload (SnakeKeylogger)", "value": "1505f7df9f58d4794b254887742340ad", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347497, "uuid": "e4d52801-d399-4e29-ab88-86456f6a1e0f", "comment": "Malware payload (SnakeKeylogger)", "value": "43bb28994e5079313633f892809a35ecd10770073a78cd3a6b028dd5ef42edd4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347497, "uuid": "af488b54-b469-4e8d-8c19-8882465db7ad", "comment": "Malware payload (SnakeKeylogger)", "value": "9ef1ac90b7f0f83c0e13829ecb8ddca13f7cb2e8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347497, "uuid": "85c750e4-bb0c-405a-b2a3-0c963a935330", "comment": "Malware payload (SnakeKeylogger)", "value": "aa68357f4325d79cb5dfddff22cfb6b4676a9bf31d207aed1cc4b896ea01b41896481e3627a1c80a0c1abb97de6477d8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347497, "uuid": "fe4000f7-f7cb-4a05-8b0f-363ad0df3efc", "value": "T1AFF24C1AE79F0264CF511277271A0A899ABDB33EB35051B1346C937433EDC3E46A66BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347497, "uuid": "531567bc-e7c2-466d-bd72-5a2c120c4d11", "value": "768:hFx0XaIsnPRIa4fwJMEyMT7cTT7RONigCGdwjy8:hf0Xvx3EMEFTYDvgCGdwW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675347497, "uuid": "00947f71-beb5-4403-ab6f-1c4d2e68ca81", "value": 36943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675347497, "uuid": "a087a8c9-da69-4b16-befe-fbd3d3c29785", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347497, "uuid": "d67829d9-31fd-43a0-b561-0409adc2d5aa", "value": "outstanding payment.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617eb372-a30a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675350049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350049, "uuid": "b318976b-63ae-466e-b4af-b2f5f0b6d271", "comment": "Malware payload (GCleaner)", "value": "ccde7e3f4465b0eaa5c94299bfcff185", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350049, "uuid": "fc3011d9-faee-4645-a795-c198d85ad81f", "comment": "Malware payload (GCleaner)", "value": "43cc7b2bc49522fb5f71c9a058fec5fa30b168ea5aef3c2075a9591202344e26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350049, "uuid": "ab4770c6-6189-42ef-9bd6-e54aaa4e9c59", "comment": "Malware payload (GCleaner)", "value": "0ae794c78e080088647cb3875f7d6b08775c70a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350049, "uuid": "500db260-84fd-42e0-9813-656c5a6adca6", "comment": "Malware payload (GCleaner)", "value": "097335f0e4b1115a86e5ac57e1c0a252904f1dea5f6264f0408a9d94dd964b5a61e77204d7d84d6ec9f0c974da0a7b73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350049, "uuid": "08126372-bce8-4bff-a08e-3a70c52bf5f5", "value": "T19FA5333623309471C093E73D062CC446F7AB6FA966E85E243A6E3A0F2E7F613955D316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350049, "uuid": "2747053b-74b7-4d04-a7d3-31856149bc2f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350049, "uuid": "a1bef695-e5f1-4ed9-9a58-2a060107d1fc", "value": "49152:bgSgjUXaAYbVVdRK7mEOY4zaBxuoxW85qlr0vs8RolGULCgv2MR:cljUqDbBJaBYoxW8glrcs0o9v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675350049, "uuid": "4ee2f663-32ac-47ba-9577-39275e41ec6a", "value": 2118546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675350049, "uuid": "c71e63bc-b087-4cb1-8507-ad73ce3fea43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350049, "uuid": "d32099ec-fd9c-458c-8d3b-618c39c54c94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915ec507-a303-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675347123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347123, "uuid": "010f5876-982a-4653-9b03-6aab37d4c1e4", "comment": "Malware payload (AgentTesla)", "value": "cb2239fad395389aacf758802b8a1d9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347123, "uuid": "3cdbc634-82ab-4603-a8a0-afb320e5c442", "comment": "Malware payload (AgentTesla)", "value": "440427e624862bf42bf5c0446da24a9fed2f8da6417270d105f02d72e3cb1abe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347123, "uuid": "0dcca3c0-5e7f-4585-aabe-1912830f5158", "comment": "Malware payload (AgentTesla)", "value": "01c0aae9e81bddc30e8bde08d64c4b0de8c13a10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347123, "uuid": "0edf74c6-dafe-4a6e-ad12-8fc87ecb981c", "comment": "Malware payload (AgentTesla)", "value": "515ec25dc25ba005f7575de4aafce9aa95d9d9a6f5c5e5e501517150900df6c3d4757087c5f475abcd32890e191abedf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347123, "uuid": "ed5924e0-1f66-492e-8230-665068e54db6", "value": "T1BE05173D297717D6C339F93186D18420B6EEA1823713F96AEDE61AC14F02682BDCE51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347123, "uuid": "e73a0e52-ade5-419a-9fd5-09bdaa49cbde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347123, "uuid": "ff6e772a-d547-45a6-8669-ca83dab7d7b7", "value": "24576:Er/jseHKNTn7tunA+/kSLgMfmBm8zUxGSdId9dXpaEuQUMk:oOXfd96QU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675347123, "uuid": "2cb6d41c-2c00-4d23-bbc2-f6b26436e8e1", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675347123, "uuid": "2aa3c960-485e-4abc-a154-36c2149f8330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347123, "uuid": "581048c6-d21f-432d-b777-bf1854dfc34d", "value": "statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4958024a-a2f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675340130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340130, "uuid": "1e37491c-8bf5-4d79-b540-3196b0a2dea6", "comment": "Malware payload (Formbook)", "value": "6494ab6f47d58bffd00600fc34cba856", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340130, "uuid": "d3e52015-3958-4b49-b3de-2a6125c4e796", "comment": "Malware payload (Formbook)", "value": "4436a15a442d5e5a2839124743cd91974230a8ce3fc55ebaa00ff66b8370493e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340130, "uuid": "565819bc-96a2-44b8-9f20-f6432f9ccc5b", "comment": "Malware payload (Formbook)", "value": "1a70cd45ca69a513194719b3ee7117f4046b5fac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340130, "uuid": "d86fc710-8e82-4fae-974e-8e9e1db29a99", "comment": "Malware payload (Formbook)", "value": "57fe13158460e1ee77637939decce9f9e9ad6cd9f0eff4690dc679e4bdc689bf6fe7a78799d89374ffdf8a793512a654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340130, "uuid": "52bb1657-6fc0-48e3-b884-bc2ca2bb347c", "value": "T1E0F49D8377B1A872F6CB10A5142837CD2FE0B103BE95E257AB7B79C0A7059FB7698141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340130, "uuid": "a2ea600c-f9b9-4873-be2c-d2f5c3e7439b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340130, "uuid": "f05824da-ece0-4f87-8370-beb61c6b1029", "value": "12288:2tz8L6gu+xMRSR5S/vOT9UbC1AU/4JgBwpVrk4cqEaB640iOM7P3qG4yPa:/LzyRU5kWhUbC3AJgSpqHalFzrqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675340130, "uuid": "aa51b332-16be-4581-ad6c-2b1a3de1e1f5", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675340130, "uuid": "10c999ff-ae9a-483a-b41b-e6e7aa6506ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340130, "uuid": "37456958-5b88-4ebf-8be5-fa938d5f4b4f", "value": "6494ab6f47d58bffd00600fc34cba856.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9428ca-a342-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675374313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675374313, "uuid": "bec64043-16fc-467f-a33d-2677340cb99f", "comment": "Malware payload", "value": "d68328652ca865ec070f70672df3f993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675374313, "uuid": "fb6cbff8-6b5e-486c-bd09-bb1a4e42c9e7", "comment": "Malware payload", "value": "45b80b5e7c9921deb37af2950b6204aa4c90e0c268a4481b3b8a19236550ae38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675374313, "uuid": "49cbaeb1-c617-46d9-8279-df77bf4c106d", "comment": "Malware payload", "value": "1e82dde99bfd3fb2f546016d98b1e221eb8694f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675374313, "uuid": "f9fa480d-1074-41a7-ae21-4878e35fd1c3", "comment": "Malware payload", "value": "cd0b35d50144aff7f2c7f24edf1369e2b3a1cefa065e9dcccc36c3cb8fb49d5bc0977bd8862e98662c24a0366269de46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675374313, "uuid": "00e45140-ea22-4303-9926-abbdd2bc46a9", "value": "T193A53341D264857BC645E170AE36D3526E55BF32391A018972AFFB8C1F6F2C8386A373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675374313, "uuid": "ec5f68a7-9086-4965-a485-965a30c04161", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675374313, "uuid": "a3fb38cc-a7fb-4115-847d-db2c1ecd1219", "value": "49152:bglVPq/xJ7azefY98jLuvT1Bjh565N7igz9EtqLCgv2MR:clVPEuzkBLuvT1eN7p2gv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675374313, "uuid": "9e5c5074-1a2f-4e26-9b35-d8d1dd624735", "value": 2084148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675374313, "uuid": "1c9296aa-ee47-438b-8326-fc4b2e0959f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675374313, "uuid": "36f7e9f9-a889-4dd4-9fda-5365cae9cd8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a3d2e3-a2d6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675327905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675327905, "uuid": "4eaa844b-b74e-4a80-8945-e4280aba8b21", "comment": "Malware payload", "value": "b63219155f8beb78548fa214f483328e", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675327905, "uuid": "7deb23ac-3b7b-42ec-9bf1-747d2acee989", "comment": "Malware payload", "value": "45cd8b42e25e4ec09e31f2ee77d825657bb61cc1f279620f6514105c6eb93216", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675327905, "uuid": "2dcb8afe-233a-488f-9338-969c49b3b1fa", "comment": "Malware payload", "value": "220ce68cc8dad838ecabc3cb9b7ec1c016a8d200", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675327905, "uuid": "bb6a7fb9-2c0a-4ea5-a757-5f8c3d80c9f1", "comment": "Malware payload", "value": "d6d896a77eba3cf7d7d2f90d3b6dacb7356b041869f929145c5a6997152193514ea7ec2bbd46c3db2c8a93fcd62a7225", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675327905, "uuid": "64b80602-5358-4519-8b97-a7b5ece443f9", "value": "T1A63422A61D95F54AC068C28E72B27E69FAE19148D93E03C53EF35960DD2FFE40A31648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675327905, "uuid": "f22e3ef2-4dea-4a60-baf5-5a1780b053fa", "value": "3072:2BD8MYDqTrkFA904WGQQjbXuIEs+cZtj/TPl8360MFYM9hnu1K6Dm0+1hOX/BxPU:YZTIFw04WyF/bcqv6b9vmZB0cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675327905, "uuid": "43d395fe-2938-4805-923a-08034c2c9494", "value": 234488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675327905, "uuid": "1910711d-a72c-40ec-b0b4-cff94d1a055d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675327905, "uuid": "1fb37af4-f6b1-469d-ab31-d2a39e63a676", "value": "FNX Proforma-Rechnungsnummer INV 20220912781936 SOA-Ref 202231121937.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3798091b-a314-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675354274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354274, "uuid": "8a351db6-4310-440c-9d1d-c556a7de87c8", "comment": "Malware payload", "value": "8dda07df050a4ec819166e017f89531d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354274, "uuid": "0fbef9c4-d780-48e9-abf5-3cf53b2407a1", "comment": "Malware payload", "value": "46790cddcb4afe5315d60e343cf02917fec3466ad902302d03fb0876bf12d313", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354274, "uuid": "4c0be56a-b9db-4325-aba4-1c91a6c0d586", "comment": "Malware payload", "value": "1e77cc63ce92671ae88914fdd9913b4b783c60af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354274, "uuid": "5c3f0185-0cff-4c4e-bea0-00148bc605f3", "comment": "Malware payload", "value": "13f945977354139a9aa6a544ed3226a69933d2fffb4fd14e430f415d62ee130715177ddbc92781c724364236c7055c18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354274, "uuid": "f5822238-762e-4fca-86fe-f6cf92f930e4", "value": "T1827633503CE5C536E4122E3144A0672A97B6DF017F232C0F17E92C6E1B7E56BC626EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354274, "uuid": "114244e9-d605-46ae-9a90-2701d97c3976", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354274, "uuid": "51aea302-2a54-4e39-af2f-82ca0044ff15", "value": "196608:91OFZEjQWk8PRLhfoBSM0RTb1cB8OJqi+DKUKhQKdwM:3OFZEldv55K8OJz+cZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675354274, "uuid": "6ced6ef1-8581-494e-9867-bdcdb2de3a5e", "value": 7606307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675354274, "uuid": "e2da2b1b-c1e1-4f65-bf08-df2535892722", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354274, "uuid": "be55a7c5-b702-4cd7-9634-5c515314ab74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81dd58b4-a2cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675324763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324763, "uuid": "5f5e2ba3-b326-4dcf-9e86-ea0bd4b0d5eb", "comment": "Malware payload (Formbook)", "value": "f08d84c21d7b2896f659a6c02c990d0c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324763, "uuid": "ff514941-4eb4-430b-b358-93e6660764f5", "comment": "Malware payload (Formbook)", "value": "476162f290b9083afe5598823bbbc42a4cf616c5f35cba8a7abb60e695be6000", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324763, "uuid": "302075ac-fef7-4d52-abea-58a0998f79a5", "comment": "Malware payload (Formbook)", "value": "94734ecce4fb97e043b8b0837991f163af9182fd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324763, "uuid": "c3d72f9e-d826-46fc-9edb-3008572c959b", "comment": "Malware payload (Formbook)", "value": "74c86a3eb058aa776089a558f509c8b338299740c578f69974b7d572413569d663677c7c97c26b897c13262a726ba9d9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324763, "uuid": "23a9da62-34ea-4ca1-b793-af74a6f35016", "value": "T1E1D423A42A5BB29383BDCC75B5F875B576DEC7AC4ED23308AEB434DF912B0196032125", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324763, "uuid": "6aa3fff9-5b12-4e16-bed4-aa5394f62892", "value": "12288:+twEthNNIRla3oZTmuxvPX/ae6No93T7qi/odhe+CRhU4X8S5YqfuLoLHdXHE:+t5hbIwQmulONm/qzh5uhfX8S5YKuLoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675324763, "uuid": "61fb6ab8-e4af-45b6-bedf-5c4e0cfaf86c", "value": 655712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675324763, "uuid": "de9dc084-d721-40b6-aaf3-d575e144763e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324763, "uuid": "aca5587e-df22-416f-97f3-babd0b14f3d7", "value": "Payment Notice_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c46aec-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675337111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337111, "uuid": "1ae7e122-de4c-451d-8b9e-f3560ec7b78b", "comment": "Malware payload (Quakbot)", "value": "37cf85f38d5c5c817427913187c22951", "object_relation": "md5", "Tag": [ { "name": "1675326103", "colour": "#11EC06", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337111, "uuid": "a70e6816-4cff-4922-acc5-2205d7d32014", "comment": "Malware payload (Quakbot)", "value": "487e5603c3fe87ff4e63372a03fe3515f3262ca7a996a5ca2f6840a43dfcced2", "object_relation": "sha256", "Tag": [ { "name": "1675326103", "colour": "#11EC06", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337111, "uuid": "f406cd02-2ee9-4bc3-8868-445aa180e34f", "comment": "Malware payload (Quakbot)", "value": "94934efcc613de0f2f1cc863a14d2b1b1c0216d4", "object_relation": "sha1", "Tag": [ { "name": "1675326103", "colour": "#11EC06", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337111, "uuid": "73a6fa8a-fddb-4ff2-a1fb-f7201f44d050", "comment": "Malware payload (Quakbot)", "value": "1b4ea437a2971fdfcf569ae5de6fad001baacd4d7f0a9353d73dc3a42b297a25edf5590d8f9095f4570e069a5ab62a69", "object_relation": "sha3-384", "Tag": [ { "name": "1675326103", "colour": "#11EC06", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337111, "uuid": "6f92b1b6-dfe9-4b8a-a931-e84ac8cb043d", "value": "T197630287BF1AD62236B3307D691C276BAC3404B3F174685198BB1DBE8F2739A6934506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337111, "uuid": "c09cac81-5594-46f4-9037-55a545d3cac2", "value": "1536:Iy9jzhSZVfBWQdCj/UeG0wc4K0ouvkB53DHIjqKPYCl8fpO:j9fOVfBWQdmUeG33oX9cjqKFCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337111, "uuid": "639bc063-18fd-4f5c-89df-2c460151f979", "value": 69016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337111, "uuid": "e35b3505-4631-4d56-9e98-5f658cb29f45", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337111, "uuid": "c06ba849-b961-4a7c-a6d0-44e948dd7367", "value": "131499.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c771731-a302-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675346471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346471, "uuid": "3a38263f-c85b-4481-8cdc-f0b378fb9286", "comment": "Malware payload (Smoke Loader)", "value": "3e85cd1b5052309bdc599c2207b56c1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346471, "uuid": "ba229c5e-04bc-4bab-881d-55b84e42ddaf", "comment": "Malware payload (Smoke Loader)", "value": "48dab342b23564c0af6d9d43a7c37e5683d2caa7d12ec5996e5d08ec61103d8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346471, "uuid": "d2cacbc0-9417-4713-b4e8-c6cec3a10007", "comment": "Malware payload (Smoke Loader)", "value": "b49dbb3ba7b34ac4b64aeebdf2d186465991b304", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346471, "uuid": "9f70f03c-2112-47be-925a-8a8863633979", "comment": "Malware payload (Smoke Loader)", "value": "74c125fe73dc2328dcfaed181c8a0c489f08d7ceaf515230f3a7feef4a430adca9b84e8e09da6f9d8e618fc6c02deb21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346471, "uuid": "04b57de7-a043-409a-979c-31b115344294", "value": "T167648D42B2A0BC48D5358B729F1FE7E47A1FBD508E5837BA1324AA1F14711A1DA6373C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346471, "uuid": "d06a991f-6d50-407e-adad-7ac4193c700b", "value": "d9bb3534629ee1e0adad5f89cd30d412", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346471, "uuid": "2c16a35b-f29d-4ff4-8b79-3874bf462bda", "value": "6144:qFwLDubhARRrszR0QVkK9/CJTk637eQfnd5BoBD:BHLjs1VVkK9CJb7d5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675346471, "uuid": "2108a865-9c14-4ace-8f7b-a1d33966f6cc", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675346471, "uuid": "0a7a6aa5-eb5b-4635-a727-3da865a2c9d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346471, "uuid": "c2fc0e1f-dd0b-4268-9125-d888c0b8a346", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484761b2-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675337122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337122, "uuid": "cc8bd27b-a050-40e9-b0b8-70e69960f4cf", "comment": "Malware payload (Quakbot)", "value": "0f32f9e91b2a0c7584b863e6caee9bdf", "object_relation": "md5", "Tag": [ { "name": "1675326103", "colour": "#11EC06", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337122, "uuid": "b26ee849-eccb-459d-93bf-ae6b4f5fa280", "comment": "Malware payload (Quakbot)", "value": "495e5b52716772099ac02c9476feabdd7d51856951d5e61f381c7016f90bb247", "object_relation": "sha256", "Tag": [ { "name": "1675326103", "colour": "#11EC06", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337122, "uuid": "b2aa11a1-be81-485c-ab1a-27ca2f625a50", "comment": "Malware payload (Quakbot)", "value": "2a3440f356388ef616f005b8f53b09b07d59063b", "object_relation": "sha1", "Tag": [ { "name": "1675326103", "colour": "#11EC06", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337122, "uuid": "feb8cdfa-9f6d-4e59-9c47-f53751b5d1d3", "comment": "Malware payload (Quakbot)", "value": "ae4e54a8c44137eca9a9db4aab9b3bbf21c699fc98e411a764c7f7a38ba498bcb26a02788371b53ef0afc688aa6060fc", "object_relation": "sha3-384", "Tag": [ { "name": "1675326103", "colour": "#11EC06", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337122, "uuid": "ae51f017-fcad-47f6-bed7-db728f592e68", "value": "T110E3F0413BE4D785F7700A7A9ADB3F4A2A32FF622E1A1B1F6664221D8C353D4D90460F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337122, "uuid": "08f04c27-ca47-41de-ae19-5e67d51efd02", "value": "1536:1gCflBiZVfBWQdCj/UeG0wc4K0oEkI4KrJFxeUHuUcH3:1xbAVfBWQdmUeG33oEkIrrJFxeauUcH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337122, "uuid": "68c1a0f6-6de2-485b-bc03-46370c207fd7", "value": 145576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337122, "uuid": "bc5312ef-f2fc-40dc-acc7-7ac46f9eb93f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337122, "uuid": "c41a4bc0-55fa-4ac3-b5c0-ba8deaf20def", "value": "131499.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9481d9-a2f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675340267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340267, "uuid": "88388ffa-736e-4ecb-b32d-e77e1368ecb6", "comment": "Malware payload (AgentTesla)", "value": "9bc7cd8b579d167e51925bae221bfa4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340267, "uuid": "f599c6bc-bb2d-4de8-aa17-4bad56e7b9d0", "comment": "Malware payload (AgentTesla)", "value": "49b1485a18abaa51fdd9cf54e48226c14aca6dc15947784e919efe522144e5cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340267, "uuid": "65e8a8a1-863d-4733-834f-abd241d945a0", "comment": "Malware payload (AgentTesla)", "value": "4544aa108e89d7c04418d88a4c7125a146c69ab6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340267, "uuid": "443e23b3-5ea8-42d4-b1de-1348dcd1264f", "comment": "Malware payload (AgentTesla)", "value": "268cfb59466dc3647b0ab58b35d7193862441ae0401b7490e5698121c2f5f660511da4ad786c8c844329b4c11c5b0560", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340267, "uuid": "e4b95028-7a93-4714-9a99-4869ad4a3621", "value": "T119032B583B9C9723EFEF577CA8E461834BB1A937A601E70D2ECCA4E915C23C64650727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340267, "uuid": "4bad8245-2273-4831-b10e-2532bb38e42f", "value": "384:+OhNuCCfNLxQk5PAfwEwh0wKXTeOIAQggKWKUw34KljAAlGOBN3vhvENXMKvFUkl:+OWLxzAfnpKlxKWVih8RW+k2RHfyiRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675340267, "uuid": "10bead90-c14f-43b2-b0e4-43cfff0f9f39", "value": 41256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675340267, "uuid": "435746f4-b8a3-4178-957d-2849a751434c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340267, "uuid": "d8bfdb0a-d3d3-4b22-8bcc-5435d74613b7", "value": "proforma Invoice Sheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6350d3df-a29e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675303667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303667, "uuid": "9c246dfa-3957-476e-8bc4-b9dd5f951fd9", "comment": "Malware payload", "value": "351a12dc931ee9a5b9ca30af416175f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303667, "uuid": "f912fb9b-20dc-4b0c-951c-32f90f30dd7c", "comment": "Malware payload", "value": "4a52145f82f57c470ee4ab39b745e5affdf2eaa6cff0c96ab825e95c240d4b06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303667, "uuid": "ea7ee84a-4b6c-414e-bc96-eae2f22f15c6", "comment": "Malware payload", "value": "bad5151af6475b92455e744d6515671e2d1ec571", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303667, "uuid": "9ee41f17-1907-41d8-ab97-a0f8af7acd70", "comment": "Malware payload", "value": "997673ceaa609d95d8d551b3f5f6366a2cdf2438776eec3a2e98a0168a751076ad4fc2ddebd90090f50fd63031a3f167", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303667, "uuid": "a518c130-0a13-4855-8ea2-8e46c9fd5e88", "value": "T1A876337273E8DC77C72A1A31CD21A3EAB0D9D7901A709D13E7A65E4CBA6E408C136347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303667, "uuid": "72ea0418-af0b-41f4-bc94-40520c80d7d5", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303667, "uuid": "c342e379-79ae-4902-b0fa-611e81e3bca6", "value": "196608:91OKegaFeuixc9uFcvhMXz8HNiruHNENBL7gAV4:3Ovj0cAqKXIWutENBL7gAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675303667, "uuid": "0738d15f-6004-4ed2-9fd3-13cd6d11126f", "value": 7633895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675303667, "uuid": "51e29bde-8c7d-41ce-a632-6f756cc3393a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303667, "uuid": "6d7def0c-0f87-4269-85a1-7a8c5e970017", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18745ec-a2d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675328763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675328763, "uuid": "eb3e8a47-0724-4d27-9375-4f9b08cdf0dc", "comment": "Malware payload (Loki)", "value": "9603950997f0588a7304a6e56513d59e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675328763, "uuid": "14eda0e0-636c-4390-b56d-93b767064264", "comment": "Malware payload (Loki)", "value": "4a8ed695823b0c7c473df40cb7e899932adb87083cab679c1f5e488fa62a7ab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675328763, "uuid": "cd5f10d7-e846-4c12-bf82-b1c8a4e56a56", "comment": "Malware payload (Loki)", "value": "15560d218014c9f3514e009a79c0c53c023096d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675328763, "uuid": "a99204c5-b401-47c3-8456-7542d15ef8eb", "comment": "Malware payload (Loki)", "value": "9d027f2521588e41d66d696f16ff4faf04830fd6a21afe9c8524de1b034a8ba335b6e905e40fa0010f5b09c02b7b5641", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675328763, "uuid": "4c598c1a-5293-4280-9284-6b6bd51993de", "value": "T1975523BF82922345E2053BFDC225867A53278F1995BBD99B14FE7058867B007FE8078D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675328763, "uuid": "1d708ff5-1546-4550-a871-3096882a1601", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675328763, "uuid": "192fe16b-51d1-4a7a-9525-03b353844908", "value": "24576:4M3F1ahfLZY71479ug+VgDOqSjawQWin2e8h5:oLZgqGhqSjh+n2eU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675328763, "uuid": "73dfa81f-22f6-46c1-a86f-0a357f83b9ae", "value": 1361408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675328763, "uuid": "8bd9acde-bfa9-4513-9b86-5ec52893b050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675328763, "uuid": "8e62eeb3-3655-41e0-bade-8b647407dba6", "value": "Narud\u017ebenica(PO22738158)Kon?ar-MES Inc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54b4eb9-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675337412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337412, "uuid": "c156c90d-9489-4ebd-bf02-0e8dfec56476", "comment": "Malware payload (Smoke Loader)", "value": "b0d836844b04e4a6f4b5ca87cb6ce63e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337412, "uuid": "a5ca2752-8612-4e16-9cac-7b3ef0140dc9", "comment": "Malware payload (Smoke Loader)", "value": "4ad9c36a38708536aaf6c85e9adeb25501107b5fd7c0eaa59c262512d981408d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337412, "uuid": "2d18e86e-6530-4710-9d4f-bfe5791df63c", "comment": "Malware payload (Smoke Loader)", "value": "8d98770e78655f835711c6ec4c824b51615a6182", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337412, "uuid": "d4df8e6f-7af1-4803-ba88-cb291ccbd7f4", "comment": "Malware payload (Smoke Loader)", "value": "b2b9afe85db63cc9d6d523ff474adc1f34f2400d3897032daee5649c17a64968565a15cdccecbbd11d52e5d14c215cf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337412, "uuid": "1b161427-26ba-49e2-a0b8-d28979192897", "value": "T1C5648E02B6A1BC48E5358B728F1EFFE4791FB9508E9837B61314AA1F14711A1C96272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337412, "uuid": "79881afc-4633-4014-a31a-71688b0ffb07", "value": "20540b45038474bafe70cf1c181e44fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337412, "uuid": "e02b6c40-2cc5-46e7-80a3-3dcbf7503ca9", "value": "6144:JSLYnYT8fbYChj1xjXf9/CJTk637eQfnd5dCpxiB+:YcvbNxjv9CJb7d5doB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337412, "uuid": "39c43483-2475-4999-afef-9f9daddbf6ae", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337412, "uuid": "9369017b-6304-4eb4-9d60-55e6d3fe476a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337412, "uuid": "b3a7daf3-d33d-48c2-98e5-b7e008bed0eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c3498d-a295-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675299648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675299648, "uuid": "526afe7c-0cb8-4062-9371-46cfd1d3dede", "comment": "Malware payload (Smoke Loader)", "value": "f0b807d36c9e3a8094170c8aced3e9d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675299648, "uuid": "df4c7096-fde6-4a1b-bfa5-1870d097dd1f", "comment": "Malware payload (Smoke Loader)", "value": "4b4471ccb0261a6f778d02b3601813bd859d8c0fe9ddddd00086ed65331b8783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675299648, "uuid": "fb2ee49a-44bc-4be1-acd0-a01a642079d0", "comment": "Malware payload (Smoke Loader)", "value": "71cad17a11fca22016e1a5668f8cedcabd76f04d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675299648, "uuid": "fa1fdc9b-07a2-4fd4-90d8-3cd88a657cc3", "comment": "Malware payload (Smoke Loader)", "value": "681578fadd48a14df68bc9fa5a61d251eef50564da6eee1a6a156a617f241b394410719296ee8118c8d373c85be4d713", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675299648, "uuid": "cb87d2ce-eddb-46de-afc0-d89ea0331470", "value": "T1B634DF3279D0C073C5AA11305C20EAA4AFBEF8314975594B7B9896BE5F703E0673E396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675299648, "uuid": "11510e37-f8b3-4cd3-b642-fb43cef19a65", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675299648, "uuid": "1a4abfdf-c56a-4a0c-bcad-e3b66165079d", "value": "3072:mtmZoyb1yyKnLuQpPWkx5PSkErpNiRgTZmE4UkM9/3wX+BcY:mtYLuLFpPZGkErqaT4E4iGOBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675299648, "uuid": "95432cca-00ea-4947-9ebf-9aefb3974e42", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675299648, "uuid": "574e435f-7ad3-4076-8b08-43e148906306", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675299648, "uuid": "63b9c2d3-f8f2-4ce8-9a26-60c790df41fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebecc20c-a2e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675332672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332672, "uuid": "5c90cfb7-3053-4654-93a8-7363a92a770b", "comment": "Malware payload (NanoCore)", "value": "cb6cb7fe3be698adba5f6ab30471ab64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332672, "uuid": "68264d38-ac01-4011-b67f-2a4f362012b4", "comment": "Malware payload (NanoCore)", "value": "4cfdf43b2f81fcb05ededad0c6e3a9d58f08a22320a36aece3a56c911ffb7af5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332672, "uuid": "1532d6ae-adc4-4dfb-b949-b288d0400325", "comment": "Malware payload (NanoCore)", "value": "10db26c28417ac198f85779fee4d5da68a4900a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332672, "uuid": "14f3ae0d-11bc-43e7-a6a5-13edd66ffb0c", "comment": "Malware payload (NanoCore)", "value": "2eec2d3287421f37f9e479c510dc775c64f382b48d09c59eca4c54a45af2787a40f9466aa0c8a4ddf4f40267ad45639a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332672, "uuid": "fdeea111-d086-4fc5-9eb3-e17c18c43483", "value": "T128451242BBC599B2D5E21A326AB57B21793C75300FA5CECFA7D00A5CDA301D1DA317B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332672, "uuid": "fd8ab03e-bf7b-4fc8-bf45-aa6bcb957386", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332672, "uuid": "12f454e9-c5e8-47cb-b555-ce1edf089fa8", "value": "24576:lTbBv5rUVQD2t8oEvg4HaBuhVBz76hZYBA3pUd26P9q6Q:PB0m2tz4muhf7+ZEA3pEtJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675332672, "uuid": "f1a57c4b-4c0a-4a9a-bf25-ebf860407da1", "value": 1224281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675332672, "uuid": "84d0f24d-2752-422d-b578-0022e3cef1ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332672, "uuid": "8dd5000b-c779-487c-83fd-3b5d412f123f", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c4ae1e-a2f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675341056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341056, "uuid": "ddb28d0a-9ad7-4307-9a9f-7dcf7a294a72", "comment": "Malware payload (RedLineStealer)", "value": "fab167cff7c87ba44d09e24cc2903488", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341056, "uuid": "a33ffb2c-21ab-4d76-ba16-a34757997f16", "comment": "Malware payload (RedLineStealer)", "value": "4de0ff38dd1f37e819e40d7658d28bed7a9a2f1574c696574b82eaab6b8716ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341056, "uuid": "e439cdb1-e5fc-4d83-85ed-04af2bb37f78", "comment": "Malware payload (RedLineStealer)", "value": "c21c01efa1ab81431c9a211881b6c5060004e7d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341056, "uuid": "974e9abb-e7e5-4c14-b489-2f34010cdcb5", "comment": "Malware payload (RedLineStealer)", "value": "9cb100d071ee6d72f0be76943b828c45e64c0368c1c5ea19eb8dc577572b142b80966c21f88fdf45e5e02afdfcc4d0ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341056, "uuid": "3f805ad7-6f9c-49f9-82e5-674d9d20f588", "value": "T1E194BF02F290BD49E5368B319F9FE7E8FA1FBD508E5837762214AE1F14711A1C962339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341056, "uuid": "627fddd2-2265-46a9-b818-40af89943c4d", "value": "20540b45038474bafe70cf1c181e44fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341056, "uuid": "22e98582-5700-43d7-a76a-052859e34b9c", "value": "6144:czPL39sY3baWbNTb3xtUqZ/DaBiA9Qz45k9/CJTk637eQfnd5cicaqB+:IPz9hTb3xhjAk59CJb7d51c6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675341056, "uuid": "236d9a8c-3f71-4771-b315-a57ce84ccbe8", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675341056, "uuid": "af8308f6-ebd7-4ad6-b812-0ed3307de06f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341056, "uuid": "f1fb14b8-f027-4cc7-bd7d-904d8328d649", "value": "fab167cff7c87ba44d09e24cc2903488.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcfcecd6-a2b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675312461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312461, "uuid": "bcea272d-747b-4f49-b31c-461441346dba", "comment": "Malware payload (Amadey)", "value": "766683884bbe6a2c0e0ea7d76b6b13ea", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312461, "uuid": "feaa315b-223e-4df9-b579-1649b0e6a9c2", "comment": "Malware payload (Amadey)", "value": "4ed06a694ba1832bb5526f2a5d52f6455f7ed317191f910d2e01d35bd8fba136", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312461, "uuid": "c00fef02-be66-4419-a2b1-7e067d89dbf0", "comment": "Malware payload (Amadey)", "value": "793d7b457f36a560d7094e4d0fee7270cc0e6842", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312461, "uuid": "3f1e6544-f418-4fd8-9906-0dd943aca2d1", "comment": "Malware payload (Amadey)", "value": "79db4c4e81f28138b748acce7d9b18ce5eaf6e348d5cc9bd6815b2de36e79cd8c3774ecaa1bc362b0dbd3d43838a164c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312461, "uuid": "db4034dc-523d-418e-82da-639a3c452ebe", "value": "T1A254E132B590D072C5A610309C30DA9577BEB9321975A9577B9C1BBF8F306D02B3A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312461, "uuid": "1a4d5777-fba9-4734-9c4e-595de1ba6813", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312461, "uuid": "6c072957-9add-4b93-80fd-13c00be28dc2", "value": "6144:vlr2XLlX3MjWzpuXgs8edJwibHbCJfAg:vlr8RX3S+AXew7bHeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675312461, "uuid": "2191aacb-34a3-47b3-bd8b-f7433bee86f9", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675312461, "uuid": "a0dab9de-a73e-46c3-9464-faa29bc32935", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312461, "uuid": "4fcada41-3714-4e05-8d1c-deb5050f0ebe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77a899d-a32c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675364850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675364850, "uuid": "f11d2267-a775-4b84-99bb-727cd330d106", "comment": "Malware payload", "value": "a19f3395e7a7f2981eccd6448d6921aa", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675364850, "uuid": "bb462c7a-8995-49ce-951d-a5b147d47416", "comment": "Malware payload", "value": "4f23c0742d9a19732acdcc777b4168366d4762b7f9fa553d1dbc62b68378cc97", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675364850, "uuid": "30f6b46d-0ce2-466c-8f08-b80c04b04755", "comment": "Malware payload", "value": "09c6a9dbff7f8dbd3c57946e686adedf9b9a1702", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675364850, "uuid": "1bb0c4d7-cf10-4140-abf2-2fa9ee5b6a7c", "comment": "Malware payload", "value": "f972de60124e93029aa4a6d1f0cce81b59c61b888d893a0ea7b78ba3696b54625cc0b241287c7a44868369f9daea708d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675364850, "uuid": "91468c46-4162-4010-a4ab-c5bfa4f06e57", "value": "T1F6235D4037E88136F2FD4BB5ACF2A2418679D2676903CA5D6CC814EA1F13BD596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675364850, "uuid": "132d9be6-7224-4256-94dd-353cf6a9ea49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675364850, "uuid": "10f91cbc-3104-4b85-9220-50d977f8c9fd", "value": "768:p96mxUTILWCaS+DiMtelDSN+iV08YbygePr7DlPlXWvEgK/JnZVc6KN:p96AKWMtKDs4zb1ulPlXWnkJnZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675364850, "uuid": "e0766814-90c7-42fc-9554-94deadd4a5d8", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675364850, "uuid": "a033d42d-a379-4d4c-8708-22f30ee0e9e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675364850, "uuid": "16ba7201-7381-41b0-ae67-99c661754b67", "value": "bJwE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb25046-a2a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675308196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675308196, "uuid": "2d06f347-f51c-472c-8383-f29f977d9e17", "comment": "Malware payload (AgentTesla)", "value": "603566da9508529b53dd5c643819e31c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675308196, "uuid": "37909916-f6c9-4abe-92a3-e5f7bfa9aa86", "comment": "Malware payload (AgentTesla)", "value": "4f5ce2f6ad6e77c21daf5ed429b45b3724f2c7fe48e058b7a4a72eb39d6903c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675308196, "uuid": "ffe2de95-2fb1-4524-bd52-3f3dd7c5533c", "comment": "Malware payload (AgentTesla)", "value": "8c7760b227a1f3e44d2d9f7738ea5717219e0a8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675308196, "uuid": "7d7e043c-8db5-4f6b-baca-3cc8cda4465e", "comment": "Malware payload (AgentTesla)", "value": "6a541640fad26f8b9a88af3aeae58f64f2cd5b7b6e733c3ff82c224237b1861bfb1359e1ffd35d7a35c3e8a1edd72d02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675308196, "uuid": "e429b03b-34c9-45de-b85f-31c5e7afda3f", "value": "T1B5E4235E67F0CD67E2980132AAFA18D72B42F63A8071631F37100C58BE556D2A70F7B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675308196, "uuid": "8a651706-a3a0-4adf-a44e-8f855d63a217", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675308196, "uuid": "fb7b805b-a3d5-478e-8e56-e93d077d69a9", "value": "12288:vY+lsePPcPIidIrII1pbCWHtBoQrFPFGqhQNBZEaS4X1wvEms/vZz/Ndk4:vY+lBPcksI1VCUoQruYQer4X1jpz/NC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675308196, "uuid": "533d1cb4-774f-461c-be2a-a31694ad6504", "value": 661226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675308196, "uuid": "a7d6c0e2-9a53-4984-9ba4-4858512632f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675308196, "uuid": "20d8e74a-0e32-46e6-b5cb-3ea358ffb5a7", "value": "Final Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eafefc5-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675337052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337052, "uuid": "ce161b2e-56b4-4029-83dc-554833744d9e", "comment": "Malware payload (SnakeKeylogger)", "value": "02f9900e4af894c12823fb6d4a6fe6c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337052, "uuid": "c0834fc4-3f7e-4399-993d-064c48b8913f", "comment": "Malware payload (SnakeKeylogger)", "value": "501c796a553cb886e46f0508d32c766b605a25bfa97f8f600d8f05cad26121a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337052, "uuid": "31c7974e-d395-45b1-816b-9aaed08e961c", "comment": "Malware payload (SnakeKeylogger)", "value": "09d1f7d9229f9d030d3f67f879dea88eecce2a09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337052, "uuid": "f940c2b5-a39c-4b77-9a14-30965498a7af", "comment": "Malware payload (SnakeKeylogger)", "value": "3c90755a5b9bda9a50f9dec65f04e92c555317f8cdb8aeadc51f7231e015bb26fbea233213f9ea402d368ec782011e88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337052, "uuid": "b54c8b77-72da-442e-8f3f-4b4dc7abf014", "value": "T141C4AF1B7A10A02AD8E38DF01816A1E57A755D321F91ED0F67907B993872513F4FA32F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337052, "uuid": "40da550c-4607-4420-9d2e-cfdad4b297b4", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337052, "uuid": "80ac7b51-ca23-4b8a-9bab-e81930a54d45", "value": "12288:GENN+T5xYrllrU7QY6fYtpgJP2zhfb2jRROHcmXXSun:K5xolYQY6fYtpQPGhSHun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337052, "uuid": "840b00dc-f283-4873-974e-9111deb7cf8f", "value": 587550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337052, "uuid": "be5210a8-0c22-4dfb-8965-b901329f5079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337052, "uuid": "779fe83f-d046-480f-ae58-3ab72851b371", "value": "S87654567890U976543456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9cacaf-a2e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675332945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332945, "uuid": "8e8f0cf2-314d-4656-a5f6-8cf87e06d14a", "comment": "Malware payload (GCleaner)", "value": "d0369051e46c25d55b4052fcf8442daf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332945, "uuid": "e658fa8d-2d4f-4ca7-b7b0-8c9ef3663f90", "comment": "Malware payload (GCleaner)", "value": "506bda7c05c084cae597c64c88701db9a5a92c98263920930f03426abc4264b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332945, "uuid": "6c737e42-dd48-4e82-80d6-71023eb5adad", "comment": "Malware payload (GCleaner)", "value": "3cec6edd354aa203ec9db1f3f5b8fb8728198532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332945, "uuid": "701b652c-02d5-4879-b022-b1a72c555e18", "comment": "Malware payload (GCleaner)", "value": "615d3622ecd79e064ddd867dbf0852213b0211a0a0891415f7d7541c8136760193ff7023fbf34eba5254df9ac437743a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332945, "uuid": "61df7bca-1926-4d12-98cf-4c5b2a5aebaf", "value": "T136A5335B94D2D836C2258A3A6E34E547AB77FF1651B213BE34BE31DE04374A3B11A08D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332945, "uuid": "2668c220-2c96-4642-8d7e-bb05256d0724", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332945, "uuid": "0dda9ad6-b0cc-42ec-8855-9b4a3d62a16c", "value": "49152:bgZ2JKt8um12kZLW5RvvO6aPT4Hf3yc7ruGIOqSXLCgv2MR:cZ2j1rERvlaPUH7Tjv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675332945, "uuid": "614223e0-0d3f-4336-ae89-5b88ee52259f", "value": 2117827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675332945, "uuid": "824fabb1-e005-4207-ad33-4c74b39e08eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332945, "uuid": "0c95bc2c-27dd-46a8-8739-a77da2957a4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c1bb6d-a306-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675348521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348521, "uuid": "0861c744-9e45-4013-9b65-1213eab30d86", "comment": "Malware payload", "value": "8b8ddc395535d912b5d60b17731bc33b", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellCobaltStrikeBeaconReverseHTTPx64", "colour": "#D504DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348521, "uuid": "4752054c-eba1-4280-8a91-e0d14c2e53d6", "comment": "Malware payload", "value": "5074fadffe1b3516888f2d5e15f68c20c7db958a2e22238681357773ce169d17", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellCobaltStrikeBeaconReverseHTTPx64", "colour": "#D504DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348521, "uuid": "37f2a9f4-c87a-4375-9579-01516e1d3a17", "comment": "Malware payload", "value": "d10b09f0d205d50d66347452500d6000d04bc6aa", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellCobaltStrikeBeaconReverseHTTPx64", "colour": "#D504DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348521, "uuid": "a751bb96-95ee-4915-bf7d-7a0f28ac90f4", "comment": "Malware payload", "value": "5a497e661bb0760159483a92877630373083eebd973abc77cb1dad361b58a64020ded9d37fbe36589b6dbb3b54b8d43f", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellCobaltStrikeBeaconReverseHTTPx64", "colour": "#D504DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348521, "uuid": "b17dd3fb-99c3-4a9e-9246-cf09f1df828e", "value": "T17F123236CA31FC84439C314093252DAB31E8555B97F70E38CB061CB63E65B66EF69A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348521, "uuid": "82da83d7-3d02-46aa-b0e2-1d19fea7c822", "value": "192:1XD6GMe4iSPeWzKA3hdr7ci9UBvqbuZq+07FK9NtkLISbniReShqz2A:1XD54iSPeWzvklfq+07FK9r/Sb49hLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675348521, "uuid": "51de1bd7-7aa8-4821-bd1e-2ffe861da3db", "value": 9621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675348521, "uuid": "64a18e96-bfa2-45f6-9690-db5f43c1fe87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348521, "uuid": "08d54c0a-94ed-4bed-961a-8dd04c3496fc", "value": "0JzA6r5r.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95994fdc-a2f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675342835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342835, "uuid": "82092900-dfcc-406e-b041-94841f7a4c7e", "comment": "Malware payload (GCleaner)", "value": "3d4778ad5398880010409eb4f28af48d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342835, "uuid": "3228a0a0-0e27-4470-9fbf-d6072f928e1e", "comment": "Malware payload (GCleaner)", "value": "50c9bc3e2a5fd737ab949b0e4a572917869b3c7c1bf92a544283e8254bbc0399", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342835, "uuid": "dc9e428b-470d-49b0-b46a-db0f3ebf02c2", "comment": "Malware payload (GCleaner)", "value": "89e8e262a20b032cb7bb1de51da59360515532e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342835, "uuid": "a03047c8-0778-41b1-a844-2ba03bdddbc7", "comment": "Malware payload (GCleaner)", "value": "3ca05126d2e38466e6e088b2fc86cda445b0bb3d7ac7c9abfe5d633365d9d0f72f34727c2884504deaa859048132e9ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342835, "uuid": "0557c649-b7b5-498f-b4f2-4fd4fa312bbf", "value": "T18AA5330C1076C47ED397AB7977356B00FBB22CAA1AB48556719C421F2B27790248B3AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342835, "uuid": "3e5dcff3-9531-4efc-8e1c-d42732da1128", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342835, "uuid": "b8c701f3-c0db-4fb5-88a9-7b3b50f8216b", "value": "49152:bg9B1NHc0jdn77NIAJa21LlOozHUY/orS4jeyLLCgv2MR:czrFVmAJj10uHdzby/v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675342835, "uuid": "eb268f88-c5fc-487d-8275-94c523215e75", "value": 2063948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675342835, "uuid": "b58fad3d-ce9f-474b-a2d7-e8159404bfe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342835, "uuid": "434d8e25-a83b-4377-90d7-8420f59e4eef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a61e5fb-a304-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675347541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347541, "uuid": "b488487e-b2a9-4541-9406-1ec95e779747", "comment": "Malware payload (AgentTesla)", "value": "e985ffa2341fa68cfc3a7019aaa4b68a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347541, "uuid": "35934719-392f-49b8-af69-0bc3ac2e0d06", "comment": "Malware payload (AgentTesla)", "value": "511f52584d43e8209e3f2edc6f3b06afada6ef440c8a4c587c485ab20675cee7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347541, "uuid": "96f4e2bb-7c5f-4b4c-8471-e5f43b008d52", "comment": "Malware payload (AgentTesla)", "value": "64430affa7273b6473b6a987ea522204afc3974f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347541, "uuid": "375358fe-7db2-4265-9070-9dd24304e2b0", "comment": "Malware payload (AgentTesla)", "value": "dd413e1d402689ba43e33ed29ebe43819a5852088ced2e53d07f5cf39d31d2da5bccf1c7ff152f73a97268faf523a843", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347541, "uuid": "2b9738ee-2a7c-4403-9d4b-ceb89c368dd9", "value": "T145049DDC729035DFC86BC571CEA84D64EBA0787B930B8217906712ADAA1DA97CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347541, "uuid": "b31acd3c-7ee9-4313-8bce-b01b0537d7be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347541, "uuid": "a1d856eb-7ad0-47aa-8e26-95c94a5710a9", "value": "3072:kIi+/igUcnhfe/Z9Zwp8LWgFMMmwDIqcWXbrqbDGdaAMAeWOnn8m5kJyY:mlNchfe/ZfwpCopW0af35O8m5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675347541, "uuid": "a9fa4b75-fa9a-4816-af67-daf42138aa39", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675347541, "uuid": "92b530f6-8cdc-4b5c-bfe1-daef01e04179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347541, "uuid": "33e11493-cae3-4cff-a432-bae3a32aba46", "value": "e-dekont-20230202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f05497-a2f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675339239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339239, "uuid": "ce90e374-3eb0-42d9-9295-68e23c33e522", "comment": "Malware payload (RedLineStealer)", "value": "9c88149795222b21389b93b69edcc3c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339239, "uuid": "bcbbb4b6-e007-41e6-9aca-36d8c3f211de", "comment": "Malware payload (RedLineStealer)", "value": "518af0c342abeae63a11c907605380199a0b6f344a93713e05d1efeada57a3ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339239, "uuid": "4bb90d2e-319d-41a6-91bf-c30045a35185", "comment": "Malware payload (RedLineStealer)", "value": "ec277b865f788289b731a5cc8dc80a7cb2b551ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339239, "uuid": "330a82bf-bf39-4cae-930b-daab82e8a352", "comment": "Malware payload (RedLineStealer)", "value": "2bf3f4032e101d36776ed4be1f63013f5268e48d54386c29120581935e5fd8fe12610bca08f563ee36a525b0fbcde3d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339239, "uuid": "05ccb6f3-cbcd-4573-95c8-1c74d29dc57e", "value": "T1D894AF42B2A0FC49E9358B728F1EE6E47A1FF9504F3D77B61224AB1F14731A1C962325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339239, "uuid": "91f62217-7972-408a-9d4e-746d386f49ee", "value": "20540b45038474bafe70cf1c181e44fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339239, "uuid": "53db281b-0668-4796-be34-167e7ea2da90", "value": "6144:poXL3apNcz6ztuFOO2N+keTg0ZP1twYGBB9/CJTk637eQfnd5VphB:QDqJztQ2AkeM0Z6v9CJb7d5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675339239, "uuid": "d080e0d2-f2d1-4d5d-abc4-89a5ef11c0f1", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675339239, "uuid": "121fb5cc-0e47-4593-b7a6-3e6893e26fd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339239, "uuid": "eef92e6f-55bd-4bfe-8b9b-f53034a24e2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a28f0a-a348-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675376517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675376517, "uuid": "d2e7d45f-33ed-4c29-8203-2d9e3865aa17", "comment": "Malware payload", "value": "3dfb453fd787b1f91147710a0691e09f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675376517, "uuid": "d0586aa3-c52c-47c3-a9f9-023c68de134c", "comment": "Malware payload", "value": "51f9775a943c2a60a5a91a735db752920c2a5caad51ba190e4f7e3af3c7d144d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675376517, "uuid": "e6f5a81f-f2b8-4c39-afe3-8d8d8f83334f", "comment": "Malware payload", "value": "b0ab664d91efe2bcef4cf3aaa61252fca7ca6ea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675376517, "uuid": "1d01b18f-ab2d-4c76-b0ff-40380b021d9a", "comment": "Malware payload", "value": "b69201f5244227c6410395b21605f99182c77c95614555a8a12854fdc8e59ec977740080a62d843ee347869a8954ec2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675376517, "uuid": "fbc7e1fd-20c1-4af4-b76f-dc2975244aa6", "value": "T17D648D8262D2FC41DA21CB728E1EDBF47A1DB9518E396F6A56185F3F1872073C5E3A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675376517, "uuid": "92bc22ee-82dc-4b62-ab70-c582c5d53a7b", "value": "2ff60b2f756b6533c2643b340c02a5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675376517, "uuid": "7278162b-e5e2-4448-868d-fdb38e1aa8f1", "value": "6144:73S4L8Lh1joWNSMgE4FXralwKwpxzEjV6ptCbNKNc:73S4ALcWbg/F2lesf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675376517, "uuid": "100e10a3-30ec-4ffa-a846-207424d0d3fd", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675376517, "uuid": "7a99d51a-1173-4fa8-8ef2-58707bf83de7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675376517, "uuid": "8936f272-0e25-429d-8f7b-728f462e8dfb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f964f1e-a2c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Simda)", "timestamp": 1675320035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320035, "uuid": "aa987398-3be8-49a5-ad17-27f98b940fa6", "comment": "Malware payload (Simda)", "value": "0d9fce1f9db03be59d9265c480fb7363", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320035, "uuid": "115000de-531a-4d98-8059-0fbd90610760", "comment": "Malware payload (Simda)", "value": "527a1e9dccaad2a9ae59f37512d2f1f61d636e251428785bb70dc56d543d9024", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320035, "uuid": "c7a4252e-c54f-4a6e-ac26-0dfb29b23028", "comment": "Malware payload (Simda)", "value": "6044818512df235b5249c49aa16da97a987d43cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320035, "uuid": "b61a2692-c77f-45a2-9fee-de1d2ac6ad4e", "comment": "Malware payload (Simda)", "value": "156b25751d9dd965e5f78593c7f3d0c26526fd4707c5cd76ec800638348676ee8f058b9abba1ade543edcac65d9f5a7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Simda", "colour": "#FE8273", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320035, "uuid": "138988f8-9a1b-42d9-aefa-401c0389919d", "value": "T1EB749D21F2458079E4F5157096FF7A5B117C6AA5471838E3F798AEC918A80F37A3C38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320035, "uuid": "d38dd3f3-cc94-4686-9a00-d88ed1d7eeac", "value": "728aac1b209d924b45a5ac4774a05610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320035, "uuid": "0326d8a2-3c72-4f30-baca-4464f0ba33fd", "value": "6144:Tu+kBmWicfSPyXTnkl+r+MHLt8TaggWQI9T1S0osk:TAmWip2TnGC+MHL2mgiIF1S0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675320035, "uuid": "7670a110-e345-4720-a9f5-7d20767b4fa9", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675320035, "uuid": "2ae5fd51-37ba-4db9-83c5-06acfac3eb8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320035, "uuid": "a620c8b9-f3ff-44cf-9345-57ab1d2f430b", "value": "ti84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517701cf-a330-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675366343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366343, "uuid": "32c5f2ed-5a5d-4d15-b423-300c3b208c9d", "comment": "Malware payload (SnakeKeylogger)", "value": "60eaf00f8029324c45474af2af3f64fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366343, "uuid": "67975ba4-f3c1-4265-a478-c888af599d57", "comment": "Malware payload (SnakeKeylogger)", "value": "52bfe70515e66a6f6d8b5ffff8b2d310bf211f0dcc745337ee12d69e85015eb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366343, "uuid": "38985ce9-6eb5-4009-b604-297864864fbd", "comment": "Malware payload (SnakeKeylogger)", "value": "7cf1bfbab3117ba69cb84318058b0888eda15e8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366343, "uuid": "a9ebd75c-2108-4c57-b6bc-b5913388e51f", "comment": "Malware payload (SnakeKeylogger)", "value": "8e92f58ae2317dc861eaae30a8d1a791763e78acb71f3bb733f7551c414f56fc4219d07e995cbd1a91319234830074d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366343, "uuid": "f25b6094-57d5-4a80-9ded-05df689b7805", "value": "T170058D9737B198B3F68B00B5142837CD2FE07503BE95A253A77B7AD09B118FBB299141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366343, "uuid": "44129ef4-dd42-407a-907d-7e597ea4f21f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366343, "uuid": "73759177-f295-4aaf-9f7d-f00b8729916d", "value": "24576:21dH+AL6F0xUzo+/5rqHMvNgk6LpqG4yPa:2PHrOWak+/5GHMVgk6Lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675366343, "uuid": "f515cc62-d47e-4f06-b805-79891346c694", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675366343, "uuid": "2112a337-5512-4058-a4f3-c0f840b4bea1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366343, "uuid": "2426738f-029b-4812-a8a3-6abd8fb4cc88", "value": "60eaf00f8029324c45474af2af3f64fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041b718f-a317-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675355476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675355476, "uuid": "87802785-c9df-4c1a-9647-b2220ed27af1", "comment": "Malware payload (RedLineStealer)", "value": "c513d5d66f1dcd6dc41f999179645243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675355476, "uuid": "2b62178d-9c95-40f3-bfe9-f5633b0b7532", "comment": "Malware payload (RedLineStealer)", "value": "52edfc3a553973feca9d6949ae3e63ecf4cf86283d3839f7e0da486ad90c1275", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675355476, "uuid": "6a8497b3-9d91-4b3c-9fa5-91bcc5682fd3", "comment": "Malware payload (RedLineStealer)", "value": "9677184aacb795e81e9a79384e04a43c0964c120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675355476, "uuid": "9b5b59da-2083-44f8-9d96-2107a91c1b61", "comment": "Malware payload (RedLineStealer)", "value": "14664b88fc1b52b2b9d63c5b5c5810d7b9d614d9237e36276366d1adf261d787924ca391760d6a77ad926be0fb441c60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675355476, "uuid": "12e0bc74-7c60-4d5e-b083-bf7e6950975d", "value": "T1C694AF42B2A0BC49EA314F729F1FE6E43A2FBD518F1877B51218AA1F14711A1CD6273D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675355476, "uuid": "8b66054a-9e5c-4c4a-9918-a7ce8e72667e", "value": "e479a558a3a55c2bde918dd7ce07e020", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675355476, "uuid": "841d9383-0a9d-48e3-a597-ac3b59488f58", "value": "6144:/JL18A0juld9HmWJXlbqvZcrFmtorJPeoKqAD89/CJTk637eQfnd5KrcWB5:xRo29HNJVbscYorJGoaI9CJb7d5Kw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675355476, "uuid": "c3cbe7b7-07ad-4265-9be3-6aef8395f6f3", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675355476, "uuid": "b7b33afc-6cfa-40af-ad00-ae1a75123822", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675355476, "uuid": "0a293c97-d972-4e91-ba4f-cf9b220bfca6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fdb77f-a302-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675346517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346517, "uuid": "54b5ef7f-4c1e-43b3-9c61-440bfea48b4f", "comment": "Malware payload (GCleaner)", "value": "87fbe33402ec35e1bcd2aa5e773589d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346517, "uuid": "a371b89e-f400-4f0a-8ba0-fc7c977ff4be", "comment": "Malware payload (GCleaner)", "value": "53b2cd343eeb025b369d84a7034b7e68ad807ab1e1b616eeb361875e97278cef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346517, "uuid": "f5228656-f14c-4945-ac5e-830c3a55906f", "comment": "Malware payload (GCleaner)", "value": "f7dd21bea56a753a3a18ee79d5fb3a8b8bca1693", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346517, "uuid": "f27cb16c-adfa-4c10-b4aa-d2ee13a3302e", "comment": "Malware payload (GCleaner)", "value": "9d08d8793e341519af729b6e965bfb31ed8489c244604776fa02e69926cd38b9f7512268b7be34910f06b125b4dc4c15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346517, "uuid": "f97e284b-3e91-4ce9-b1ea-1842a63c69a1", "value": "T1CD9533B5A1FAC077D033CB3605748221F997BE62157A469B305C6A8B1FBB340652F3E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346517, "uuid": "6f42ac0e-b7ba-40d9-9e32-e535c7986c0e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346517, "uuid": "4926e9ad-8b5d-4db8-a122-06c0910972da", "value": "49152:bgShVIvrrgtQhlvRkgF5hUJvSsaUQiBKV5fLCgv2MR:ceqYtQhlA1gUHBKV5v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675346517, "uuid": "97b0fc57-c0e5-4f07-a2b7-fe2c2e12e7b5", "value": 2060976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675346517, "uuid": "851ed91b-eed1-415f-90b3-42e1f1954be0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346517, "uuid": "16a66a49-ebdc-450d-a4ea-3e173d76d6f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366a99a8-a335-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675368445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675368445, "uuid": "e64af319-f922-41ac-8413-7398ff20b7b0", "comment": "Malware payload", "value": "5e9cf194d28e22718aa580991d8f15df", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675368445, "uuid": "ee30091d-cb3b-42d0-ab8b-b0f77a8ae002", "comment": "Malware payload", "value": "5432086daa9ec74b311002f8cf2d9c110414b342366941fda6732a7a264562c0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675368445, "uuid": "3781ef8d-58a1-4c47-92c1-4692b3b06797", "comment": "Malware payload", "value": "055e7ba5d1a80e2f619792e063bfa2a5372ecd5e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675368445, "uuid": "aea1da61-c177-4102-babc-6a1dc68e702a", "comment": "Malware payload", "value": "198027455c91c33d7db74c681021543b858f76512cec2b1e85b181573bb95e04937a4893cbfa95a81ecf4bbb381b2b17", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675368445, "uuid": "74b3eefc-bbf9-41d3-9fb7-3801c3bb4794", "value": "T1ED236D4037D88136F2FD4BB4A9F2E24586B5D2676903CA5D6CC814EA1F13BC59A036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675368445, "uuid": "7279ab96-82d1-409b-a563-e3654bcc88ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675368445, "uuid": "258d8a7e-4f6d-42a1-9024-879fe0e8c919", "value": "768:4G+s3CjtDILWCCa+DiptelDSN+iV08YbygeTbCvEgK/JvZVc6KN:4G+AatpOptKDs4zb1cenkJvZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675368445, "uuid": "acd0c5ed-7b64-49e2-b5a5-2352e599219e", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675368445, "uuid": "02a09fc7-6393-4ffd-9b4e-1b3edb4f3cf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675368445, "uuid": "65f2068e-6ea6-4818-a6a6-35e237d37a27", "value": "bJwJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2243b64-a351-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675380652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675380652, "uuid": "ec1565c1-ece2-44c2-9266-086d81604166", "comment": "Malware payload", "value": "ce4f2b3ca13a0cf5b0fc82ace99571f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675380652, "uuid": "f8482cc0-eec2-4152-b6cf-832fe59a4839", "comment": "Malware payload", "value": "55832e6ea2053a060e673f058a71210972d8328b561ea1cdb4f4f2d462bb1127", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675380652, "uuid": "63536f93-5e72-4b8b-bbc1-0fdae1059d6a", "comment": "Malware payload", "value": "c56379ac1a2b47efb8b67e1fa845f04b43cde9f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675380652, "uuid": "e736e738-5422-4269-be31-bb43d48db2e9", "comment": "Malware payload", "value": "0e30a445bea1a6f4edda95489e69e2254dae9b157468fdbd41ac5546dffeb0a48c1cde151f943d8b8d4fbcc51094d5c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675380652, "uuid": "947fad8c-05a2-49db-97bd-58a9f9c52d93", "value": "T16A95334ABAC08C36DB225F721D1C962EE049EE3334315151B40F76665FB78BAAD4FE12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675380652, "uuid": "48048d91-3704-488d-b89b-ff54546ac426", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675380652, "uuid": "7c9138a1-e0d4-4329-bc3f-dfd4dcfa61e3", "value": "49152:bg79aK5FDu+I1B4lJJd/+7OugtLbRnQatCHR8Tj9Eaz7LCgv2MR:c79vFDu+Ib4lzVykLbRQatu8Tlv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675380652, "uuid": "b5bd4c3c-e2e0-469f-b98f-e5922c35f654", "value": 2052575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675380652, "uuid": "1c7801c7-30e2-404b-b382-715a1167b721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675380652, "uuid": "230bb2f4-ce99-440a-a9b1-6f63b91ffa28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62120fc-a2e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675336045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336045, "uuid": "ccbeb7f3-63d3-4a80-9806-f26b45001fec", "comment": "Malware payload (AsyncRAT)", "value": "434272e39598efb39944fe0ad41b0cb5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336045, "uuid": "1aff5c8f-cf32-4684-a1d5-f66edf535938", "comment": "Malware payload (AsyncRAT)", "value": "55e25bce90136a80ea0e24c17e4fa2b6582d9d387b3defeb06d40e38313ea6fe", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336045, "uuid": "653ab57d-2c1a-49c6-a8da-c81ae7bf4459", "comment": "Malware payload (AsyncRAT)", "value": "961476c2cbd0c9b5925a502a0ef76ff9c0715177", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336045, "uuid": "d581f0cd-3f39-47d8-b435-d0b669731ff2", "comment": "Malware payload (AsyncRAT)", "value": "7b8748206a8e3624d0a2d93934c88e6a7e51df3ac425a4f8ef0d218de1d21365da9619f4b38faf5e5fd339761e68ac4b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336045, "uuid": "e95a52ad-04f4-402a-ae2e-fd16a8ed742c", "value": "T108232B003BE9C12BF2BE4F7899F26145457AF6633A03D6492CC412DB5613FC68652AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336045, "uuid": "c28e79b4-e1fa-4626-9734-8b8d794bfe92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336045, "uuid": "1ff5cf07-835f-4f8d-a73b-841e9434d838", "value": "768:DuYe9T3kH1jWUvmqRmo2qbtIziXqiPIlzjbCgX3iPCV/qajNcuA38BDZfx:DuYe9T34l2kQl3blXSAr2uAqdfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675336045, "uuid": "76e70177-481e-45b4-b430-cb95f4c6127f", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675336045, "uuid": "b38add8e-1127-498c-9e59-1e4a7359f280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336045, "uuid": "41dc4c11-cd36-4e86-99e6-ae8a252fa987", "value": "bJvF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9013cb-a317-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675355787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675355787, "uuid": "85e56106-a090-4c7a-9203-8b1f3be56900", "comment": "Malware payload (Mirai)", "value": "9cee8372f7b961df1ba5400dd39c587f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675355787, "uuid": "01205033-fbcf-42d8-aad8-f4e00d573a10", "comment": "Malware payload (Mirai)", "value": "56e3219819aca31feb15df8ed36383f23f08565ca8e0cfd872b12526747e65a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675355787, "uuid": "71d715a8-ee15-4c08-84a6-f6dbe65f816b", "comment": "Malware payload (Mirai)", "value": "dc8cb18c2ac01b398ce2c590334a5fa145ab8a16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675355787, "uuid": "7bad86df-4205-466e-abb0-6da4cdd75ad6", "comment": "Malware payload (Mirai)", "value": "723178e2da0153b7668ac634c7eeedab1681cf28424082b15c43cfcf10ab29ce45730e91721b49515ebaf1731ef1f825", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675355787, "uuid": "8a9d1af9-11ea-4588-b5d2-330f2b1fde4a", "value": "T10E630896BC818F11C5D412BAFA2E118E331727B8E3DFB212DD106F24678A92F0E77516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675355787, "uuid": "244ca7e5-b4ba-48c1-80ef-42d49c47c1f6", "value": "1536:lIn6m9j4hM5OggaoH/8Tl2YeOSMOwkfQvMvihzonni+7:S9MhogaGkeOSMTzonni+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675355787, "uuid": "54ad82d3-3e93-47c0-a62c-7ee17e36d263", "value": 71136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675355787, "uuid": "cc7a132e-125f-4b46-9fb5-70ff643f8c40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675355787, "uuid": "d0333406-8719-47f1-a9a1-2abd7ece9c7d", "value": "9cee8372f7b961df1ba5400dd39c587f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cdf0842-a2b0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675311467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675311467, "uuid": "37e8087c-2869-4422-a85b-b1d01d8885c2", "comment": "Malware payload (AgentTesla)", "value": "f0a00cbe07b60c50384f77d06fa9bd9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675311467, "uuid": "46cfc0f5-962f-433a-9a0c-38927efbb716", "comment": "Malware payload (AgentTesla)", "value": "56f46ad5379ca55610e3f0fc9b5fd4a86b3818e8713384d64cfb3741729c4a5d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675311467, "uuid": "fd835da6-3ecb-4d31-8d45-e5926ef09245", "comment": "Malware payload (AgentTesla)", "value": "5661448688594eed640077e2951b82fbf34164fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675311467, "uuid": "363d8444-bf3a-463f-b0f6-1fb28ff64d57", "comment": "Malware payload (AgentTesla)", "value": "c9acf9361b07e2e026bc9bdbba0b950e7a3bba8f7a7747a01bdad49fdb63764613159435bee88b4da745b027bb01bf3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675311467, "uuid": "20601745-9501-444b-9815-194adfae08cf", "value": "T19805D43919761BE6D338F63182E14020B6EE6C836723E959ACE636C54F319817ECE61D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675311467, "uuid": "e6eecda6-c5e4-4310-984c-73fbd26cd8cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675311467, "uuid": "77211821-596d-4838-9376-799282d28335", "value": "24576:3M6WjseHKNTn7tunA+/kS2IMfmBmT2NXmE/nO61i:tOS2NXmEPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675311467, "uuid": "72d6c54a-74a6-41cd-91b9-4143d8dba036", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675311467, "uuid": "3f14a02b-efb0-4928-aaf3-9c18ef2c6435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675311467, "uuid": "1c781045-6496-4ada-9782-5253db44806a", "value": "Remittance advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b967f69-a2df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675331571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331571, "uuid": "86ad5331-85ad-4cb8-b806-e35dad6c0693", "comment": "Malware payload (Formbook)", "value": "b334a0c29b5e559b17da1d12040f3e2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331571, "uuid": "1c1117c9-7ba5-4526-906b-c5b7b1879cd7", "comment": "Malware payload (Formbook)", "value": "5718c580c8854ea0d8785b26989e890c56f9e5fb9a58a0f1debc4bf71d869a9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331571, "uuid": "b4cc50fb-762c-453e-b17c-ecbbd17eb4ce", "comment": "Malware payload (Formbook)", "value": "23e73f5b76aae753529d75d9cb993cc5d0884b38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675331571, "uuid": "7fc9e91e-e140-4cf9-8ac8-2832d04a7d1c", "comment": "Malware payload (Formbook)", "value": "df6a27449a8f1fb501e6b78f7722f9e71dc3a8b90311b19e797dfbc0f5f1a253e4d9cf2c0c3de97760e2936fcc47ce3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331571, "uuid": "eeb449b0-9500-4e49-81e5-72bf923d31a7", "value": "T1AC159D8737B1A4BFF68B407144283F896FA07113BE46E25397373A949B098FBB798151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331571, "uuid": "093184a5-92aa-44e7-b328-fe65e4976b2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331571, "uuid": "82b7808a-bd86-4f55-ba80-c90190bfc48b", "value": "24576:bXP6F0fPXPyXzIq2XYK2KAAQvOYiMpqG4yPa:uWfPXPyX8q2oHKAAQvOYZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675331571, "uuid": "e9dd2280-73fb-4354-94cc-e75c36a51d62", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675331571, "uuid": "964f564a-eba8-46d8-b69c-c2c3fff539ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675331571, "uuid": "a3829571-db98-47f8-a1b1-6132646596e3", "value": "SecuriteInfo.com.Win32.PWSX-gen.14307.12199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7bc004-a2f2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675339946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339946, "uuid": "7780032d-732d-43f4-9709-45c3e1d18647", "comment": "Malware payload", "value": "574d4e5e0bc569ed9aa7c80d43a29878", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339946, "uuid": "ea0b8fa9-b939-4c6f-a7e1-bf00791a33b8", "comment": "Malware payload", "value": "5803f69e36cb8a4e6aef09eb1de919b738a71a5459e8b256133d434791a068ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339946, "uuid": "2a9ab6d2-8209-4ed4-8c12-a2ecd8929c79", "comment": "Malware payload", "value": "38137ca3a87fd0eb184bce5b22bd99d18e75454b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339946, "uuid": "d770ec39-bb85-462f-9760-2e92dd948119", "comment": "Malware payload", "value": "8d5212d883b7d998c42a435b147ad2d157788b0bcae1f6277ca35c50c14413fbfd54f3298f94d738704eb91135944978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339946, "uuid": "c34b1362-8593-4db3-8349-82aebe5d772a", "value": "T132D4C666A8F614F9C6BEF0344202A322B87234B943343FE75ED546AA1765FE4763D324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339946, "uuid": "e022f428-5c18-41b4-8726-e2f79f2421eb", "value": "6144:6hfF8pjtKy0vYmJT4TTCZD8jm8lLKJkvogMiz1pXjzf0VDIIbM/jGSudMfBD:65u10wmSCZDOmUW5gMgpn0trbMrGtMfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675339946, "uuid": "70f17008-2daf-40b1-aea7-9d537864c04c", "value": 639942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675339946, "uuid": "808a07b8-f781-4553-9a92-c18cd6607931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339946, "uuid": "78760128-1194-4102-86c3-2a603305ffbb", "value": "574d4e5e0bc569ed9aa7c80d43a29878.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3c1d28-a2d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675328113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675328113, "uuid": "d3a820ca-19da-4c9f-bffc-3abafaef6a5d", "comment": "Malware payload (Formbook)", "value": "d435e40e23adb026097ced4361aed483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675328113, "uuid": "2ece0e83-9e1e-492b-bc49-06ba44952bca", "comment": "Malware payload (Formbook)", "value": "580e90650f19c14aedf7922ba6305412fd2c041144591d22456a753885aafcda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675328113, "uuid": "fc6e69cd-b717-46a4-b8fd-d12ccfaa0cc4", "comment": "Malware payload (Formbook)", "value": "8e94de6cbcd2e8c83748e725008d7aa582530680", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675328113, "uuid": "383c8f7b-df4d-4c49-abd7-3e829b17ff8a", "comment": "Malware payload (Formbook)", "value": "452c2f7fdbb34235fadbb9b09750599cbef565af9b4e307ff1c5a5a8c8f26fbe7525ec424d05c8c0bf49aaf5a27c1f6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675328113, "uuid": "a978bd47-9b10-4347-a5ce-46f76b595a37", "value": "T10DA4DF416B84AFD9D6E239F78933636ED1AB9D4E9031F1839B907BD4EA37040C853167", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675328113, "uuid": "d284d0c8-015a-4474-917c-4d31dbe7b6b3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675328113, "uuid": "e55c0efb-4852-4426-8388-477d640cd10c", "value": "6144:wYa6bDdD9PpjOovpV6XCx9XzEZazURQZbQ+AyTjsXB0RvXWKXVuLsk1ACVZrVpr9:wY1R9wEdZU+AqRvGKX8/LVprsNJGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675328113, "uuid": "166094f4-881f-4143-b1b2-3585f425420d", "value": 453373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675328113, "uuid": "fd21ea7f-55d4-478a-a7c1-7bacb1dc53d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675328113, "uuid": "9896a6d5-bec9-4ded-81fc-7439a0c6c4ca", "value": "PO-2200230_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e29832-a2ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675338373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338373, "uuid": "966f359f-416a-4600-8377-695462811a25", "comment": "Malware payload (GCleaner)", "value": "81af406ec430c5168236ee792f4d5f54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338373, "uuid": "98ef49b1-46ae-42b8-9c99-16c32e79aa69", "comment": "Malware payload (GCleaner)", "value": "589ddcb9e88f8b187d7bccc2936ef2e5f131a9318fb18cae29915830442bf279", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338373, "uuid": "c0014668-5bd2-4b1d-8a07-7a169ebb828c", "comment": "Malware payload (GCleaner)", "value": "c51e5bdc91918f23a24f326df9ac10e8245da353", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338373, "uuid": "e9af2041-ce14-4105-b91d-9398c6360214", "comment": "Malware payload (GCleaner)", "value": "3bbb95c7b471d6ff1d35618bbe91f3b39d178e7362544ff1ca42d8d82bf20e2ea6560a58a0c5490c276c0ec1a425eb38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338373, "uuid": "00dd93a2-cbdb-4436-ab92-6244d55cb2bc", "value": "T16AA53302B95120B7C091C2BE0B6B4F056AA37E7CA735253939BE255D1FA3730B6E9335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338373, "uuid": "2e66218e-53b5-4961-96f0-c61780c4b2c8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338373, "uuid": "b1c88b98-105b-44b3-9ab8-24946655b82c", "value": "49152:bgyF2/di/xckrOsbFwGYnlm3+3GhCLCgv2MR:cM2Vi/xckyy2ZmYGcv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675338373, "uuid": "b4d03363-976f-4065-a389-cda97378e945", "value": 2129852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675338373, "uuid": "02bf107b-e4a0-4584-9f17-696d6d9394d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338373, "uuid": "fd4937e7-d3e9-480b-bc44-cbee8fb76d57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5054998-a2f6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675341626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341626, "uuid": "3b3bff79-f05a-4cf6-83a6-c6b02f47d5f0", "comment": "Malware payload", "value": "6e3bbc2077ac7a5590be689848d0a536", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341626, "uuid": "f9d34269-a92e-4048-9b8a-dc477ae5e14a", "comment": "Malware payload", "value": "58e792d7fbdf1e0a3e20e291546e697eb49770cdd5da6236fac33c5e46741fe9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341626, "uuid": "5f447e5d-53ec-4a8b-9b54-da631386dadd", "comment": "Malware payload", "value": "cc3674fbb11333d7ac25f87b17c08d682aa308f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341626, "uuid": "ae5be3d5-d2ff-482f-a999-c318ae5b0e15", "comment": "Malware payload", "value": "c5499ebd16239679cf591d6bce658ed3315c4e8d52f7d470bdcda1ed1d59c37883bcd27ab83c07334cc35d6a3c5c7c35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341626, "uuid": "761b4f89-c24e-42b5-9921-565c2076021a", "value": "T14632412553FC0210E3FE0B360A3DB25549B6F955987BDF8D114DDC7E391AA44CAA2B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341626, "uuid": "98c41089-1a03-41a8-bcb6-0f18d94bc1ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341626, "uuid": "b999e9ac-5e75-4015-a688-845e4aed9379", "value": "192:5LtXCgj5ZNdaLixdqnP/VunlYJLLLTuHRa8Hek+I4ynqyX:5LAgddaLie3hPLTuCXTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675341626, "uuid": "54b933b5-21e8-49e8-9c71-d55b85de3c40", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675341626, "uuid": "2fda8221-2060-4dab-9b1e-f86f01a0399e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341626, "uuid": "eba81ac4-a845-4da0-b7ae-012912a4dfdb", "value": "Onetap.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5d2177-a2c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675321642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321642, "uuid": "966e3dd7-6ca8-4416-aa23-91559aff2ac0", "comment": "Malware payload (NanoCore)", "value": "c2a80ccf6362bba805072de9ce963ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321642, "uuid": "9df272d3-9bcf-45db-9ef7-6e6504c0b203", "comment": "Malware payload (NanoCore)", "value": "592217d2590ae9ca688346688b2d7d13a78190f9562889597ebb79060136034c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321642, "uuid": "3dfec89f-a346-4017-8320-df655e29366f", "comment": "Malware payload (NanoCore)", "value": "c7a0ca8b35e2c08e69f48d754dbdbf20f2d1d53f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321642, "uuid": "27832a94-efcc-4a47-abd6-3b5938b5eb3d", "comment": "Malware payload (NanoCore)", "value": "e0860ea6372b1154c5405d8697ee0d19cc14131577e23286cd044eaa64cc70f12fcf10f2abb0d16150964e6650f50671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321642, "uuid": "db159642-eeb5-4b73-aa2d-ee1208283ae1", "value": "T195351202BEC196B2D0A3093256767721B97DB9601F68CEDFA3D1466CAD325C0E7317B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321642, "uuid": "39154b70-31a8-48b6-8f0b-ec9c2900e2b9", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321642, "uuid": "31ba50a2-304a-4ffb-a86d-740932f02a55", "value": "24576:9TbBv5rUeTA/TYaxVKPijItG0bKL1xRMa2LSmnbrDrF:XBvIHBMG02L1N29rDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675321642, "uuid": "2eaf5733-157b-446d-b9da-93729a3bd52c", "value": 1064658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675321642, "uuid": "0dc3e4cb-b04c-4737-b879-25b1b72023d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321642, "uuid": "be00d33e-aa4f-4686-b3d1-990b6ed0c468", "value": "026910003102350.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1440243-a2fb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675343768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675343768, "uuid": "1f5dee3e-4114-439f-bff4-fdc5eb6f8b09", "comment": "Malware payload", "value": "ee2378ef9184bde967a7f052f1887cd5", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675343768, "uuid": "8b867956-a44a-476f-b2b8-172d16c7eb53", "comment": "Malware payload", "value": "59339d88d61b762e368e3017874e75286d464e4cd39c78724ec9599adfad14c6", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675343768, "uuid": "9f1f554c-8791-427f-b5f6-c1de3d187398", "comment": "Malware payload", "value": "682654aa68fcc8093494e879eab25bc0d1e93d01", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675343768, "uuid": "ad250a92-941f-4876-966c-1fdf3ffb55b6", "comment": "Malware payload", "value": "78e7f1874bb4d70b0a592f9abc1e49a65302074d19de83f2a218fe853978a9946f7b25245db3513e6719d05ae387b79a", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675343768, "uuid": "d58c861e-81d5-4318-b60b-c902fbc69a22", "value": "T16172D00111A6D5E5EF29E64B04AB1313939FF077A08E045B4694F7AF30C4E1E8B7F8A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675343768, "uuid": "00fafc26-7b15-4ff1-880b-4c3d5974d65b", "value": "384:nDKg0uh2MmvIBKCclTPD6RzhktAjK24Esz+N0Zn48CTyDPrS8:22cMB+5A224pz+N0ZAEPO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675343768, "uuid": "ada21e96-5d78-428c-9aef-07a2bc59955c", "value": 16154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675343768, "uuid": "85ac7e21-27e1-4e1e-90b1-1d9859c43b5b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675343768, "uuid": "8b27b594-acb4-4d7a-8fdb-a89e0464cdb8", "value": "invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af38b3b3-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675337295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337295, "uuid": "0c1f2071-cc5e-4b1a-b735-950212cf1762", "comment": "Malware payload", "value": "32a5ddfe0c91ac2bd220e13f38901032", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337295, "uuid": "53bd7344-9c1e-4e63-a6ce-9262671c90e1", "comment": "Malware payload", "value": "593ea77a457ec269ecede467f85557c7e1ff1d949b546737ab5670f0824819ba", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337295, "uuid": "ceb06a3a-2fa8-4c0e-857c-48961e0a25ab", "comment": "Malware payload", "value": "951ef4bc2ecf1b5f7006f385608d17ec8a8ce22b", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337295, "uuid": "1753c2e6-a265-42b2-871d-8a7b62a0907e", "comment": "Malware payload", "value": "f686ab8e954f270bd8b0d706e27ac70e9bf5d2f8b575e66508e9ceda50c75d1cc6fb277af5a1fc58d91c589c85c1600d", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337295, "uuid": "f0821ccd-2d8f-4e7f-83a7-a3d395462edc", "value": "T171810A15D2C0CFF3D91C02B30FC5472A6B7554A18AC241447788862A285B7CC8766791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337295, "uuid": "ce7eddd0-3f47-4d68-8af2-4a89886b234e", "value": "738e2915a1b13a485142850706e9b7de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337295, "uuid": "b0ec0585-02a2-4269-8784-a01ea729798d", "value": "48:ZvtnarP7mU4xWcoRqn5haGNHoKL7n0MjXQvcYhGC1U:Z1MP7mU4gcoRqFNIKLYyQvKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337295, "uuid": "b543812b-0fb9-4bcf-81b9-6fde122fc19b", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337295, "uuid": "f093a7f7-0507-4fc4-9cd0-67222a317e97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337295, "uuid": "c2320b5e-febb-42f9-a657-4eff72061ee5", "value": "1098.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2287d2-a326-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675361935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361935, "uuid": "59e5c44d-7894-429e-9bc4-4c4928802f4a", "comment": "Malware payload", "value": "a51bd0d26e43dd7b06265ff76d016a0c", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361935, "uuid": "c44bfb02-4f90-42a1-bf86-2a361de7c700", "comment": "Malware payload", "value": "5b285eea307dd689321fa478c17091953455799a9af67a30915f14ac02ad564d", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361935, "uuid": "f65ba304-15c7-4c8e-9045-73fa8313b4aa", "comment": "Malware payload", "value": "f746240b4ef1051c6a4d1cb3f64c53b70a678dfe", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361935, "uuid": "4640437b-1fab-400b-b120-23500226b905", "comment": "Malware payload", "value": "ec1abfbb9fc5737d21ed8f36fa496f955485e0abe50e03956315a58b339e572b0a71cc5d1fcefb03b0d5f55aa21b4005", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361935, "uuid": "d2e5498c-2dee-4b34-b05a-28f653a8ac91", "value": "T129C3D8B33D0D0D9B63D3CF6BD6749549D85FD0B06142F41FF06EE8A91D64AAC02B9AA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361935, "uuid": "ae719fa8-26db-445a-b4fd-5a0e2a7589ae", "value": "1536:uB7pB//lxliQ/2K4cXp0bK6R7PfKxtJTlRkLgdSONu+OTtx/d:MvliQ/2K42sR7PYTlRkQSONu+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675361935, "uuid": "f280c6b8-e8e2-400a-928d-358a4cc830d3", "value": 124914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675361935, "uuid": "4ede7e1d-4584-48f2-9c29-f1700789e108", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361935, "uuid": "30c91e4d-38da-4838-b8c2-000f103cfd55", "value": "UJywsPB8.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc16dcc-a28c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675296113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296113, "uuid": "224c24b3-6259-462c-9192-29888cef569d", "comment": "Malware payload (DCRat)", "value": "a5bb468e6bb248387e71ff2692106d47", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296113, "uuid": "2205bab2-26c3-4082-9135-93567cf0502e", "comment": "Malware payload (DCRat)", "value": "5caa9414d268c408b9a82f4442a87efa2f7f4058d44de616a17da6c5ab113bc3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296113, "uuid": "8212ce86-7c6d-4a41-9ed9-d9a7ab0bc0b2", "comment": "Malware payload (DCRat)", "value": "c673a5f6bee9ad99068a43455fac19cb4ffb948b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296113, "uuid": "37bff454-1141-4568-ba2c-9cd7b72461d9", "comment": "Malware payload (DCRat)", "value": "205afb120410908d30efa016208b2d84d168068e41d558fad12fb76c2f02b81d41e3c9be4d56113f4c0e6cce9718eec7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296113, "uuid": "b7445319-1969-4b7a-813c-7e9311052373", "value": "T10AC45D142AE99925F1BF5F79D4F069AAC77AB5627763EB0F059103C60A23740DC80B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296113, "uuid": "4d18b5ff-9672-46aa-95c9-9dbe465a2620", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296113, "uuid": "4b058d66-aeb6-4bde-a4e7-f5e51f226d94", "value": "12288:fqnOpfdSL1NYAm/4q2CHeVlnJo2JEHE5rGtK3:f+OpfdCYAzq2VVQ2JEklGt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675296113, "uuid": "5762e5a7-b46b-43bf-bf28-0606784b410a", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675296113, "uuid": "22e22ed4-b58d-473b-aca3-025c64e6eda6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296113, "uuid": "3226a430-c03b-4397-ad2c-038fbafd9e06", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-5caa9414d268.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff5bc07-a309-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675349590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349590, "uuid": "8b982013-853f-4d61-a2e0-56b369e45216", "comment": "Malware payload", "value": "214b61a58eac3c1cf0bf9691937ff5d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349590, "uuid": "eb141894-f7c1-47de-a639-ebedc40055d8", "comment": "Malware payload", "value": "5ee446ec637a63b49257d1d772fb24293c6be3d492a9799b94fd28e7ef8f8042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349590, "uuid": "2c36dcde-3954-4b04-aa9c-f95a3edae91c", "comment": "Malware payload", "value": "47087920b459aa2ab2c9540689b27dcd7494a811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349590, "uuid": "cd9d8d97-065d-4b12-b33e-7b163629bdd0", "comment": "Malware payload", "value": "e6b87a4602d4ae799e95c48fa03f008cbd54512b25d10706df87b02f652428cc6afa33ed988f7b99e2cb1a53c5ee54f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349590, "uuid": "11982073-1a12-4141-b620-7b93a277b9f2", "value": "T16ED4D53D19B613EAC338FA7186E18420B6DE61923703F968DDE65AD14F025C2BECE51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349590, "uuid": "4a15d58c-57aa-4ad0-a97a-2c6abe4839f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349590, "uuid": "d92a6782-c3f6-4235-abc6-fa3e74d52ca5", "value": "12288:LDEM+C+2SlLVseHKNTn7tunA+/kSBAljwXqErzq3d7w1LNgOoB3o9nUMO0U4qhhk:LDEjseHKNTn7tunA+/kSBWKqWONire3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675349590, "uuid": "af0158ac-107a-46c5-afb5-e59731f649e7", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675349590, "uuid": "56c4afb0-1bbe-42f3-a928-5273ad493d20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349590, "uuid": "27d5629c-1b28-4bb5-98e7-212fc0f65c06", "value": "CONTACT INFO..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9d82dc-a2c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Downloader.Upatre)", "timestamp": 1675319681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319681, "uuid": "db6e9892-1a9e-484c-9b6f-c72f1d7d3ddb", "comment": "Malware payload (Downloader.Upatre)", "value": "6916f61d95cfd19e64b0749035b85b01", "object_relation": "md5", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319681, "uuid": "e06a9355-acb4-4c62-b75d-0700a790cd07", "comment": "Malware payload (Downloader.Upatre)", "value": "5fca14e334abfa6aefad9d409d44e951f14231ae0a0f91b7af0ce392726be3ad", "object_relation": "sha256", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319681, "uuid": "6c888531-5f0c-4c2d-9c75-14a0f9391d15", "comment": "Malware payload (Downloader.Upatre)", "value": "158a0dad5f18a50b516677221d1c47789625a214", "object_relation": "sha1", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319681, "uuid": "fadad71d-c737-415d-ba7d-e7cb6eaddd50", "comment": "Malware payload (Downloader.Upatre)", "value": "5b92843d5e93868a936a6a6e2726984e371c7fb899768ecf28134739dda73f2c9039d6898b5c38c93f3ba73de608244a", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319681, "uuid": "9ae9483c-2fbd-493d-98ce-0233033bc693", "value": "T17A533F347BC555B1E37B8AB5C9F682C2A526BD227C12D80D50DA77860833B56E8B1E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319681, "uuid": "81e52302-bece-42f4-8278-660493428ca1", "value": "f3e3791f85a6950ffa3d1dd4505cc55e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319681, "uuid": "5840818a-187d-45c0-bc45-492cb1cc2ed9", "value": "768:1dH5CZTKSu3syc3peNPmGPJXdxSNd+qoM4wA+sr:1B5C9nu3Tc3peNPmGPJXXSH+3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675319681, "uuid": "e81d128e-7d48-4338-8df3-57aa293086f0", "value": 61958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675319681, "uuid": "028bba81-c502-42b2-8c03-ec0f57dcff4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319681, "uuid": "c842e6ae-6105-4036-b974-337e6f250747", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f543b6-a2d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675324987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324987, "uuid": "937dfb5b-f1bd-477b-bd80-d75ed4f19f7b", "comment": "Malware payload (Amadey)", "value": "0fa73457ccb4dbe7eb33b21aeac7d0a6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324987, "uuid": "9820f460-13dd-48f0-bb12-0f5b3cdc21a6", "comment": "Malware payload (Amadey)", "value": "6007dbf350d68037b6c9da8bd87655ad9b9566f8870277203275b6ccfc045efb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324987, "uuid": "564fe7f3-641a-4b53-af00-91ffe439dd23", "comment": "Malware payload (Amadey)", "value": "f4f7134560c4dc6b8ecdfc38baff3844d422fa67", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324987, "uuid": "7b7af6e4-12ec-45c6-8e24-9416fe3fd08e", "comment": "Malware payload (Amadey)", "value": "7d96042d31cf59f8b8091fa4dcf9136be5288f8f29ed7fb2b3ec547192389efefe0964193eed2c2d5d61cbfb367257f6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324987, "uuid": "3f7986bb-a4e7-486f-8d9d-1bac441dfbc1", "value": "T120648D02B2E0BC49E9358B329F1FE7E4391FF9518E5D77B61214AA1F18701F2C9A2725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324987, "uuid": "e14f21f0-45f6-48d3-a42a-b2f689329c81", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324987, "uuid": "3b342dee-0246-4df2-9919-4d42336bd7e9", "value": "6144:NRLrtcN9I+mqToLbPK39/CJTk637eQfnd5QuB:7mNEbLbS39CJb7d5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675324987, "uuid": "aeb5aa12-1c92-4a61-ba73-c7f5deb61884", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675324987, "uuid": "603f3a04-ad9d-4420-9e8a-e7ca7bb3a50e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324987, "uuid": "d41558b8-03bc-4c26-9dce-2e25aea402ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a32a699-a2f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675341045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341045, "uuid": "760d2231-e06f-4c3f-b158-c990127e5f3c", "comment": "Malware payload (RedLineStealer)", "value": "7e412e24b1323d22362a1d9a806704cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341045, "uuid": "e957619b-325f-432f-8fcf-b18b9d5185c6", "comment": "Malware payload (RedLineStealer)", "value": "62e5b8648521d398e9645b6ddf70ef4fda1da2e376855741f2d5413d0b45db0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341045, "uuid": "5b274593-3e55-4352-817c-d5bd4daa81f6", "comment": "Malware payload (RedLineStealer)", "value": "1f5fba40979ae1ff56dd2b92db4d6d166a669cca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341045, "uuid": "3922051b-0ec9-4a79-a622-50bc772b4d6b", "comment": "Malware payload (RedLineStealer)", "value": "0f41a61770ec3750df44f69b46e7b49f03761ac812199c146f088332d6975601cd27e37a1d68a47b1461bea26f2c907c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341045, "uuid": "f5c82d32-2a54-46c1-a019-89055b9ac272", "value": "T175740B887670FD9EC867C47F8A681C24E6636466570BA203B05317ED993D79AFE070B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341045, "uuid": "a503921f-ea4f-4813-9d33-475b5f5d8e9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341045, "uuid": "93f8b432-7cfa-4800-8063-103f2be36ee1", "value": "6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675341045, "uuid": "7950f568-485f-46ac-99a7-05d92958a015", "value": 344632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675341045, "uuid": "c9cdcaf2-6db6-40d9-9c35-f782693191e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341045, "uuid": "35378b19-9b5d-4eb3-a564-7236294cd508", "value": "7e412e24b1323d22362a1d9a806704cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40adbf8-a30a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1675350188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350188, "uuid": "9205fd68-bbbd-42d8-91a7-7cc443b77d7c", "comment": "Malware payload (Chaos)", "value": "47e14a46326791625b67704d4329bed6", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350188, "uuid": "ac278a24-ada2-44c3-8969-f86faf3d99b4", "comment": "Malware payload (Chaos)", "value": "6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350188, "uuid": "1fdc515b-b533-475d-b299-4968a540949d", "comment": "Malware payload (Chaos)", "value": "01e0e607678a36d8e7e23d1fb11f8d7aa2c20581", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350188, "uuid": "cd6571b8-6912-4b4f-a5a9-3803b5e34deb", "comment": "Malware payload (Chaos)", "value": "bbc717e5bb8b0404fd88ed2f6bdd4060da1815a7c0bced605112b7f492ca9481865a7faed2d9a3e27ae43ad0806ef05d", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350188, "uuid": "9d2c31ab-7288-4fd4-b91f-d50c5a5216cb", "value": "T1A494F1342EFA501DF1B3EE7A4BE8759BD96EB773370394592091034A4623D42DDC2A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350188, "uuid": "06543674-6161-4258-8805-918bc702fe62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350188, "uuid": "74ea1832-a5ba-4d4c-a6ae-88debe049714", "value": "6144:cMr9/U806q0jnjCyc1rIGruapfd7ggZqLuID/pFZwVZ3j:a806qwjCycpIGRpfd8cqCITpFZwD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675350188, "uuid": "4cd19adc-d790-475b-a2a4-1a36008a7e1d", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675350188, "uuid": "0170482d-aa82-4966-8f2a-3bf174fb161f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350188, "uuid": "9fa95baf-7133-4b2c-8016-77c1f42d580b", "value": "2023-02-01_47e14a46326791625b67704d4329bed6_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64edd43-a350-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675380337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675380337, "uuid": "6f7940c7-c912-49e2-892c-06bd6151e66f", "comment": "Malware payload (NanoCore)", "value": "e01a14abc90acecb1fe2aba8d3adb71f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675380337, "uuid": "9526462e-e5af-468d-aa4d-dab133d3785c", "comment": "Malware payload (NanoCore)", "value": "646b292f7a79327604ddfdb0f535ee8d3832e46dc86a980986016fdba3d64627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675380337, "uuid": "808999d5-5300-41c9-8415-74b45f36d881", "comment": "Malware payload (NanoCore)", "value": "1dbe3b0d1e76eef6e1cd8c28e59a67b067eb6988", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675380337, "uuid": "3e1a1b1c-c678-44d6-bb9d-c9ccafc4eb56", "comment": "Malware payload (NanoCore)", "value": "4653563422cdf46a68a3370f822a8336961c8ec243a3c185e2a63035819d91dbae9efd4ef9181cc530544cc21c3f0106", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675380337, "uuid": "cb7a7d40-80e8-4699-9c52-87da69ef2428", "value": "T11F8412017718E795D38CA7F8AA74626C4371B6A81932F32F4C6B30E7D563BE2472185B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675380337, "uuid": "da408aa9-33f2-47a3-b7c0-d031f897ab03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675380337, "uuid": "96500893-5f3d-45f0-8576-c79fd352eef1", "value": "6144:f3g6+/BLtz4FIRvUHGNid8tWDBtfctKnKlNSyPOYFq4vCwg8D3ICNiz4ypR42:Y6+/BLtvkGCuYqKifOYnFg8TIuizB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675380337, "uuid": "af997dce-98c8-42c8-98cf-30884b973845", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675380337, "uuid": "0cfda8d6-2d9e-4799-b5e1-5a8729e8e883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675380337, "uuid": "f4bd7b80-6f06-422a-9060-874a2c537822", "value": "646B292F7A79327604DDFDB0F535EE8D3832E46DC86A9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609ed798-a2e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675332009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332009, "uuid": "2ec6d445-3382-4f77-bc2f-280084a0bc71", "comment": "Malware payload (RedLineStealer)", "value": "a2b0e27953e18f84f131b68845ae040a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332009, "uuid": "4f60743e-bdff-4636-bad6-6dea14ff8ab4", "comment": "Malware payload (RedLineStealer)", "value": "64ceea761d30bc6d34cfca690e12bb3397756598b684b28446d3c7767f0468ec", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332009, "uuid": "b30429c4-b5c3-41cf-a0a0-73750c2fc2d6", "comment": "Malware payload (RedLineStealer)", "value": "4958961105a49b0898713976208333fffcc2b3f0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332009, "uuid": "b5e4d0ec-8b3a-4c85-9860-0b8ebf9d7e37", "comment": "Malware payload (RedLineStealer)", "value": "551572c07ae5ba42c3472a4410ae8be1e0b746ae5c461bd73a8e9ad28859cce73b736d0155790861141e178c2249e034", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332009, "uuid": "e6d30368-6230-43d2-9464-cfd795c68a6e", "value": "T1CA64DF949A251970CE8A4EBB239F170FFB964D370130C45E74F4A6E007126BB6D7B26A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332009, "uuid": "bc57bf40-6102-41a1-9e2f-1d32f5cfb10a", "value": "6144:x+K5nT4YLJ+5GMT2O9L+qEik6G0yzwLE9yjd4fX+RlMx7s9fOuRKYb2:x+LYLJ+AMuh6Gd8EkjdIX+3Mx7DucYb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675332009, "uuid": "d115e261-d937-43eb-b954-f495be9d4ad5", "value": 330754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675332009, "uuid": "f9b841e1-75f0-4206-95be-3407eabd5003", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332009, "uuid": "64a11c7b-e445-45a7-b5d1-5720983b0b9a", "value": "Facturas Pagadas al Vencimiento.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcd7214-a330-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675366233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366233, "uuid": "7a76c292-7952-4434-90ff-7dd6b295616d", "comment": "Malware payload", "value": "84b52cce1d0d97b360e44d0399ec6645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366233, "uuid": "8362fabc-a2e2-4b3c-a2d3-2a53968f36b9", "comment": "Malware payload", "value": "65873ae35f6b64aba9882a16a5a9b886064bc34ab916fbb6f27e2f178b826f85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366233, "uuid": "dbc1dbd0-2af8-4d59-a9d2-8e29d79e3820", "comment": "Malware payload", "value": "0c9455c0845c5b1e1b6bdc9f54284f63000ed629", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366233, "uuid": "67b0e26b-7260-45d0-a273-6e19da30531b", "comment": "Malware payload", "value": "272b57198ed0baf5732e5617d8e8e8add805c60cfb2b4d1aa0f798a3d57ca0825d1f013bb11cc518a2631f0f0caeb04b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366233, "uuid": "eeb7341f-f1d9-4894-bddd-a86fec80dff3", "value": "T19C94BF13B2A1BD58D9368B728F2EE7E47A1FF9508E1837761214AF2F14713A1C963724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366233, "uuid": "0d27244a-78d1-4eec-8bb8-aabfe197cdb7", "value": "64f2017133017378e6738b9a4be235bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366233, "uuid": "322542f6-97a1-47e9-b946-f170a4a9dc5a", "value": "6144:Rra4L9U2SgkV9HYzlsS/21UBcXFeEia8tv9/CJTk637eQfnd58WB:Rra4C2zUUsS/LBIwZR9CJb7d58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675366233, "uuid": "19d025af-c764-41be-bf5e-9063899812f6", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675366233, "uuid": "aa1ca1f8-119f-40a1-90e3-ae525d042eac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366233, "uuid": "26726757-728d-447d-93dd-8fb167451da0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5460df6-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675337332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337332, "uuid": "672af2b4-5a8c-4ebc-8f18-bf88275ae593", "comment": "Malware payload (NanoCore)", "value": "0d6f726c3c2a4f6e82f0ede90ba88155", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337332, "uuid": "595a5012-03c2-43e5-be33-68e35fe82a0c", "comment": "Malware payload (NanoCore)", "value": "658c78c61ac43dc28e128cd71060b2c5ab03ed241cbcd32c5a0f5a09f081a574", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337332, "uuid": "26aeae35-8688-4df5-9cdd-ebc8428c7887", "comment": "Malware payload (NanoCore)", "value": "668eb996c241e10fb19c3a6ae5024309470be171", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337332, "uuid": "91db3a4e-2048-4f91-83e5-f2d5cebfcb46", "comment": "Malware payload (NanoCore)", "value": "6ac4e92e33ce8fd93633253310587a58c18a88b2662ae9bdfef73fa5f1cbac39dff22d5e7decaf18916ce698429969cd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337332, "uuid": "12e88b93-4b4d-4df1-a3af-ee7c41ef73de", "value": "T17C9412BEC91E8EC62B3D19E5B0682C162E5C4ED7563A42F0FD48504771FF210E9A6CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337332, "uuid": "3dc2ca00-83e6-4653-9a49-9dc84c175bc9", "value": "6144:BKWuoMfFEsrEGwfIWcvAoQlZPDhPvFPbr7zrdvBDHp+Nwsk/USGrtfy0nt:BKlV3EbqApDhPvFHDJ+NwpBort", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337332, "uuid": "32d68b66-a895-483f-b3e7-838b9436e9f5", "value": 427766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337332, "uuid": "c6fe49df-9c7e-4f3c-9b9d-11485ca339c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337332, "uuid": "2c7640b8-12bf-4c38-875a-2b102501ae2e", "value": "SWIFT MO104978172_1301 EURO 9700.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9f9a7f-a2f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675340195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340195, "uuid": "df498dda-96eb-4bbc-943d-6ded2a9806ee", "comment": "Malware payload (Formbook)", "value": "b2a5e99e7aab7e1ca3bee555b4753d78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340195, "uuid": "54f5bd46-9e77-4b75-a192-659dd6e2c3a7", "comment": "Malware payload (Formbook)", "value": "65f11a6c107a0d4f5c87193d2677b57abb3549f0342904c6248e7e61b7ecafe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340195, "uuid": "139234d8-8049-49fd-9b53-2539b58560e6", "comment": "Malware payload (Formbook)", "value": "617261030581bf54d9ad4fc2c7b8a297eb2ce9b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340195, "uuid": "c3b5d04d-8ec8-4768-a51e-7d806e8172cd", "comment": "Malware payload (Formbook)", "value": "4645fb887faf6b8e3b6940138c4fd3cb1e07ee8b3e443a643d3ebee28d6da2d3195442c1bb9f1c69201b87553dad0e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340195, "uuid": "5c158af8-2626-4aa5-ab3f-25593aa7996e", "value": "T14D84E089F94095A1EC1AA7712936DD325A037C3DA4B42A1C3BCE3E7B3FBB0639419553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340195, "uuid": "a4fb4874-db8b-4c97-8f87-f5a5ad8f5152", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340195, "uuid": "a7c206a8-94d6-4749-b90d-8352e9e0e4c4", "value": "6144:jYa6WIlMvVbgziBUr7VZzFL7zKCM4L38mhitFlkE8wDqfos+jwryI6:jYRlMvOzmUhLymL381FlqYwx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675340195, "uuid": "5c0146be-1e9a-431c-92dc-0705cbb9e674", "value": 394780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675340195, "uuid": "c1ca4063-9898-4774-817f-e0322470d8be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340195, "uuid": "4c4efdf5-10bc-438d-ad33-0c59e2f015a1", "value": "b2a5e99e7aab7e1ca3bee555b4753d78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d859410-a327-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675362444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362444, "uuid": "94652f75-f30b-4762-9e3d-991f84cda584", "comment": "Malware payload (RedLineStealer)", "value": "0b1acb4b5056b527aba9b2b8fe264f18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362444, "uuid": "cf4919c9-d2c9-427e-ba2f-0155ffcecdb2", "comment": "Malware payload (RedLineStealer)", "value": "660d50f7a98df33bd4a50f36197b7bc607017cc48847b236e5da75d25fba4d7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362444, "uuid": "c32dc52d-4dcb-488b-9e56-f71336f06796", "comment": "Malware payload (RedLineStealer)", "value": "b03eb17ba2b35270e1b644e62e5563415f56ff58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362444, "uuid": "1d1e5310-f059-489c-b6a0-30197cee5df8", "comment": "Malware payload (RedLineStealer)", "value": "204b73b716dc5cf6034692e406f8a1d966e6fc8a6b273f0c3e94482557d0975371a63b9544b79a7840e261321b288d4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362444, "uuid": "83c9d60b-bd2c-4970-b7b0-653547cbb71e", "value": "T117652341EBE99089FC7E17704F3781F4A53BBC64ACB4692F3549722A2A72307AD1135E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362444, "uuid": "35d1254f-25bb-4885-9776-6cd5fb0026f3", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362444, "uuid": "550c894e-08ee-41c8-abe5-999011ae401e", "value": "24576:HxUDkjRmWxWthoshQm6oavW2crM+Opo5AEhvPKRZxx+dqsLtsk7Usr+LCsd/:HFRmWxpm6osqO4jhvC/oPR7Pud/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362444, "uuid": "eaa90366-517c-48a4-b85a-09faf35bc703", "value": 1508864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362444, "uuid": "f185c3db-efc9-4e72-a5bf-60168f23ab60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362444, "uuid": "af5e893a-bb41-4d7e-8229-748edc5643a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370956b9-a2f6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675341388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341388, "uuid": "16edcda9-2daf-4239-8388-f7d94c6a3d43", "comment": "Malware payload", "value": "fa8f8430c0bf412784138ca285d6ada9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341388, "uuid": "de32728c-5d70-4291-b746-3281c1703b64", "comment": "Malware payload", "value": "666608980c541318f7bbb6634857aba071c9728c6a10e849f38df1ee6b078207", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341388, "uuid": "f063ec7b-bce2-42c5-9f6c-3043102bbb06", "comment": "Malware payload", "value": "5dbcfe25833ffe449690f884fa0281729ede9296", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341388, "uuid": "e775d3bf-8359-4200-b7a6-4c5cc75ceefd", "comment": "Malware payload", "value": "3cb6caf1fa38b52c2d584018bf4b57da8b045f3877e9a4fffdc20f4a4473859717591d3e008570ad98e6d173714b9ca2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341388, "uuid": "e8b7407c-790c-4131-8aa2-1370cf68a4d3", "value": "T1236412C97994E87FCC17D03A49598D948BA67677226FE293404362DA5C4FF1B8E1C0B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341388, "uuid": "1b0eb12e-71dd-4786-a387-eee5ad0f0473", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341388, "uuid": "9fe511b4-f203-4b9b-9ef2-4b5b768af7a1", "value": "6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675341388, "uuid": "d716c380-3621-4d05-bed7-75ece8131304", "value": 333417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675341388, "uuid": "9a370e5a-cf3d-47a5-835d-6116deaf3f4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341388, "uuid": "9f9bd5d4-f704-4942-a6d3-eb6d1901f7b5", "value": "fa8f8430c0bf412784138ca285d6ada9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6733a9e6-a2c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675321283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321283, "uuid": "5f572836-4183-4403-88f8-3b6628597252", "comment": "Malware payload (RedLineStealer)", "value": "6dd4fd70660fe4fd43fdcd316521dee4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321283, "uuid": "84f7ff9f-0a12-429d-83b9-7b9420d41197", "comment": "Malware payload (RedLineStealer)", "value": "66967d49e5d96c09737095adf9f655361955d4b41854662ced6cc2414f780db6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321283, "uuid": "efb76115-d5f2-4cba-bb93-a3dbc0b5c466", "comment": "Malware payload (RedLineStealer)", "value": "c1a01f8f0b2cf669528be357e97f7cd6cbab4a50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321283, "uuid": "a18a9f75-c50b-4898-aed3-fe32f7bac7fd", "comment": "Malware payload (RedLineStealer)", "value": "5af732d9aa12766ea89d298dd8f38a05f8ad8ea44edd74da888433f2e94219d0b8b70c41cd61dfd17096f6e40481bee4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321283, "uuid": "a086b856-c5e3-46cb-8182-9c3b285809ff", "value": "T15E74F13239D0C332C56300756924EA49BEBEF53109B99A8B774817AD8F707E1A33635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321283, "uuid": "18b13c53-7d35-4706-94bc-ebe7f2673cd7", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321283, "uuid": "990a4555-bc46-4d73-be91-bc97da6702da", "value": "6144:Op9kwLjqBtcvRRCg+WtuKQpfbHqzvDS0sFDGy5k6h6Mf:Op95fqBtWd+UuKQFbHqzvDwFPlHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675321283, "uuid": "fc40b0fa-d8b8-413a-9214-3186b4301792", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675321283, "uuid": "f328ac84-1a8a-49b1-a1d5-6165d9235ad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321283, "uuid": "e44c941e-eef8-4ae0-8f91-1bb0613d6318", "value": "6dd4fd70660fe4fd43fdcd316521dee4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5940d3-a324-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675361132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361132, "uuid": "3412619b-ffcd-4b60-9bd8-654a8786c892", "comment": "Malware payload", "value": "31bd7d296f1f28aa2c1fdc9fca367427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361132, "uuid": "7ed687f4-ab8c-48ca-924a-5d63a13b193e", "comment": "Malware payload", "value": "6772a67bf0602f8a5e64d900e0929e1dd48a6b7cba1e976c65ff6aff88ec3cb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361132, "uuid": "302914bb-5564-4520-ac0e-a2fb300cccbd", "comment": "Malware payload", "value": "9c3a9b4aa83801ecb8da4397e1b072b4cda9150d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361132, "uuid": "8ec3f31d-6cc1-48a7-a70d-56e9474e940c", "comment": "Malware payload", "value": "bf9cc9ac9e4e88679668c6d1916b6d785ad98faa2493342076854ebe2f8ca312d598fb72955d1ec98819905024de10b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361132, "uuid": "e431e277-3219-4f47-b0fa-456602e0d5e7", "value": "T12EB4F121B584C032E5A312314AE6EBA1297BBD215B2164C77B90B77E6FB42E1D778307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361132, "uuid": "fa256815-bd55-4de6-9cbc-4403907dea61", "value": "6dca3e9fb3928bbdb54dbce669943ec8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361132, "uuid": "7767c6f6-b46d-48c2-bf27-489f20c8218b", "value": "12288:UU5rCOTeiDEHgZXrg3CP4CbnCjSPyIuesKmCXHNZ:UUQOJDmqXrg3CP4FSPzuwJHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675361132, "uuid": "29025878-4509-487a-bba0-b59532fdb76c", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675361132, "uuid": "41cfdc1d-c0b2-4aeb-b1c9-29823baf5a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361132, "uuid": "642da994-a693-4945-bc38-2e1dcb8b29b4", "value": "WinWord.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f037dff7-a326-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675362315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362315, "uuid": "b70d082a-bf96-4c91-9157-c514ddf922e9", "comment": "Malware payload (RedLineStealer)", "value": "09e9d8ecda1f4d700d414df1558286c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362315, "uuid": "681dc768-6d99-4b0e-83cc-df4ddf1983b2", "comment": "Malware payload (RedLineStealer)", "value": "695c14d27171f9d8606571fad11404b5cbda354b1e17cb014e3e2d95fd77fa36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362315, "uuid": "a2263048-24b8-4b84-b4ee-0e89a4d8d850", "comment": "Malware payload (RedLineStealer)", "value": "18c7e17cffd1039b75bca327c5eb9bbbcf821500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362315, "uuid": "55f7e980-4918-4bcc-a522-45a884868e76", "comment": "Malware payload (RedLineStealer)", "value": "fcc32f0e45f261b516dd39b4936b92f636845423332566846a52f0bb6eb5b89ca1f11104a2b72a79cbd1b4fde150c674", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362315, "uuid": "3b449c60-efdf-4bd2-aa45-3e291f4ed2c9", "value": "T197649F02B2E1BC58D9328B728F1EE7E43A1FFD518E587776122CAA1F25701B1DD62325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362315, "uuid": "7514f5af-64a4-45c1-aad7-3aeae5026c63", "value": "64f2017133017378e6738b9a4be235bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362315, "uuid": "3d168ab9-44eb-4e02-9406-f07f5f516625", "value": "6144:XGQeLbKSd5bzcFyZTAr8dmV9/CJTk637eQfnd5KzMWB:XGQefKZFcTAr19CJb7d5OM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362315, "uuid": "ae01334e-0338-4178-832d-084962b1b2dd", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362315, "uuid": "d1ee132d-bb51-4ce6-b79c-36910a297096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362315, "uuid": "5bc169ed-3ae4-4305-998e-f441b8a903c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4593c07-a28c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675296045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296045, "uuid": "71b43f29-fc0b-4459-a04f-0374eac267c9", "comment": "Malware payload (Smoke Loader)", "value": "eb55d1c2832bb9a313dd20cc9b618677", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296045, "uuid": "6e05582f-fa54-4014-adec-c5058e67e6f1", "comment": "Malware payload (Smoke Loader)", "value": "6ac05f6986bc3620cddd96fe8d60bb21b88260d9e256b60884cc97f9792145a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296045, "uuid": "c2ebb75b-0534-4a01-8fae-709bbb46bfee", "comment": "Malware payload (Smoke Loader)", "value": "60523eba0fec6229b2e9616d3a236e85d670eb57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296045, "uuid": "403ba36b-64ef-4aa5-a902-a65d210694a8", "comment": "Malware payload (Smoke Loader)", "value": "581bd92c35b4cc6431f88b7dd9de74e538d12414faa9b04ff18791ff3b96a4b24c0b25ff1ed1f2cc639f34a29acb17b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296045, "uuid": "b8bf92ca-9853-468a-8f5b-49ed6e862cf5", "value": "T17334C0327590C0B2C56B51316C70EA917A7EA4720975591F7FA807AE9FB33C1273A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296045, "uuid": "542d3dca-ed73-49d4-be5f-e46677b31cd4", "value": "5b3e1365fd24e4232cba105b88665e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296045, "uuid": "d898915d-a248-4482-a605-d932415bbe5e", "value": "3072:oHTO2iUCnS4FaLbUWewdZr5N9WLeW9aAd0NwPTH81KkQMDdU9:ITLARwLbUbwd3WK8iNHQoO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675296045, "uuid": "87982d06-7fc9-495d-bc3d-c073566f2043", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675296045, "uuid": "1f9f4cc5-3bd9-4f17-a4ed-4f20437ce9ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296045, "uuid": "d8af9cef-c2b4-4fe4-82fa-ba546c6d3eaa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41605c11-a2c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675321219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321219, "uuid": "1430e9bd-35ce-4c44-aedf-835df5fbc62c", "comment": "Malware payload (RedLineStealer)", "value": "ad4534b97345680890953fd0ff0d068c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321219, "uuid": "4bfeb437-ed3f-43d9-b1d2-2fd640739541", "comment": "Malware payload (RedLineStealer)", "value": "6acee31b7d70a5d29bd227366ca6ff41aa3f40086fcb6cdac93181bbb4052bf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321219, "uuid": "53e3bdf5-90c9-457c-b73f-121011975b29", "comment": "Malware payload (RedLineStealer)", "value": "cb4978d1f7bd20f2b6ae882b8900dfd7d103e778", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321219, "uuid": "9c8ec519-255d-4e72-ae4d-2e0931dbeea9", "comment": "Malware payload (RedLineStealer)", "value": "f7bfc5f6b02cd43def95707f13de3c898bdc6ee407bdc540d5c2124c83cd37841bb9a4f432e7f64d09ac3d7c04b9f943", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321219, "uuid": "52420eb6-908a-4fa2-adaf-e7b3281d8386", "value": "T14894BF0273D0FC49E9318B718F1FE6E47A2FF9608E58777A9228AA1F15701F1C962725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321219, "uuid": "50dfe661-a072-4521-8f95-51704664ca61", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321219, "uuid": "5a716541-cd11-465e-988a-0a1569afd566", "value": "6144:F3L2WW59qiI1TC5Xkcr4A9SD9QlzhEvtmWM79/CJTk637eQfnd5P7giB:ZI58bAv4FD9rmJ9CJb7d5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675321219, "uuid": "8e68e1f0-e721-4c44-9b66-3e6880616683", "value": 427008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675321219, "uuid": "b78d6aae-ac95-43ed-b195-1415878d4b48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321219, "uuid": "a34e740b-eeeb-4238-a33d-b0998f1b0a85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e5e120-a2ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675338615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338615, "uuid": "3afd054f-a88b-42ce-9121-4abae133ec12", "comment": "Malware payload (DCRat)", "value": "dd32729dcf73c31a478099c25da5789c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338615, "uuid": "b14463f2-460f-4fad-af56-42eccd0719d4", "comment": "Malware payload (DCRat)", "value": "6aedcdfc3f6fdc1ca86554a6ba351d9dbccec6c0ab5a0aec82ef583a4e690f0e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338615, "uuid": "5b4a3ec8-103a-4ef3-89a0-705d8ebe4bc0", "comment": "Malware payload (DCRat)", "value": "dad05d17829936c6136d16962c38d2981e56bb21", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338615, "uuid": "d258b9f8-3eef-422d-80f8-2bed82c5d076", "comment": "Malware payload (DCRat)", "value": "453df5ec5c0bab91dd1723640c728a0dd84678b877398fd698a00abe1fe5df2b1f9176e971c06e23c6eff83c9c1c3b81", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338615, "uuid": "6de82cf1-d314-4e86-be0e-664c818dad75", "value": "T183653A027E46DD13C0291A37C9EF952547ACBD817B26DB2A7A9F335E60123A35D0E1CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338615, "uuid": "6a7c1242-94bd-4751-803b-ed8699824fe5", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338615, "uuid": "9543666e-ebc3-4b69-a5cf-644e63825367", "value": "24576:U2G/nvxW3Ww0tdGyavpdrgnar7l2odPdcsZHpa+AGO05d2GqXW+lWR++40:UbA30alr7tcsZHpaVwulmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675338615, "uuid": "7ed0a19d-a65f-4f80-a595-fdc3a485123f", "value": 1479882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675338615, "uuid": "9f91bd9b-f10b-4699-bed7-b890ec8aa4c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338615, "uuid": "0ea485cb-1b92-4631-b584-6480a0a427b7", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-6aedcdfc3f6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53aacc5-a2a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Downloader.Upatre)", "timestamp": 1675307723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307723, "uuid": "fd9fe8df-9ae4-4b9a-b950-6557dc6f04e7", "comment": "Malware payload (Downloader.Upatre)", "value": "d4e0f09f34c6a90100c932d83b11292a", "object_relation": "md5", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307723, "uuid": "fdf16cb0-fa1d-4709-9bfe-c11ca34c1430", "comment": "Malware payload (Downloader.Upatre)", "value": "6b53de90d4c71ace801f6208d6a38c6e59a7e5d50de83544b9ef7f20c5296de2", "object_relation": "sha256", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307723, "uuid": "a4963bc2-297f-4747-a032-59a4846192f6", "comment": "Malware payload (Downloader.Upatre)", "value": "ef87bbdcfc247dd48cd270de68702f7d0177554d", "object_relation": "sha1", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307723, "uuid": "3cf3fc49-0dc3-43e2-9337-84b16f11cd0b", "comment": "Malware payload (Downloader.Upatre)", "value": "9e6b8d83e1f10a63f719c4505977e87a83d08d73e90993bdba97604564bfe954f8ef0a856b35d2452525eef1488ab713", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307723, "uuid": "d801c591-61c9-4587-ad0c-b56b04bb472c", "value": "T15EA371F8ABD446B1E33FBD75C1B248CBA936702E7D01442D209AB229BD33BD19D6154E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307723, "uuid": "b4823df1-ccc8-4c0f-af38-10d43dd090e2", "value": "6f1148c8f00adfb7f71f0e0cb6af6ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307723, "uuid": "68710afd-28e4-4c44-be1c-db3b86a4b16a", "value": "768:UbNjs/1T6PPqi7DSlhVtQZsQ/TTiZT3OJhixp3ecnu:iNjs/ZlhVtWsQ/T2ZEE5eL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675307723, "uuid": "6ff0d1be-8ef7-4952-8025-79e7be91f89b", "value": 103806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675307723, "uuid": "ee4bf28b-c228-455c-9889-4100c421b82a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307723, "uuid": "da293d30-6bc5-4038-b894-9521bb803e87", "value": "up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496d757b-a2b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675313072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675313072, "uuid": "5305a98f-86fa-4c30-bdb8-6027205b72cd", "comment": "Malware payload (Rhadamanthys)", "value": "2aef309400415ab1504e45e992b12662", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675313072, "uuid": "d544654b-4c23-4421-97d9-4c634cd65e16", "comment": "Malware payload (Rhadamanthys)", "value": "6ba9982be86c9a4ce7af68b7d3b776e3d9698ffe0a94d603b51d1b2569a29c59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675313072, "uuid": "7970344a-a51d-4096-ba68-dbd95154324d", "comment": "Malware payload (Rhadamanthys)", "value": "037453f37c289589ada73ceeac8b2c53cb33daaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675313072, "uuid": "a107a00f-35f7-4789-abc5-b270c6bf8529", "comment": "Malware payload (Rhadamanthys)", "value": "f9350982a9ef9e7dd7a25f8a098976d766395bf9a64ba63abbd09bb8a4b6e542544c50786bc1b0b91a2d9ed45d7831b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675313072, "uuid": "e9d16e45-db7e-42dd-ad09-acb1af9af014", "value": "T10F444A7BBF58D865EC20663BCE634351F2EE58CC1251CE0B219B6850D5733F81BEA266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675313072, "uuid": "bbe6b41d-bb14-49db-9d37-feb0381d8d5b", "value": "933c3c1939cec1543334fac4d41f0119", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675313072, "uuid": "dd7ff448-37fa-491b-965b-86f1fdfe803a", "value": "3072:4xu5wEx6HYpOAplIulkqtCm4+r6oaRRjDJ8hX8L2zq/w+ziLQNkX8S:4xu5wEwH1nu+Dmf6jKBEz3A8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675313072, "uuid": "af11c797-9901-4ac7-885a-4855e28d99c2", "value": 270615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675313072, "uuid": "48ebc6af-9076-4922-94c5-77f534a7be6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675313072, "uuid": "a2b36f50-96e1-476f-a764-530a619d2f39", "value": "2aef309400415ab1504e45e992b12662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f043a04a-a2bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675317218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317218, "uuid": "efc4c0db-c3bc-43d8-8e7d-214e5467ba5a", "comment": "Malware payload (RedLineStealer)", "value": "4daf628da6f5b5702f4a00e81f0f20d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317218, "uuid": "77a70623-ffd3-4811-8ec7-b262c5d384bd", "comment": "Malware payload (RedLineStealer)", "value": "6c3a0bcf3bdc430a810c776661f9b8ae5b1ca4e7199e32304e310388109d82a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317218, "uuid": "433c0cfb-d1c2-4294-baab-19ee7b689f9a", "comment": "Malware payload (RedLineStealer)", "value": "152e6bfae2fc47f3e0de176b6c26906a989ba024", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317218, "uuid": "8e36cc8e-540c-4368-b920-dc9933fd8657", "comment": "Malware payload (RedLineStealer)", "value": "7307b40c558383990c0a2477c3fc7467e611c3ed23a2a34834e3df7517002f2df01db87f2438cb11488e66c3022015a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317218, "uuid": "3aab3c39-bfc8-4c4b-a6ee-0b11778cff48", "value": "T11C94BF82B2E0BC88F5358B71AF1EE7E4791FF9604E1877B61218AB1F18711E1C963725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317218, "uuid": "98834eab-45ae-4395-9f75-39e2bfc0b3b8", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317218, "uuid": "360f093c-e41b-4f83-9268-b483d14e3e7d", "value": "6144:2uLjOwNH9b90Nvr26uZYrl6wvZj+Djdr3Z+E7qokmXF9/CJTk637eQfnd5wIB:FFH26nwkr3ZpymXF9CJb7d5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675317218, "uuid": "3e8df46a-b206-4e9f-9a0e-668f1cc33216", "value": 427008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675317218, "uuid": "f69f84ee-9f7e-4151-ab33-217578bff753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317218, "uuid": "e8ad2826-0f76-4ac2-a3a5-3ae595d4d4e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55987c3-a2fb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675343774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675343774, "uuid": "99e80285-4a93-4dc8-b61b-ad6cbb106824", "comment": "Malware payload", "value": "dae18d93abf44c1f8175725df0ad57cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675343774, "uuid": "1a41371d-1734-4e4b-8324-336b07fa628d", "comment": "Malware payload", "value": "6d1c0a6c1419e55196e4847deec0b828fd5c74d594d06c9f5ba5ee2ae5c0eaa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675343774, "uuid": "e8163e9e-e202-4ed7-8cf7-e31ca212d2fc", "comment": "Malware payload", "value": "b39f2d0f74f92bd86326d56a6f1f5cb240345120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675343774, "uuid": "4a16f900-9473-44be-ac51-efcfdb0bf6ef", "comment": "Malware payload", "value": "76fcf5d654c4b2f831d8bfe60818b11c3f942515600521f22c100e440e25d899f654f9c810e4ee0cfc986302ace5696b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675343774, "uuid": "60ea8f97-7938-4633-99cf-148c2be549ff", "value": "T1A0A31F18A3EE5E23D96AD7781953F3322735CCA245A1D7071EC4AD973B1BB822E100F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675343774, "uuid": "bf54481b-3023-4299-9845-4d02caf1f874", "value": "768:FiKXNV7scqmxqdVPl1ZfiLXNbP5NbcVfup+btYAJHa4H:FlN1sF5dL1ZfOdrcVfupotYyTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675343774, "uuid": "a639bbd2-804f-4586-b3bd-5e38f354bb63", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675343774, "uuid": "9b635c79-f41d-4a74-b1c8-64e28d53f1f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675343774, "uuid": "87484860-b18f-41ac-9eef-2d5aeb671784", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0f24fc-a305-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675348056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348056, "uuid": "b8f72b3f-0262-46a6-ae22-7a429ae971aa", "comment": "Malware payload (AgentTesla)", "value": "8299775dc88e42710d2e8090142189f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348056, "uuid": "5ba147d8-9238-46c6-b4d1-d5f3b258ec5d", "comment": "Malware payload (AgentTesla)", "value": "6f1961dcfaced54164a7a91935ef591688c686ee9b4b6c091a02b8a3ee3778da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348056, "uuid": "95066cac-b503-4ecf-850c-f5fb15c146b3", "comment": "Malware payload (AgentTesla)", "value": "ed5161f8636f6c99dadcebed389a8dae7d28f2ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348056, "uuid": "01b4dbc9-240d-4b75-b60f-67721d2536bd", "comment": "Malware payload (AgentTesla)", "value": "a5f94c3554a1dc9aea3d89bd66759fb4f06d041cee7ddef02a5208feb2c568de5d2ac67f77493b932dd6cbb009d02e5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348056, "uuid": "8b6dd777-4e3b-40ea-a0ac-0e4bedd2aa2b", "value": "T177F48C8377F1A8B2FACB10A5142837CD2FE06103BE95E2579B7B79C0A7058FB7698151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348056, "uuid": "63436d48-72ea-44d0-824f-924626b41691", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348056, "uuid": "aa8db31e-142e-4d58-8f8c-97c21445401c", "value": "12288:itz8L6gu+xMRSR5S+bmF7YKqka8ARo7zDPQx/+KyDTl5K8IaFqG4yPa:jLzyRU5XCXa3IzzQUKyDX3IaFqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675348056, "uuid": "285c052f-e7a5-495a-82b2-7a84806fe136", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675348056, "uuid": "7d7cd3cc-ddca-4638-a018-707d4c30215a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348056, "uuid": "b82dd69e-f569-46a2-85d9-5643221fdd32", "value": "CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98f3568-a2e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675334762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334762, "uuid": "7b67949b-f1dc-4e48-8ef0-3e3dd80a7645", "comment": "Malware payload (GCleaner)", "value": "fa2d4e02adfd3aa4f0da8a47bc6bceea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334762, "uuid": "4aa3d548-f4ad-4eee-ba1b-eb309c63de37", "comment": "Malware payload (GCleaner)", "value": "6fccffdb4439fc5d3a0e1e3503595c337a4f57616b934fc2d620af23b73613a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334762, "uuid": "35349967-071e-4e63-9355-17bccffdb10e", "comment": "Malware payload (GCleaner)", "value": "b84352cc2dc85cb5d192abc3e482a9e10ad21cad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334762, "uuid": "b342400b-54dc-4619-8ab2-1bf7bca86f7b", "comment": "Malware payload (GCleaner)", "value": "906aa93966c049f5ddb314d362c9b3943c38f73a8e7a0c13b6f17a8b9c8577bda63cc63f3ec34d950750b56900bbf608", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334762, "uuid": "7d0ac3d8-a528-4089-a724-c5c73e08a11a", "value": "T1D4A5334AC1824937D362DB71912D420AFE77FDBEA830B40A624E515F2A37397EE14763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334762, "uuid": "b0ddaf85-ef5f-4186-a515-135aade7e2cb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334762, "uuid": "1a9e056a-0d51-40a3-b846-e1595af95569", "value": "49152:bgxVrbVoJAtWrVk9W7I9zFo38q9L8Bmyuwj18oOiQ0mLCgv2MR:c/uAtWy870Ujlm5w0Wv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675334762, "uuid": "a3b56231-c909-4c34-9c2e-99cf222bdfdf", "value": 2105994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675334762, "uuid": "3d4087a0-b767-4326-bc12-6fa0150e7a92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334762, "uuid": "5368f6f9-0bab-49b1-9f51-ff23924c7ecf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e17a19-a2bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675316880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675316880, "uuid": "b9f31389-c940-47c6-9046-8ed82d6a4df4", "comment": "Malware payload (Rhadamanthys)", "value": "52032f059d932ad85d7de814708b1d4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675316880, "uuid": "3da46c80-376f-44ef-a50c-f9a7a3f121ab", "comment": "Malware payload (Rhadamanthys)", "value": "70f55017e476683211c4e7caea2bb4301476decb9e2608df7f7dd10ff99adc35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675316880, "uuid": "8d6ae9f6-4679-4335-b7a9-cdb1362fe7b2", "comment": "Malware payload (Rhadamanthys)", "value": "f39cb847b97561f47b6e87a8e65faa817efcf118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675316880, "uuid": "16dc783e-39cb-4b91-b0bb-ad3c5a3a8249", "comment": "Malware payload (Rhadamanthys)", "value": "a52563816fc7d89b85a7f9eb7d6185ccb4affba8fc716f3893e469ad92457c062179f40c19c44f7cec801b5ff6f2df1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675316880, "uuid": "8ddb7cbd-c559-4bf5-8e4f-6b1151534de0", "value": "T1EF34C02234C0C072C5A71130DC30E695AB7EB9F15975595B7BA806AE9FF02E0673B39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675316880, "uuid": "aab1c25a-c33c-4aa0-b7a0-05ac0df8dabb", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675316880, "uuid": "72fcb191-59e1-4178-a663-ffcb0078d142", "value": "3072:6pcTryRL5UEILp/gWRd5Lzt4zSLH4GbV1GFNXGxso2oE0S4DUh:6p/CnLp/gMnt4zSLd5iXs2oBS40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675316880, "uuid": "8d31aee5-bb68-4c05-9807-a7f77ddd64c8", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675316880, "uuid": "bc47ca51-b9db-4a0e-9a5e-0a29fe59c957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675316880, "uuid": "09aaa632-0fd3-4632-943b-061df9a54a60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508d95cf-a306-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675348303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348303, "uuid": "29c14ad8-1e16-4135-b13a-b86d869b753e", "comment": "Malware payload (GCleaner)", "value": "76113178e953bc0523359b2cf610ccd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348303, "uuid": "8828ed1a-4abd-4f97-9ae9-ce1a778eec9f", "comment": "Malware payload (GCleaner)", "value": "712a7e0c6cbe2e3d672b1e5db2b7dc357a36506e0aba5498012d1e4d4f51731b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348303, "uuid": "3725cdeb-c34d-40ae-ab4d-b09ec152e88f", "comment": "Malware payload (GCleaner)", "value": "ee2f02cffd23cc2741584a333deadc28e5298e9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675348303, "uuid": "4dde0f2d-7dab-4e62-a49e-6b3008fcd6ae", "comment": "Malware payload (GCleaner)", "value": "7f05d736afc9d794a3cd7c9b643e64fe9050dbd1781de37272f84b48c2997ff40ada22a6a4320fa3f7caf4f608f35481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348303, "uuid": "168d5f88-3cff-45cd-a19a-6c04e1bd4807", "value": "T14AA53307E173C137C3E396B210746786AD31BADB3874A12874BE22DC9E3E3E86959714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348303, "uuid": "b1154a76-aaac-4f92-8ad1-ce4d5c795001", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348303, "uuid": "c0680c44-27e0-4e8c-b638-38d902ab784b", "value": "49152:bg2g5yA1n0D14skwQt9O2yJEYdPK+YrLCgv2MR:c/7+HkX8i7v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675348303, "uuid": "efb34e91-3681-4a3b-ac7e-44b28bc41ee3", "value": 2085853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675348303, "uuid": "266300a5-a0ab-4456-a181-20a5644e9cce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675348303, "uuid": "63e8a6da-ee0d-4eb0-9493-73eb332bfcd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257bd2d5-a302-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675346513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346513, "uuid": "138e3a05-8cd8-4e3d-986f-3d141718a8ed", "comment": "Malware payload (RemcosRAT)", "value": "90eb893c66efe4e796330b770c4d8d93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346513, "uuid": "97ab1e40-1d03-4377-8807-9323d7ae0e41", "comment": "Malware payload (RemcosRAT)", "value": "7255c52bd792b4078fb2bc5924259cc3becada28ea69afb76f26a7b2eb2f28cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346513, "uuid": "34263369-2691-45b1-b468-eb190e4a18d3", "comment": "Malware payload (RemcosRAT)", "value": "8922081a55722db249b05f132e1040d3c50d1354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346513, "uuid": "3670ebf8-0bf0-42ad-aab6-959d4d4f90d1", "comment": "Malware payload (RemcosRAT)", "value": "7b184473e0f70c64f1c0f13ea415401f3cb34c90783c1d79c1cf2742db7bab1b0158d252fb16e8f6bbe204155f69b9cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346513, "uuid": "0be46fa0-e4e0-408f-a254-3c14b25553d5", "value": "T1D6550103B78594B7D479173215A35B207EBDB9301BB68ADB5BA0452DBE323C0AF31B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346513, "uuid": "7f2b7e6d-2169-4502-a393-d5d0e9956ce3", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346513, "uuid": "ca1cdd53-c179-4af0-89e9-e056fbb21b93", "value": "24576:9TbBv5rUeTwPmcZScRR2O0nCmLNLIgiB5TGrC003Svlxi6K7nY:XBvws551xLIhzH3Svfi6KE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675346513, "uuid": "451852af-5cb2-4b86-aaad-ac461d8a1f07", "value": 1396932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675346513, "uuid": "702720ea-b8ba-4907-8329-c6397afed2e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346513, "uuid": "f3a6c2af-0879-4b8e-a654-22cb0fee6887", "value": "cdfdghgf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce36995-a29b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675302341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675302341, "uuid": "3d117db3-ad8b-41f5-adc5-af59a5356e63", "comment": "Malware payload (GCleaner)", "value": "df3d16f606a6dd53e354f0a1ebc65add", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675302341, "uuid": "712be31c-efa1-4e27-9cbc-b3a7103e1821", "comment": "Malware payload (GCleaner)", "value": "72efc3ca827711c128c90a926dd9b50535d1dad4b020464e2268936b2fb14a5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675302341, "uuid": "7bdc151b-18b2-4975-ab82-5214827b8086", "comment": "Malware payload (GCleaner)", "value": "881c6181ca75fea4a1b037b84195f42a3278938b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675302341, "uuid": "1cb8bbf6-de53-43da-b811-48021c5d2e15", "comment": "Malware payload (GCleaner)", "value": "e3c17f45c866eb19f48e35650ead4803c8d0f61cfbae47a8d84c8940dd6b3861b8e649cd48986bef5907163f2a695df3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675302341, "uuid": "c97a57ae-bafe-4ae4-8ed8-55905d16ee3e", "value": "T1BFA53356613A4D3BC1D2BBB57926D5609FBBAF043869821760E93C4F3ABF7431E0D242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675302341, "uuid": "afd3f021-c4f7-414c-9e46-97db2c87e57b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675302341, "uuid": "1ea2c289-b5fa-4447-a93e-22581045a206", "value": "49152:icPLnQTgwNkOV5o0byYLOhc/XtSLCgv2MR:XPLnQTBN3V2/OQv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675302341, "uuid": "1d3c218c-aae7-418d-beb9-b9fcdfd1927c", "value": 2178811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675302341, "uuid": "ef24bd96-ebdf-4463-920b-4ec6149592bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675302341, "uuid": "838bfd11-5526-49b5-a807-8d6bca0362cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1aa295-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1675337317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337317, "uuid": "a76f8979-94af-4368-ab2e-b85efac8065f", "comment": "Malware payload (Vjw0rm)", "value": "7afbb2051c1ba1c1e88c499c5e11636a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337317, "uuid": "3a94891e-a915-418f-a600-9a36bd1d048c", "comment": "Malware payload (Vjw0rm)", "value": "74fc83dc153086db0329b982e73e8bee4b652d1265c8185b0b4374898a112d06", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337317, "uuid": "d45fe54c-edf8-4433-80dc-262d96f3e2d7", "comment": "Malware payload (Vjw0rm)", "value": "4b2a14b3ca310b1f39959c130ae7b72a03078873", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337317, "uuid": "d7265c73-ad5e-4b66-8050-94ce59805aa9", "comment": "Malware payload (Vjw0rm)", "value": "9c16cea8e5feab2385dc17fdaba4411843dd23267da1968f0ea197192c6aaf407b1f0084523ee82fe684ce83d2870ca1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337317, "uuid": "75c3400d-6647-49cd-bfa2-5333c190b543", "value": "T136A3A4FCF1051F22D392615C89DE0A1873B2D361F1E9DF05666C760AC1EE92B538AEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337317, "uuid": "1f866f9d-8124-46e5-8f8d-adfa0730fbf0", "value": "384:chWWz5Kfy24jHueR45qWWxWBWHKSqmqR4G:XYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337317, "uuid": "0defdd79-f873-48de-a965-bb1bfb8b2465", "value": 100292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337317, "uuid": "ee0c1c5f-0070-41e0-8f00-634ab45847f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337317, "uuid": "3bb3379c-611a-41dc-8219-6fe78bf9b327", "value": "TG216_94_312_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3950c2-a325-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675361610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361610, "uuid": "2a3e0888-26d0-4ce3-b2e3-065069e79c99", "comment": "Malware payload", "value": "bb6bc81c780e514188c7f9e5ef6184fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361610, "uuid": "0b6fcee4-c83d-4962-b6da-b48c3983ccd3", "comment": "Malware payload", "value": "7543614c09c963292f44f62d302033a25be36956f3f4699bca5e3584e1a9ddd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361610, "uuid": "fded8608-b510-4e2d-9599-4b8fdcc7f49c", "comment": "Malware payload", "value": "ccd9d6043203a379859bab5a562a4578458d8a10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361610, "uuid": "a43da50c-018b-4df9-95da-2ea1bd2dcd54", "comment": "Malware payload", "value": "95e151cd5664073d85ab0fc0f7c787f2faa51f561d53f92a0a76786c293a48b18f617219f9ed1e0c9633df58bf51e987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361610, "uuid": "495b626e-3f14-46ea-a83b-00ae9068328b", "value": "T144D2CF2673E84730C8CD47B409318366DB7193330A66FB6DAD8354DF9D869D28193BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361610, "uuid": "3c06360d-cf02-4a1a-a3e2-6ef1bc400cbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361610, "uuid": "b8b1a5a0-46d0-44ab-988a-018282093274", "value": "768:xjyLtI1TWoY2+ix6IVyEpm76du1P2d9AK:xjyJgIa6IVZprOud9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675361610, "uuid": "68072bb8-39d5-4856-8d99-07338263bf15", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675361610, "uuid": "fd342502-1c0b-4aed-8505-ec6ef325a386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361610, "uuid": "d7ec58b4-19bc-4cee-b837-93d8a6de2ce2", "value": "cch%%hsr%.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216610a4-a2d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675326749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326749, "uuid": "d23647f7-f0d2-4f10-b263-88e9daa6d168", "comment": "Malware payload (RedLineStealer)", "value": "e6e3ec21cb0099173bd22ad1252a062f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326749, "uuid": "24e62021-2b18-4a2c-9909-7f21618be939", "comment": "Malware payload (RedLineStealer)", "value": "755cee37572cd6adec4750735f2a6fd9cdb15dcf3c988d49771a1f5772b51705", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326749, "uuid": "6cc3e76d-5cb0-4230-84a9-6424d3b3a198", "comment": "Malware payload (RedLineStealer)", "value": "339a4facb7161d4c6ce5540450d253f89a86f59e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326749, "uuid": "c382e371-9311-4b91-a657-db227dd1fb8e", "comment": "Malware payload (RedLineStealer)", "value": "623c30b9d1956fbcf670c502d58a954b248a6fc9c5b89a567453372b7a5753d4bcc17fa80584d520a58ee2accacf505c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326749, "uuid": "cdd3ebaf-fa91-405e-a44c-0ce8c353e291", "value": "T12194BF037290BC48E5318BB2DF1EE7E4791FF9508E4967BE1224AE1F18721F1C9627A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326749, "uuid": "c946399b-2ef0-4cb4-ac5c-0a7ad6f38eff", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326749, "uuid": "aab0d54d-3110-4ca1-9e8a-01ec0bc57fdb", "value": "6144:sDLp6CR98RaJkvBkyxFwGiTuRCe4AThNOg3uALpG/db9/CJTk637eQfnd53B:CjRySQE6TX3xG/db9CJb7d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675326749, "uuid": "484334e4-2f3c-440f-987a-7d2e9a0e4ba2", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675326749, "uuid": "88d50180-045b-4f6a-b325-397b3ea1f254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326749, "uuid": "59ae5110-9040-4313-997f-30c85129d67e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4626d154-a330-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675366324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366324, "uuid": "3a79a319-e6c4-4182-9865-b3d3f16c96f7", "comment": "Malware payload (SnakeKeylogger)", "value": "3064726b643cf933c803d572ae56e925", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366324, "uuid": "3627b477-9ff2-4d01-a458-7d4ec8ad9dd3", "comment": "Malware payload (SnakeKeylogger)", "value": "7637a06005c3e90cedae65054c0458d02a66865e1f91c61b5b7ba1ccf3303587", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366324, "uuid": "1c61c1ec-d7f2-4e7c-bd02-a7301f71090d", "comment": "Malware payload (SnakeKeylogger)", "value": "af73eee09bfe11fe8475aec38d7742215432b063", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366324, "uuid": "a5cff8be-40ff-4b78-b90c-ee75ae1cd8e7", "comment": "Malware payload (SnakeKeylogger)", "value": "d5d919d81aed496b302bb2b4d7dff64f3e59bffd33951079593ecab6214fc0dc3278e8c0205b59c0fb2d9c181deec3c3", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366324, "uuid": "1039d3d8-081a-42a9-8775-327f3ea33e6a", "value": "T14AF433BE8064CBC3FD2784114C92A610B96A01E889B5D8AF89B1D35EF3DC6D8F15537B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366324, "uuid": "aa1651a3-8dfc-435c-8ff8-858653481a5a", "value": "12288:8BqIS1W2v1XJGMO40rS85YZ/457cqCkvfqfuppdOBWtrWbJn/tz+219iiULFc/zf:8lSH1Xw5rt5XcqCkvCfuppdtV0VFr/hz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675366324, "uuid": "05851859-be57-450c-9630-c4218596ccf3", "value": 736278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675366324, "uuid": "7c7032a8-dfca-4d84-a440-e876dee78562", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366324, "uuid": "19d8a101-b30c-4c32-aacd-8d6766417ae1", "value": "MOQ-10356-507.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213fd323-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675337057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337057, "uuid": "249d7f25-c9d7-4822-b34d-16ab2e740f42", "comment": "Malware payload (SnakeKeylogger)", "value": "cf1450682fba5e9ea2d70ee275061f25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337057, "uuid": "a32c4453-0597-4a1f-a5e0-1f811623d772", "comment": "Malware payload (SnakeKeylogger)", "value": "77bcae42d672dde3c6cf251c8976276dc1d38ef8891f7a1a3b8e3e699ea3890e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337057, "uuid": "32969624-db70-40ff-9707-383903552734", "comment": "Malware payload (SnakeKeylogger)", "value": "5e51d9fed361d4a7b073abc84e8918048bb9749e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337057, "uuid": "6906f773-1615-4543-95da-a3ea54c93bf7", "comment": "Malware payload (SnakeKeylogger)", "value": "12efea7cb72428ff668f50b21ba3b1c01a5889cbedbd142b334f3d75db3a84e547de4eeb22d07c716cb1ff9a49fba38a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337057, "uuid": "ac44e451-880b-4b06-baa0-a9b62fdd13fc", "value": "T132F44A4137F19462F1DB05B91028768C2E3D7403A6E6E2665BBB39C49703AFBF694F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337057, "uuid": "c87d3721-8e8c-494e-bb44-3124c97b56de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337057, "uuid": "04ac9a51-ef04-417c-b63b-dfca4006a3b2", "value": "12288:DeuaAr8VS7he3lEML+ZLOeWgMpLBzuPeExYsp4M8tOQh5AajvR9i7+pv5c4N34:DeuaAr8MVe3l7rNCPe5sSEciarRw6R5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337057, "uuid": "961f9658-4a86-45e5-b6b7-158804af3e22", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337057, "uuid": "a8baf6ee-12b9-4221-bdba-1275e636b194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337057, "uuid": "5cffbadc-68f0-4414-b519-3273a4c71997", "value": "\u8be2\u4ef7jan2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e99a916-a2d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675326369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326369, "uuid": "3829c59a-4fc5-4cdc-8f18-ef4686c0a6db", "comment": "Malware payload (SnakeKeylogger)", "value": "d60336a8f28b18eb93b2e2397363eb48", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326369, "uuid": "cfc57efb-2ae2-42fe-b33b-2f3055d7f2ca", "comment": "Malware payload (SnakeKeylogger)", "value": "7806f26df3fb3833888d7842e5faf01952a7d01c836d286f063da2741a8dcf5b", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326369, "uuid": "63c4eb62-f891-41f4-a0b0-f1b49c219e72", "comment": "Malware payload (SnakeKeylogger)", "value": "897e4a754b528524a77b397bbd08be27ebbb4645", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326369, "uuid": "40032f9c-ae19-43a7-9fb2-f55973c177bc", "comment": "Malware payload (SnakeKeylogger)", "value": "861c3df10733e1f8e49c3a42cdd80b5891131b204d86f48ad9edfda47aa2d876ddd6e3377fcfc2d3efd86b56f2b082ff", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326369, "uuid": "fc9d16ec-0006-4cef-8372-48f215b79c4a", "value": "T12CC4231E51C4D0092C6CCF032C6E6FDB649EDF2C73E9C739E11E0A1997AA0EB25D2691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326369, "uuid": "962b2e6c-7389-4a36-8fcd-e2f2a0c3dbd5", "value": "12288:9Ba98l6AU9I2Deq3FIhbcKZTULvLalIdVnwgLYvj0fMR8RTPbx:9BFl12CEIVcsTULvLHdbLEQkRiDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675326369, "uuid": "7cd61537-52bb-4d58-8114-579f950addb4", "value": 596582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675326369, "uuid": "e03b98d0-f894-4329-aceb-731452e54a95", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326369, "uuid": "74fbc3f9-137c-4e38-a8d3-02252d2583f5", "value": "Paymentinvoice Confirmation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7711dbda-a2f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675342355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342355, "uuid": "9970a94e-c1f9-4ef1-8d46-80f38afbee28", "comment": "Malware payload (DCRat)", "value": "5a85456927d17627968250e487d8f714", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342355, "uuid": "4b23449e-31aa-492d-a1b5-66f71cca2fd8", "comment": "Malware payload (DCRat)", "value": "7839eb36f7eed422a53caef155ec171e4e75c2c8cf918432dcc933dda4241bcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342355, "uuid": "9c183753-f61e-468c-83e3-9e6767200f5b", "comment": "Malware payload (DCRat)", "value": "21f6936933c7651e37c56f5986c889c33872af5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342355, "uuid": "b07a88b0-8db4-49c6-8b79-1902ae7ffa84", "comment": "Malware payload (DCRat)", "value": "bef0b44ec767be30d254d59585a31632086edc41e490b84da6a4640a8ec3a5f253e1ba344eb60a549303e364460593b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342355, "uuid": "c476f83a-5101-4d88-a1a9-00de01a253eb", "value": "T192557C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342355, "uuid": "2b4506d8-31e9-42bf-9ec1-9f9ec59aed22", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342355, "uuid": "264214a3-28e5-4cf4-8cdd-60160d923a10", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675342355, "uuid": "c368fc3b-8250-4b36-b0cb-b1d7f1497661", "value": 1407112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675342355, "uuid": "808bccd1-d928-4248-9834-9aee79125401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342355, "uuid": "f4f62751-b929-45b3-aa2d-1e678d314eb5", "value": "5a85456927d17627968250e487d8f714", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5aeb7f-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675337045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337045, "uuid": "3035aa1b-af2d-46ba-ac20-c5fe50550eab", "comment": "Malware payload (SnakeKeylogger)", "value": "61dc0af4e2df1e0439e426974de3d7ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337045, "uuid": "caf42aef-e322-4c6c-b52d-111183b4248d", "comment": "Malware payload (SnakeKeylogger)", "value": "783ec43af8cc12fd64dce2cfb6080ea9c8a5b356cf87e9778d6d86a94e9d6d6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337045, "uuid": "2221809f-54f4-489d-aab6-bcb5a6164c80", "comment": "Malware payload (SnakeKeylogger)", "value": "77cc5f4fc450cce60a96da36431e340fc268d306", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337045, "uuid": "3843550d-9bc7-4ba9-a62c-ea19b066b493", "comment": "Malware payload (SnakeKeylogger)", "value": "0c3154b829a0219fd13ce0f50e02f7228739cd18e4fec9a9863a767f564e90da41c469c7cde1e491d05d74b3c842cc8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337045, "uuid": "076c0085-792e-46be-a765-63284ef073fb", "value": "T1E1E49EBB2440DDDCCF6D87F3621AC081239AACBE852CD6897F9633D24BE1B554C92647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337045, "uuid": "e806899a-0047-4866-85cd-cb8a3793207d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337045, "uuid": "2411791d-2eb6-4181-bf2b-5fe061e15014", "value": "12288:sgFDutOc6duxKLoCV610ianvXmHR6LSC3iEtD5/uDGuTLNQyMtZoId7Esfozv6nB:36jank6/5EGuTOtZoId7H46nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337045, "uuid": "480cc572-dd91-4bec-84d7-ca6937988836", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337045, "uuid": "4abe69e2-d27a-43dd-9ac2-11adfc226f9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337045, "uuid": "3547f0ea-78e0-4bfc-828a-be5a26eb0cd9", "value": "PO Request Offer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876a6007-a2cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675323055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675323055, "uuid": "3c986d1e-9df5-4492-9a49-4b8b003cdecd", "comment": "Malware payload (Quakbot)", "value": "e4780cca4c2ab22c55c01d36b620c955", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675323055, "uuid": "7a75d0a0-a9ef-4e77-ac6e-ab537a1ab0db", "comment": "Malware payload (Quakbot)", "value": "78632bbb0a21acb272a6238c54434b3df1e89bf95104a2ea6f0a7c880acf0d13", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675323055, "uuid": "4f125b55-b3d8-4a4a-bee9-7ac108aa281a", "comment": "Malware payload (Quakbot)", "value": "68606cfce4bc962afbe22606c7ba6c4c87430983", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675323055, "uuid": "63f32303-3c97-4336-a268-dd917de1a113", "comment": "Malware payload (Quakbot)", "value": "602cc7ab3358ae5be4b176a82317248e74b5077da33537c2bcd1e70e87011757623b344465f1b9ba7c9e81a6bcebdaa2", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675323055, "uuid": "59d558ee-8315-46c1-9d4a-0124b44bd704", "value": "T12404E11226F545E5DEE47BB24DE3971DAA2BBE27E212035F4BB66A1D8D60310DC0470F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675323055, "uuid": "6b02c291-b1d4-40e1-af7b-8398f21b8416", "value": "3072:iaA0YRw9/WITtTWR7IbNzvL1aCbYCuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCG:Ia9xytedL13Ew4iERB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675323055, "uuid": "86b6d43d-1a4a-4a6f-a895-1c4ea0a711d6", "value": 176248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675323055, "uuid": "f8183160-7a35-41e3-b786-5a9969fcda14", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675323055, "uuid": "36c4e452-fada-4ebf-b7f9-6c7df3e88766", "value": "ComplaintCopy_71881(Feb01).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76e64c5-a2f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675339993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339993, "uuid": "5a77d00e-756b-4f52-8e06-7ace79ed66eb", "comment": "Malware payload (Formbook)", "value": "18769957091b957068ce6a614ca2b84d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339993, "uuid": "2c2b5a4e-acd0-4db4-8eab-a3a80e10d133", "comment": "Malware payload (Formbook)", "value": "78ec1f0df89f01bef78e2b508a8980f38fffc556387be3972ace6758f0441da6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339993, "uuid": "a52772d7-47f9-4d0d-864b-b48355f2cb96", "comment": "Malware payload (Formbook)", "value": "04c27e77914b32dbc30557afe3ad80072985823a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339993, "uuid": "88fa975b-5d7d-4e66-95a4-d222a1b5378d", "comment": "Malware payload (Formbook)", "value": "b40903944dc32b132a161946bffcd206ed5c3da82f43e44cdbdce331c55db8775bf93a99be399a6c50e22f9c96b5cd53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339993, "uuid": "510caa67-d647-4f35-850e-a7928abeca7f", "value": "T131158E8737B1A8BFF68B407154283F886FA07103BF56A25397377AC49B098FBB694151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339993, "uuid": "0b0d616f-34e9-4780-9866-7d9ef043a50b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339993, "uuid": "ba421242-c3da-4aa3-a27e-6e856a6e0b8d", "value": "12288:QnBaJmi3raEG0hZ6Rsp86PadT6K5rT5jszFyu6Fy2Mxzo3pqG4yPa2skEnXN44:QnglhZJp+2KBT5jszh6F0xMpqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675339993, "uuid": "02c88966-bdc6-4652-89a6-66dc54821361", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675339993, "uuid": "c207fb55-c81a-4957-a6a5-1d9264d9ccf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339993, "uuid": "096cbb4b-1207-4580-b0b2-04433038e6e2", "value": "18769957091b957068ce6a614ca2b84d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdeeb0a-a30a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675349934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349934, "uuid": "d03c41da-5bf5-488b-8bbb-46c56e91dd17", "comment": "Malware payload", "value": "0d4090b11f98adca793547a749213a64", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349934, "uuid": "3c2a0bb4-10e2-44c5-80a9-122afb8e0631", "comment": "Malware payload", "value": "7a21e3d14c5bae2e57469c344e234503bf5a5b0dea090039d881415989a7d81e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349934, "uuid": "d70fd25d-f6a1-4ec1-bda8-b7737b5a9ed6", "comment": "Malware payload", "value": "c0cff8665970d3892400f60aaab5b825ce6d0456", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349934, "uuid": "18332354-e087-4ac0-9116-71ed6039d2dc", "comment": "Malware payload", "value": "15429ba3797f9a90ddda435f18a01134126edfbcbe3b60a6cd265f8022df8e9d942195e0e6cabe00292cfaefdc5ed635", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349934, "uuid": "3f6fc860-c445-42f6-bb85-73dd45565ab6", "value": "T1F5F3233050B7DFBC84BA2CBE44F552748E2F9DD640113204A93A6B3F4A29F526E190EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349934, "uuid": "55977fc2-3469-4fdb-a246-0defea68d428", "value": "3072:6h4x/3je9YLhD0AxB/u8vuS40/vX+W4Eq/YOcMJwcEBYhAsDW0r/:6ix/zDpjxBH4W5q/YOcNcyKBbr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675349934, "uuid": "3c00606a-3751-4546-8994-e323489ec0cd", "value": 172791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675349934, "uuid": "d9d47432-4472-40b3-8b83-f8efc9ccba8b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349934, "uuid": "0f997815-492b-465c-bd12-521dbeb97739", "value": "8972952545.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcbfd6ea-a32d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675365342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675365342, "uuid": "d68a3a0a-d067-4631-a1fc-04be164cdef4", "comment": "Malware payload", "value": "558da264c83bfe58c1fc56171c90c093", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "toxicnetarmy", "colour": "#2DF4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675365342, "uuid": "8fb317ee-6361-4f38-b9d7-5603c9e46a52", "comment": "Malware payload", "value": "7b96da9c88b9ad7a56fdc220c0a68a196f8ce46e2247cd1c6cc26d6a4f12f870", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "toxicnetarmy", "colour": "#2DF4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675365342, "uuid": "00264599-d4c7-4684-b24d-22fdc195173a", "comment": "Malware payload", "value": "5e7216bb407cb7e0aa5a932ceefbd27986df6e08", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "toxicnetarmy", "colour": "#2DF4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675365342, "uuid": "24ab233e-853a-48a9-987e-4f80407bff3c", "comment": "Malware payload", "value": "7a34ee052f8fd1331a3f48a873b275ab84d948f52766c0d5d0bec287d1be316c3a5c067c58db23660459776aa0294527", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "toxicnetarmy", "colour": "#2DF4FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675365342, "uuid": "95176208-db96-4e79-8d40-6e285e9923e3", "value": "T19C516A3D2111D98DADB3AA3BFCA8BF245059EF63DDD077C80435845B26E15B5720839B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675365342, "uuid": "1aa96ea8-7ddc-4a85-98c8-4dac78acb212", "value": "48:sahoFeaqqsfrZJA3uOKNnSgieUfkHySgdS33qI8hsxZhJ9r9nHutF7:saeeND39SZSF9d5H8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675365342, "uuid": "d6e6a106-1b27-4cf7-ac04-ea9b09f22d27", "value": 2509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675365342, "uuid": "b0b40bb1-3254-441b-ac35-cafe06cc07fc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675365342, "uuid": "8d50a8da-cae1-4e6c-9d65-f761b8da5ee0", "value": "dump5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170b8723-a330-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675366245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366245, "uuid": "94199af7-16f7-43b2-8960-e06432a8bfdf", "comment": "Malware payload (Smoke Loader)", "value": "4936831157218397ece7fcee89d604b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366245, "uuid": "ce8677fb-899e-4a7c-bcd5-ace7476f3094", "comment": "Malware payload (Smoke Loader)", "value": "7c00573505ee69bef99968a44671ebfbf7cfbb6990771e3f9e55dc29aadf636c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366245, "uuid": "3a941569-ec10-4b41-a676-e98dfb2d5231", "comment": "Malware payload (Smoke Loader)", "value": "12a0f2db2f9081ac2352f63b06b5d6145784acbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366245, "uuid": "3e01d295-6f19-4f49-82ae-94cd2b8caa6e", "comment": "Malware payload (Smoke Loader)", "value": "28480a674506470f4efa8b5949a0dc6b393789383b672c5596eac33930970605f3b7e563087a8996ac61dde72ab1dace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366245, "uuid": "947b0524-eab7-4dab-be94-5af20c672228", "value": "T171649F06F3A0BC58E5328B718F1EE7E47A2FFD508E5937761224AB1F15701A1C96232D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366245, "uuid": "9f311f68-cbe1-4093-b67d-cc0e5c5f14d7", "value": "64f2017133017378e6738b9a4be235bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366245, "uuid": "09a0048d-f2e2-4c04-9b8b-8a83a0ced7d2", "value": "6144:WWvDLtBSVPkYgqH6Lh9HqSYHz99/CJTk637eQfnd51O3fSWB:WWvDZBSHTrHz99CJb7d51KfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675366245, "uuid": "27970d66-b2d5-44b3-8189-addd1ebba48b", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675366245, "uuid": "846e66f5-62c5-48bb-ac80-01e31bc8ac54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366245, "uuid": "bdd50b8b-4f66-430d-8a59-7778369a8107", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175938e0-a2ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675310411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675310411, "uuid": "3d5ba815-f5f0-4b11-8457-590a6f00909a", "comment": "Malware payload (RedLineStealer)", "value": "59d355a010d4a27f4bb62b3c9474a672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675310411, "uuid": "c6ccb52c-56cc-4cbc-a8ae-073a8a9ebbba", "comment": "Malware payload (RedLineStealer)", "value": "7c1cfee715bf004eff0037c113e231562190f3db48282bda0ca6d06ca65c5387", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675310411, "uuid": "a44a5c0a-419d-4186-b4f7-1edc6eb601e0", "comment": "Malware payload (RedLineStealer)", "value": "f14d8046d1917de7678aab330ad652e903fbae24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675310411, "uuid": "0161e6e7-4298-4f65-b952-cc1b9e21bc09", "comment": "Malware payload (RedLineStealer)", "value": "05d01be2bf009c35364ef49a1bb237d8dedb7bced83332f2e8c7922621eca627864e28362d21a0118ee48778a043f380", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675310411, "uuid": "83880be9-d93c-4481-9878-67f65c288654", "value": "T1A6740132B9D0D031C5AA10305864E7A5FBBEB5301E38546777582AEE9F306E1A33A34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675310411, "uuid": "5eb65757-917e-4f61-8006-09afd4ff3639", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675310411, "uuid": "87c773ff-9db7-419d-b6c0-4be313b5828a", "value": "6144:JpLFUkLi8YvxwC3l1jDKdbfz4ccPJGyscc5r:JpLHO8Yvxn3l1jDYYcQGyzcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675310411, "uuid": "13453b5d-ef6a-48e8-a64a-14a9d1d6f9f6", "value": 340480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675310411, "uuid": "f9156785-e506-47e7-9b09-c1fdf2dc16ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675310411, "uuid": "94f33c26-00f7-4312-9742-a7d63a39b4b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02bbac3b-a2c4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675319826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319826, "uuid": "e7e1aeba-1834-436f-9b92-188e86882f6e", "comment": "Malware payload", "value": "53f1a63bcf7a8ad3f092419ac1d359d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319826, "uuid": "19752e9e-bf40-443c-b24e-513147386730", "comment": "Malware payload", "value": "7c29f23f83ed808cac396c558a781faa45ad3986cfb6ec73f980f474b3ea7b93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319826, "uuid": "11fff2ba-8d09-45cd-934d-1d1c309ada32", "comment": "Malware payload", "value": "22a41e0633cab0ec9ada8abfaa4eedceda24544f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319826, "uuid": "57fc5a9e-4ab9-45c6-aa8e-13b6f2ca5623", "comment": "Malware payload", "value": "6ac9f56c179663e9fee3b21d5cbfcaf0ced4e51aedb949ff833682ed263e0dc54e522522cd4240fc5d7abb7a4d7beccf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319826, "uuid": "a70f0041-343f-440b-bb86-fbb8567e8b0b", "value": "T1CED48115ABF50726F2F74E30A86A9958FC32BC52BE00C39A1689464C0D66F51DD72F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319826, "uuid": "676cc6e4-25e6-4ef5-8ea9-4b1087f4c4eb", "value": "d8b32e731e5438c6329455786e51ab4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319826, "uuid": "757b2e3d-a4e7-4024-80c1-b9c369cffc1e", "value": "3072:MGjhaq5iL0beJQZt32wLji5DlsODxRPNDkjJHzW9hUd56JsuBSjw75W6vfH2i1wV:Hha8iAx+1zwjJHd6vB/75W6XmVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675319826, "uuid": "806102ae-ab08-4bf2-98c0-420a13c4d586", "value": 641263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675319826, "uuid": "d22b8d8b-74ef-44b1-b0d5-617848b446a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319826, "uuid": "8c320b8f-1cb3-49cd-b25a-47899d18d579", "value": "ocean.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619337b5-a2e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675332011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332011, "uuid": "34d0f3fe-5bee-4e2a-a8ab-16b43727b531", "comment": "Malware payload (AgentTesla)", "value": "d5f655c18e77f7d4dc38b04bf81f10df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332011, "uuid": "3a013a62-ffac-4fe7-b416-73d089980758", "comment": "Malware payload (AgentTesla)", "value": "7d65d55e566e6833b59107fe3cdfc837a922a1f83ec41f009365b18645427f26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332011, "uuid": "83c8ca9e-ca2b-4f4e-b9df-936a03f5cf05", "comment": "Malware payload (AgentTesla)", "value": "c7bc5dfdec5077713bc6e5fc8b45f20db32a3d9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332011, "uuid": "59c1761f-4844-47d7-9c2e-a14041a18c3c", "comment": "Malware payload (AgentTesla)", "value": "52714a90a533cc62a367eac733556166116b2c887531a2173a857f3e82d505203493c3f4754a3feca00137057b9a6dd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332011, "uuid": "180b53b9-e7a7-4aa8-9e7d-aedbbc5afa66", "value": "T12275B06415E60938DE396E7F2AF1A3878F967412213DC1DFF430B533A540A670CEDA9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332011, "uuid": "df890c75-be0f-4e73-a761-66871117bf50", "value": "eb55e8383c5574f7ad2db6dad2bf9e8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332011, "uuid": "2fc42f29-3a6c-4ec5-aca2-842ad034106f", "value": "49152:dxYtuXBU56+dt4s57ICyvxrSlI3Hm7zp7T54:gtuqrdKsB0SS36p76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675332011, "uuid": "7b1c54d1-bb0d-4c7b-8640-96a714289a6b", "value": 1672344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675332011, "uuid": "c7174d0d-624e-4e96-b4ce-af9b27e1ebd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332011, "uuid": "ec91a617-6c8c-4bbe-ba07-c6382ec831c1", "value": "DHL Original Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83eac18e-a30b-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675350537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350537, "uuid": "2d597e5b-f392-40f2-b13f-a2089c5a6bfa", "comment": "Malware payload (PureCrypter)", "value": "a40459f1f741836d46666ce9b97a191c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350537, "uuid": "f7fd3500-c6ab-4403-bc6e-7317d69c6ae3", "comment": "Malware payload (PureCrypter)", "value": "7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350537, "uuid": "297588c0-aa34-4963-8058-50669b3f67bb", "comment": "Malware payload (PureCrypter)", "value": "2bc5fad1d7906cca69973978854c55631bdf5513", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350537, "uuid": "9986568e-745e-47e8-8084-d54243009476", "comment": "Malware payload (PureCrypter)", "value": "b964c683f84684b397f2859662e1b1e4535ce965ac92dd1e17bf42e1416e48751def8a4745c81e096ce2f1306bf91ca1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350537, "uuid": "93bedd19-692b-4791-a105-2b80a2d6fc05", "value": "T1D882621057A56EA7E9138FB4465133C283F81DE7EF85CA6F8ECE101A3B2A1C17D89C64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350537, "uuid": "d54102c5-d2f8-4c1a-8864-ef2b6a2267d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350537, "uuid": "99c18100-1c7d-45d2-b34e-140e52205cc7", "value": "192:wA1NdkCT9ktcs4AZ/Daryr13kQfwvxk4Hkq7n:eCT9MZ/D2yrlffkxtt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675350537, "uuid": "85e0241c-30f0-40c1-ba66-441ac35cfd5a", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675350537, "uuid": "821a23b3-01b4-4045-9715-1298ce161561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350537, "uuid": "1a3d219f-e958-462a-92f7-4e5b0273e181", "value": "a40459f1f741836d46666ce9b97a191c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3045c471-a2ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675315607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675315607, "uuid": "80a352b1-a3c8-4bca-abed-0727be54e1dc", "comment": "Malware payload (AgentTesla)", "value": "03bf64a83afbaa0f7c65d027d4159caf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675315607, "uuid": "451a990e-b551-4415-8787-d0798819aaca", "comment": "Malware payload (AgentTesla)", "value": "7ed770882e68ffbc46e62f6f6cf20548ece7d42b72ad30228f98e9259d0023fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675315607, "uuid": "d76d0dbd-6562-4bea-89e5-6a7ec8d1e793", "comment": "Malware payload (AgentTesla)", "value": "43b26f8acd97d4d1bee7c4f4c3087b6f197bbe4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675315607, "uuid": "8998a4f5-f2e7-4298-9434-b392bcbf9be7", "comment": "Malware payload (AgentTesla)", "value": "7d4be3b28e60fd8cd7838218d9dab13ae6db4c9ac359934fa78ef1d8d369e2836e64960e2385cd7ed91b96a8ee94c3d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675315607, "uuid": "470f54ad-87e4-4e5b-b59e-068a56d961fa", "value": "T1F4141262A2F0C0A7E5761BB11D7A139356EADE1539D983A78720AF6C39361C3880D773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675315607, "uuid": "2c74aff2-f7a2-4b85-83a7-5ce5fa566fc5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675315607, "uuid": "be30e2aa-8fa2-4d04-9abe-584c961b9d9c", "value": "6144:/Ya6Iwk971blC6pIYBgPiu+PaU4rtQuXpKgv5K:/Y2wy7i6pI0gP2SdWuLxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675315607, "uuid": "89301498-e46c-41ec-a380-192d5a4acad9", "value": 207334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675315607, "uuid": "805875b5-5cd7-40b3-b168-76273c90bac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675315607, "uuid": "2dffae2a-15ee-4f24-9a27-ca2c4390ad2b", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d327ce1-a2af-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675310851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675310851, "uuid": "4f0ca9e7-6f13-42b4-b5ce-8f64de3fb5a8", "comment": "Malware payload (RedLineStealer)", "value": "c4f045d7baafb0380485a1e028f1ec48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675310851, "uuid": "0fa6dc9d-b002-4a68-8a1b-ab5f9060ae58", "comment": "Malware payload (RedLineStealer)", "value": "7ef99cf6b2378214934b430a7b9513dfb3fc188fdf212477bf1dc906207663f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675310851, "uuid": "fb5d133f-ddc9-44c2-a509-aabd3af892da", "comment": "Malware payload (RedLineStealer)", "value": "a07fdb9c8462369f2f721f526e4e18f700029371", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675310851, "uuid": "0efbc41f-4a51-4ef2-9571-f00b71844cd4", "comment": "Malware payload (RedLineStealer)", "value": "64ed0c42d2c52d44839c795c27c450f2c0c7f5dc99d1f1510aed6f8ccc4592c0d6d3e257dfb67af785400d138562d323", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675310851, "uuid": "9d9d2325-637f-4ab5-945a-635241c4916d", "value": "T18C74F1327A80E073C6A251337820DAD56FBEB1315975564B7B581EEE9F702D0A73A30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675310851, "uuid": "efef13d4-5b7d-4990-82f0-d52d03f1e636", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675310851, "uuid": "ebf3cfc4-5998-4959-bde9-ff912768b21c", "value": "6144:tlIkwLjqBJlGO76YKJWF7JmS/UqkxRic+qmDM5EYDu6ZOpsC9:tlI5fqBl6YUW9IENTiEYS6UW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675310851, "uuid": "11a3a3c5-0b2d-47e5-bcf8-f1775f78863e", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675310851, "uuid": "5670f2ee-8473-4ece-9ece-b05f14b70f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675310851, "uuid": "835e1a33-7d85-4ba1-a5d9-d023f7a2529e", "value": "c4f045d7baafb0380485a1e028f1ec48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b3e16eb-a2c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1675321638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321638, "uuid": "3da750f6-2f8f-49d1-883e-7caa1bafb6de", "comment": "Malware payload (VectorStealer)", "value": "4355e60486c91962cec129e669cd29cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321638, "uuid": "89805d10-df8d-4288-856a-50699a216692", "comment": "Malware payload (VectorStealer)", "value": "7f08a164914b44c402b96fb5cd938da92a5111353ae22b34581f2ff8cca6670e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321638, "uuid": "5d650d5c-5465-4e2d-91c9-855324d25fb5", "comment": "Malware payload (VectorStealer)", "value": "55696ed707b0e29adf4f077b989883edb9041e99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321638, "uuid": "dc6e2903-e18d-443d-8525-35f9fe8345df", "comment": "Malware payload (VectorStealer)", "value": "910670ea71c239c2a2a168407938703187710ea58086c055980eb8ed8332dc36b3c6ef2c3ce4adb0250a0ef1be59902d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321638, "uuid": "a1f7536b-94e4-46b1-9aa2-cb18aa23395c", "value": "T18D050108239466AECFBEC23AECEC2EA8DB74A43A5557D323648361F76D45341DD142E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321638, "uuid": "a38aefc3-edd4-4e0b-81b9-5668af9edb5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321638, "uuid": "c89f228f-86d6-4140-a6d8-0d68d0856267", "value": "12288:QH3DfruorRzLsTzOuN6F7ZY6S7g/m7PHZ/81UoXfjv9T4tGsWy7hQM8HJrYZYs:QXW+Rz6OuN6nLSgg/K3Xb9qWyVupr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675321638, "uuid": "71e344bb-f013-499e-830e-ab87d2dee0cd", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675321638, "uuid": "e1c67bc4-a544-40e6-a750-b20a6246ab97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321638, "uuid": "8cce21ed-e4e7-4d4c-929c-995cab08cd63", "value": "Payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4762af-a2dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675330235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675330235, "uuid": "7b589e50-e2ed-4965-bdc5-94df7d04a674", "comment": "Malware payload (GCleaner)", "value": "e48d38731c718970d13291d5960fe7b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675330235, "uuid": "fe035a75-95c4-41ec-b645-aab6d2cc819e", "comment": "Malware payload (GCleaner)", "value": "7f10c1a6da3279d3a54874ab8fc9c90b2b31a47646cb9c12848c2388152ea6ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675330235, "uuid": "e60fb721-247f-4b5e-b382-ba59df0b1794", "comment": "Malware payload (GCleaner)", "value": "6f36c7bef44c8ef7e5a7221e4653a1737e275194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675330235, "uuid": "3dd971a8-51b6-400c-b030-2a30d0ec57bc", "comment": "Malware payload (GCleaner)", "value": "4ad4a84f7a0e87b6b1216a7883bf334a36b24358fe355ccea9f93e4a68d2936f4b345d774118abf14c6a4e5610e3a119", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675330235, "uuid": "4a1a5aaa-734f-478d-8d7f-3fecf245f445", "value": "T1A8A5332B2062553BC0239F710C7C5423FDE5BADC59BD637AE85C366A5E3A3442A1F321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675330235, "uuid": "0bf900ba-67a9-43b0-926e-ec75cfb12b8f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675330235, "uuid": "c2e9c116-d960-486d-ac66-e1777d81b9bd", "value": "49152:bgawODmDbuQxeT2iyCAIVnLAofx9PbYU6K04kHxgSJqe2LCgv2MR:caKbZetVdV8ofQU6ZTRgSEjv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675330235, "uuid": "ffc47327-f3b7-4109-bfba-3192e0f30d34", "value": 2100063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675330235, "uuid": "9cbd5d47-b8c1-4775-ab5b-ee62915ad95d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675330235, "uuid": "08634209-10bc-4d7b-9eb3-b81bb5394ada", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6097b23d-a2b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675312252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312252, "uuid": "038ec078-39d2-402a-b21c-7b6db04bf5a7", "comment": "Malware payload (RedLineStealer)", "value": "3d0d8ff2c300f8c7dca0274246e9fd09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312252, "uuid": "5a225177-d1fb-40d7-a0a0-b09c32f908e1", "comment": "Malware payload (RedLineStealer)", "value": "7f492c0fe8db77c703e29f0899f3ce33fd052e195a137aede9ac9fe364b1b579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312252, "uuid": "95013d7e-8819-41dd-a8b7-acd00f2c80b1", "comment": "Malware payload (RedLineStealer)", "value": "ddb7219c531daf51377b77bb26d269838e50a2c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312252, "uuid": "7562d220-4aee-4d68-9638-f48d87a80f06", "comment": "Malware payload (RedLineStealer)", "value": "4859b04e5ae8ec198091ceeef40f96923a2001a98145c0e0dc34e14eeaad151f247b787fa52a6b79899c8092ed828291", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312252, "uuid": "c7fd77c5-2db6-4307-ad53-7e44fa22ab4f", "value": "T1BC74F12275E0D032C5A760701C24EB84FB6EA4318AB598577BA41BAC9F333D0973B34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312252, "uuid": "fec6a59d-14ad-4e74-8917-805ebdb7c46e", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312252, "uuid": "dcb40003-9b39-4d9b-b2ed-20a99a601fa8", "value": "3072:kl97UHycOk3bwLliWK15tfgxqhde/IIzpLZDtfsF4M704fINCTTdFXdazaAJFa:kl7AcLliXV6qiweXEFO4gNy2JF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675312252, "uuid": "8db294f5-7bee-4d1f-bee3-60f8a7475ed5", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675312252, "uuid": "a155e746-f1ab-4ce8-9a71-5346d4af1c02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312252, "uuid": "d098ea2b-f44f-42f1-9b41-8865cca40c39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c82311-a2f1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675339460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339460, "uuid": "4ad13095-bc94-48c4-a805-365d7c1c6ca4", "comment": "Malware payload", "value": "f3ac897b892086fe6c5aece3595c8f15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339460, "uuid": "432d195b-4753-486c-ad8b-9c2bf30f684d", "comment": "Malware payload", "value": "7fae2c58465bb871c32606467310d4aecd5a0209ff0c0de72981dd9baae01d34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339460, "uuid": "7dd8f480-e8f4-4f32-a39c-3f8f77de95a3", "comment": "Malware payload", "value": "d5695c390a4350debb5c08d5c5a0023eec1cce05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339460, "uuid": "1ea188fb-d6b8-4c4e-83ec-60a35a10a174", "comment": "Malware payload", "value": "55d81ef41ed839c02beb08e074bb6450032e2c1921e72af0f8b4c29343fe290315ce59ee5ec0d730db9be85cca4c2ca9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339460, "uuid": "222819ee-1dc9-40b6-89c3-ff21bbd71d6a", "value": "T12F6412C97994E87FCC17D03A49598D948BA67677226FE293404362DA5C4FF1B8E1C0B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339460, "uuid": "7ae135c0-29fb-46b9-b25c-3d7116277c73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339460, "uuid": "b11508cc-07ff-4395-b84a-83bb0f938423", "value": "6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675339460, "uuid": "731966e8-2e01-4b47-acdd-5b3025376550", "value": 333252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675339460, "uuid": "9ace6358-16c2-4a23-b418-dba772f246de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339460, "uuid": "fa214835-de55-4b62-a7fb-d86189e16d85", "value": "f3ac897b892086fe6c5aece3595c8f15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7883728c-a2e7-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675335056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335056, "uuid": "62d01953-037f-44fd-b5fe-a9d242298403", "comment": "Malware payload (DCRat)", "value": "c532d809990659da1bc427ad039a7d5c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335056, "uuid": "7d14bbc1-6495-4560-8cd2-221f8f799e37", "comment": "Malware payload (DCRat)", "value": "7fe5834f29daabc2f0034eff990a5dcadccdbbad7a6428eea416322020f2afef", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335056, "uuid": "d8a7005f-b8bf-4eaa-8e3d-e8cedb1bde54", "comment": "Malware payload (DCRat)", "value": "6158717c914aea611074a14fd0527663e95ccb64", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335056, "uuid": "8339dcbe-b404-4cba-83e6-595e716998fd", "comment": "Malware payload (DCRat)", "value": "61fdd674cc288c60669eeb526cb8c174474634ab823432244f4c3bfa36d922d45084222e679aa76a560d3b3752e239ac", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335056, "uuid": "d1add84e-6a07-41cb-b190-8fc394b27a58", "value": "T16175CE2129EF50CD73A39BA25FC8F8FF895AF573191E70F921425B428722D808D62B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335056, "uuid": "97b8b8b6-d22b-4345-9367-54495533f07a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335056, "uuid": "b8216cf9-51d8-4149-b8ea-72aed8563e4e", "value": "12288:CC6105US81giZG7/N8vzvD//dH1P2TZeQmrD0:TUS813T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675335056, "uuid": "7e462f6e-5ef3-4ed8-9ff6-5d903b835e15", "value": 1589248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675335056, "uuid": "6c7f00dc-e196-4082-899d-7fd53fb1170b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335056, "uuid": "3df909da-72b4-429a-a929-8527ac36cfbd", "value": "HEUR-Trojan.Win32.Generic-7fe5834f29daabc2f00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1419d908-a2db-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675329733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329733, "uuid": "bca97d60-56a0-4d24-b0cb-38cf50dcb97b", "comment": "Malware payload (Formbook)", "value": "6c8861d0c5093645595b3ff9187b6ebe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329733, "uuid": "0760c9e6-16f7-46cd-b893-798877b4ec24", "comment": "Malware payload (Formbook)", "value": "802ef9033535b7c8c8b6844eb030ab8fa10f6427d45d5b7f8339f5d89cff1958", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329733, "uuid": "6417d68c-2113-4ba2-b6fe-d7f1ac80afaf", "comment": "Malware payload (Formbook)", "value": "1ee8d66607c82691ef0efc5a1a7d860fc02a23c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329733, "uuid": "6cd8fe6e-7876-4208-9a0a-c76d14999782", "comment": "Malware payload (Formbook)", "value": "588804d02f4bd59623f4570237d70a3cafb566a1ecaa5260ae75bf7d800effc2208155c9e479e2d870e15bf6e4006f87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329733, "uuid": "a9ac6504-0ae0-4452-9008-7a2fed2a6015", "value": "T1E3F42350B3F8C355E8E447F55623818113F13823A73AD67E1D98F1EF067AB949A40BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329733, "uuid": "3b0f9dcb-d5a3-484b-803d-d61fb0d42636", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329733, "uuid": "2e48cf92-93de-430f-aa78-45ceb3116ad3", "value": "12288:fxKkMtEwcU3gZ+GQzjkATGdsWMQi4DvvH01VNelXWMUJIiwuYSlSrGo/1Sur:ph6AAgZbQzlGvi4DvvUD+XW6MSVAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675329733, "uuid": "d8a0f5ef-2335-4517-b2ef-db9a6775adac", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675329733, "uuid": "012cac7e-0b87-49aa-979f-974185afbef0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329733, "uuid": "4d9358e7-8329-46f6-a325-f2e26a68fb9e", "value": "swift copy of payment MT301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2ca883-a28e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675296914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296914, "uuid": "8cb22fec-d616-4fcf-b63b-da19f50ed0d2", "comment": "Malware payload (GCleaner)", "value": "5f584e6d089c77b69c74095ee6e49613", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296914, "uuid": "83cf0a8c-3277-4f9a-82d6-9929a3cd4b6e", "comment": "Malware payload (GCleaner)", "value": "80c374d99fedeae835f12b3d3bd4ec4cf2af4e8f2a2996621864e2b916b099b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296914, "uuid": "6cb68ca5-bb4e-456b-a343-f0d6133d61eb", "comment": "Malware payload (GCleaner)", "value": "662d8f727545bfce042186ab60cc01498e7c6c3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296914, "uuid": "f4cf3652-0203-47be-a9ea-8bcfef07f7ae", "comment": "Malware payload (GCleaner)", "value": "5cba455b6fcbdbdda41254524697a068e72145e4ca7161698499285e54f5a96293fb9e730df33d3a82615c47e814258b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296914, "uuid": "26e6d0e7-2a7d-4373-baea-12f7481725b3", "value": "T18CA53341F73ECD72D1126AB02A12C572B2757EA2640DA60425F73E5B3BBF7E1BC18246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296914, "uuid": "1663c3a3-5c39-4caf-ab37-ea3177910ecf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296914, "uuid": "aa5fefb6-7fcc-4a67-8822-d8acf731b490", "value": "49152:icPLnQ+Q8xMR/bYCsz6KOO8WscHHLoLHxchJpxMa9vLCgv2MR:XPLnQ+VMR/bYJz6K6YHHsLuxM8Lv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675296914, "uuid": "0e14f1ef-590b-42f8-85fc-6beccfa1af8a", "value": 2179845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675296914, "uuid": "6cf0c3d5-4644-4e77-bc18-d478d9f15023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296914, "uuid": "1c4be1a6-620a-4e22-aa83-f2848390c406", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca12863a-a32f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675366116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366116, "uuid": "04d5c6b7-d50f-4387-a8aa-76c70b3779df", "comment": "Malware payload", "value": "e3c0485e590643f8da1526a1db60c9cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366116, "uuid": "dcbcfdb1-da65-4c91-b0ec-7b57c36363ef", "comment": "Malware payload", "value": "810fd35bb4cb80c67a4e5887be706fb93b81862dcfc4d488feb4f1c40e817700", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366116, "uuid": "afbf25a3-48bc-411d-854a-6b1754799612", "comment": "Malware payload", "value": "e88c3257f84372c1c999d79d1bd59a721904baef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366116, "uuid": "90427d42-e133-4de6-9b66-0c0d479d63d1", "comment": "Malware payload", "value": "28b6f7737ce5a07611f15faf57ce4516da624e8bc403debc6932d0ad8f188ee6523ce517fde764f78d3ef61e807293c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366116, "uuid": "19c2a4f4-c494-4955-878b-228bb6b51646", "value": "T18E7512366F2DEC11C90C84B3F65384CBA8309D6453D569A2756BBA3F817C3A7EB1E118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366116, "uuid": "c03a7cc6-a55d-45f1-8512-12394df067f8", "value": "49152:GIbQoc+JS5kKfL6fb3tvbhWN7awmLUd3e9A0NMOu+PT:GpNfmplW1rmwd3e9AIlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675366116, "uuid": "ed737851-b0af-46b3-bd3e-8c805b273193", "value": 1665496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675366116, "uuid": "ec4cb065-694b-4217-8b64-c75c9b3a082c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366116, "uuid": "deaf3185-03d4-41c3-9a06-90052a4a826d", "value": "\u266a Download to Listen VoiceT.MK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83b64ff-a2f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675339941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339941, "uuid": "ff21e190-0799-4843-9f63-ade2ffccf34a", "comment": "Malware payload (Formbook)", "value": "36fc3308e4813aa3c33813e57b78def8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339941, "uuid": "158bebb3-9733-4f40-895c-3edc3d9b4e00", "comment": "Malware payload (Formbook)", "value": "82c024f643635b68f740f440beae2bb256d8851d7b88130389855a8bd8b8db18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339941, "uuid": "b6879d38-c73b-46a0-9fad-af33b9323e77", "comment": "Malware payload (Formbook)", "value": "9b2069a165733766ec6bedc23f45a9b48b7957db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339941, "uuid": "41dc1b51-cb06-4279-8382-fdbcbff77abb", "comment": "Malware payload (Formbook)", "value": "2ce6faec15d619b7defdbff14d42d072bd1146cb47e8d6eba5ff359e5a31d187e22b83d18996ba0cf070ec7c4368f0b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339941, "uuid": "74b67dad-fdd1-4af7-977c-a596feaf0f19", "value": "T1D5159D8737B1A8BFF687407154283F886FA07113BE46925397373AD49B098FBB798191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339941, "uuid": "cb09bad0-b30b-47be-bf39-bbabfab2963b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339941, "uuid": "807ebd98-3ee5-41de-bc4c-755b4a20b745", "value": "24576:UXfQcv86F0xMni78j0pg1wFsHFnPsmQbJ4YqG4yPa:UfxWi8tgHl0mKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675339941, "uuid": "78a47b2d-b1ef-40f1-ad5c-77d95dffeaca", "value": 913920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675339941, "uuid": "b0d3764f-b436-4b74-bcd0-9d6aaeb9bdaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339941, "uuid": "1aa310f4-45d1-4aa8-8948-b42e4b0e2177", "value": "36fc3308e4813aa3c33813e57b78def8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceaabe34-a33c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675371707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675371707, "uuid": "ee93c798-64ab-4e9d-90fc-5fa1fde10e35", "comment": "Malware payload", "value": "59179fbc7f87d3020d7ddb02dfcec852", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675371707, "uuid": "499c09c3-dad2-49c2-92d2-30a3bf4e4771", "comment": "Malware payload", "value": "82eb130b07e60fc6886ffeee9f7acb99ed49a79cf36292c4b95acf0712528059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675371707, "uuid": "8fcf23b1-0b9d-480b-8e61-f35df3bb07df", "comment": "Malware payload", "value": "f1c335f42e272d631a6006ee989b27aa2cb546bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675371707, "uuid": "566863b5-d203-41ab-9558-b36fb49809d8", "comment": "Malware payload", "value": "af42d484481500f8bbf74cfe95ce3b48bfe403d4909e347a5cdabf297529d07feeefbfc181b97ffd3fd27f9708230719", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675371707, "uuid": "fb701b8e-cb56-4078-93d3-d04b41d819f3", "value": "T113648D02E292FC41DA25C7728E5EDBF47A1EB5528E286F6B52185B3F1972173C1E3318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675371707, "uuid": "ac8ffdf3-a89c-4b4b-81fd-ad18c53946a7", "value": "2ff60b2f756b6533c2643b340c02a5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675371707, "uuid": "f30d7476-f1be-48d7-be1b-654559b2018e", "value": "6144:aOPBLQ6hC91Ka9aUnNGTvSrClwKwpxzjV6ptCbNKNc:aOPBs66l9almOlePf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675371707, "uuid": "9798dd7a-57a0-4b45-b2df-63e8de495a45", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675371707, "uuid": "2d8dfedf-520a-45d6-b61f-414b7a51e48c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675371707, "uuid": "0d759dc2-4743-4472-81da-3de48358cbae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feed76e5-a326-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675362339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362339, "uuid": "160f4dff-fa1f-4ca7-a2aa-eb88193663e1", "comment": "Malware payload", "value": "5f31be9c294b2efa10d117a49103771b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362339, "uuid": "77dbaea4-6f5d-4166-8dc1-0973ca0e0044", "comment": "Malware payload", "value": "855f71b486fa8038b40dcd9fcfbc73d4a2c0a623b028447f7847c8301bc40d5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362339, "uuid": "c1453ef1-0fe8-419a-8471-91d79d01a06e", "comment": "Malware payload", "value": "1bfb8c5bf2fb257c380d091af37c543ac0ed6c09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362339, "uuid": "d4063537-8f35-40a2-996f-190dba72e3d5", "comment": "Malware payload", "value": "e0ec383591605ad8223455b294fe7eea9d66bf8451df685b3b65a9e8a6bbaf1aa0ff9a9855d851b6f25cb14704bbcbdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362339, "uuid": "6ef753d3-8843-4d79-ae78-27c3e00f6853", "value": "T13676334030D4D8BEF75999308CB553EDC0E24B8895386C6F1B88DE77917D792C326AEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362339, "uuid": "edab4395-5a8e-43bb-8181-5ba139e7c390", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362339, "uuid": "41eac4ec-5da7-4a38-b544-85da7b6322a7", "value": "196608:91OPGZ3lcxcozBjYUTU0xUl44Ko3N0hEOfYxv0lAp9rgYjRZaZ:3OPyiCoztaK3odTFxMlApZfaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362339, "uuid": "db195b35-3bc1-4e64-a4d1-18cc0370c100", "value": 7619833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362339, "uuid": "bbce124c-ab49-43c3-9d05-81b15ff4a718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362339, "uuid": "c3cfbd71-2ecf-4390-8d00-3fffcac83784", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c103b8c-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675337048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337048, "uuid": "57747a25-202d-4ad9-89ea-09d74d48a2ea", "comment": "Malware payload (SnakeKeylogger)", "value": "f41bb2121282cf880ddd03177db7885d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337048, "uuid": "9a7e3ead-c765-4de3-8911-84f2b304b77a", "comment": "Malware payload (SnakeKeylogger)", "value": "856f6cee8ed252e786bf4565ff647117e671e1f1f8d0f5a33887f0286843eac9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337048, "uuid": "0d7d2f83-94f5-4b03-8392-28456e182292", "comment": "Malware payload (SnakeKeylogger)", "value": "ca117c5b756dd7fba6372e95df62e76cae3baec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337048, "uuid": "959120e9-9ffc-4d43-8bc5-6cdf282e91cd", "comment": "Malware payload (SnakeKeylogger)", "value": "cacdcc92e1275a3056934eb75e4908b43987aa0c2942e2a681566011249b61c25df457b64bc4b623a2110c01c74e6b90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337048, "uuid": "a735d7bf-45c6-43c1-bc55-e321713b9062", "value": "T13C057D8737B1A4AFF68B407154283F8C6FA07113BE56E253A7373AC49B098FBB694151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337048, "uuid": "14fc3240-392c-41a8-a340-9d6ce6dbb469", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337048, "uuid": "7fca83c1-b29b-4f72-bc64-91f09489ee34", "value": "12288:2fSb6Fy2MFJfD1xCLrkaTTsbhjEeTZCXe31kux0W1BNggzo3pqG4yPa6Uap6WRl:2fW6F0FJWX0jEs7hx0ABNHMpqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337048, "uuid": "a0444f7f-5d26-4ed1-8bf4-28a927b7492f", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337048, "uuid": "afbfc2c7-211d-4a4e-9927-0555097c093c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337048, "uuid": "f7e10e42-0f96-46b3-97b2-4db721bcfdd5", "value": "f41bb2121282cf880ddd03177db7885d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b399e9f8-a327-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675362643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362643, "uuid": "0b8cf295-cfa8-44df-97f3-7886886c2ef6", "comment": "Malware payload (GCleaner)", "value": "c551e61e53d3beef1a487860260d751f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362643, "uuid": "f17b7a45-873c-45a1-9fb5-174f6367499a", "comment": "Malware payload (GCleaner)", "value": "857cad5ee1f9c13ffcbd6bb0a4cf8e1d28c865c82f564b0c649172e93c70293f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362643, "uuid": "b8c97646-385f-4081-8385-c73626c1ad52", "comment": "Malware payload (GCleaner)", "value": "bb13e05c25713f7c3b9afc5328b4741faff63d3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362643, "uuid": "ffac0035-4521-4b7f-a71b-457cbe45ed94", "comment": "Malware payload (GCleaner)", "value": "3ddcc3e7f1dec31274f6b811a1fa9244a5656991cfde4de01c92d19afea6e9cfe5617026034e90916ea4ce5addb8526a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362643, "uuid": "277a0917-65b3-4e7e-b4c8-74d9f6d4fe79", "value": "T105A5334369B41077D221D6B66E30B0A5B1323EF369F44E00B8AD776C6AB2B61F4E53D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362643, "uuid": "2a2caa28-88a8-479c-99f6-f7584703b7bf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362643, "uuid": "d1c8b47b-9727-4517-8cce-5a0e0baf3f11", "value": "49152:bgdOQQHEm2DzTLSoKM/4eIKkSoRPaZmCmtUaCCIyKzaEBzFxXjALCgv2MR:cdOQwE1DHLSoMxCDnyAa0FFov2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362643, "uuid": "3d573f83-386f-4d42-99bb-d251e0dd4425", "value": 2131513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362643, "uuid": "e8591894-a463-404f-aaf4-dc986240983c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362643, "uuid": "6bcee873-63a5-4d0d-9a98-ef6738ec7884", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5216819-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1675337305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337305, "uuid": "583aa88b-8484-4caf-bf53-9916fbe958dc", "comment": "Malware payload (Vjw0rm)", "value": "70653ab99274c82b0a279a3385f62d04", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337305, "uuid": "05045f2a-a486-4c26-8dde-b65fc71002a7", "comment": "Malware payload (Vjw0rm)", "value": "85e2252b565492389e6dc161551a3c82b9fcc6b3873ca2f7f4a2e99d87ca6c9f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337305, "uuid": "6fb94641-c0ea-43a9-ac1f-a9801c7798e9", "comment": "Malware payload (Vjw0rm)", "value": "fc35767cfddafe185ec263c1eaf2d5acc65714a8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337305, "uuid": "e70ecbe1-2be2-4813-b76a-977ff6fcb7a7", "comment": "Malware payload (Vjw0rm)", "value": "be4632cee55721622e9478a2bddb0ade40390fe7bbdfaa9467f27024e34189f51616c56002c06f48b9e752afaefe07b2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337305, "uuid": "b2ce9306-8daf-47ac-8791-8c5a22592ffe", "value": "T1EF55D150ABC45F9EEADC0A07E07D2A0E63F2574AD4A2B5CC77637C076B6FE4C520A485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337305, "uuid": "18e99fd4-3571-48ce-97c6-6ad231e764b3", "value": "24576:ju9bPTr3v4HG3dvjcYxRVBw+H8AirMFTYs0RU:iFTrw4LcfpMCRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337305, "uuid": "c374ab6c-addf-48a6-a86d-9fce882a3789", "value": 1394177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337305, "uuid": "e6dfbf2d-4d48-4a30-b52b-8505be80d8f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337305, "uuid": "b3dca4ea-285b-4f08-a431-8209293bd787", "value": "Request for PO_2023.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3383e089-a2e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675335799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335799, "uuid": "25cb8701-5e84-45a4-a30b-722b09396cea", "comment": "Malware payload (Formbook)", "value": "6e4618e85f1366a3a526496f6537af89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335799, "uuid": "316983b6-0149-400f-8b13-55ca5968cd38", "comment": "Malware payload (Formbook)", "value": "85f9e2436c4b4743d0d509dfafeaba63bc46848a31053ffb00d35987fade8fda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335799, "uuid": "8c2785df-ba20-420d-97bd-e878925e59e9", "comment": "Malware payload (Formbook)", "value": "b1b1c0191b8b0043828ba04bfb91b5f41903459a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335799, "uuid": "876b7fe5-3d3e-4545-b774-74d19d7196fa", "comment": "Malware payload (Formbook)", "value": "3845184bf3970209d2b9ef6605ed26f0846fbd19ebdb041b5fc5436672e4dce3bf8ec8a472e4a544a74bbc2abaaef2da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335799, "uuid": "db376b9d-d895-472d-b93c-1cf217b09032", "value": "T1F7159E8737B1A8AFF687407144283F886FA07113BE46E25397377AD49B098FBB798151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335799, "uuid": "0bf50165-0bfb-4568-b79f-0c2d7bac787a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335799, "uuid": "c13316e0-1d89-4b79-ab7d-3ff41744b0cf", "value": "24576:Nrg6F0xMiBlOMp8vj/Vt4Uz8nTTgIdqG4yPa:3Wielf8vjdtBzakIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675335799, "uuid": "9eac2f0c-0edf-4d87-b386-dc165c9becdd", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675335799, "uuid": "ba23ee0a-545b-4dda-b56e-27e2786d4fca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335799, "uuid": "554305e2-568b-428e-86fc-b1933c660756", "value": "Order specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf3ab5b-a297-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675300569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300569, "uuid": "9966f88b-4b78-4c65-91eb-0b02db7b8769", "comment": "Malware payload (GCleaner)", "value": "65c65cdc5b26540162a814db6b21bbad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300569, "uuid": "0079d925-ae89-4e89-a4c6-03d246929acd", "comment": "Malware payload (GCleaner)", "value": "860e62f9243c70cb49484df32da12903e50fa6de8e6552c2119dfc59359a9c25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300569, "uuid": "3f930742-9abb-4a02-8dab-40d3930d73ed", "comment": "Malware payload (GCleaner)", "value": "f0dffe333ac5a1f02c1d3e05ab2116190576cbcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300569, "uuid": "b24623af-4cac-4556-b111-b22b59c3bb1c", "comment": "Malware payload (GCleaner)", "value": "25d86e07531ee34218e09878ca626079b26273b4412b0980259725215de25a4764056345c8003ea3a8eeb991b9578ad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300569, "uuid": "1a320492-ac79-4557-ab63-eff2bfffe545", "value": "T1AAA53322793D9837C2921EB96F51E5211A76BF61353CDA4631EF3D0B3BBFA927408142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300569, "uuid": "cfd431e8-9c80-453e-921a-e9d79d7e78a6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300569, "uuid": "660303a6-56ab-4894-872a-51b3e874174c", "value": "49152:icPLnQThMLV1HwdPnOrS+PkZC/A2HeWCrCEnlIG9MCSJ43kLCgv2MR:XPLnQThMwhOrX8qTCrC2o1cUv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675300569, "uuid": "2f70ae7a-297b-4c7c-b731-a4228e1e846e", "value": 2147670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675300569, "uuid": "8dcde3d4-1be2-4410-b13f-4b85b330ff5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300569, "uuid": "8743a913-62f9-4a6e-ae3f-d00bad4fdfde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00aefa67-a2eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675336573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336573, "uuid": "2e60c46b-5c8e-483c-bb8b-f264e12b3ebe", "comment": "Malware payload (RedLineStealer)", "value": "a690e92f86769aaf046fba0274315c54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336573, "uuid": "ad9264e3-9ed4-4d14-82db-35d9ac9790e9", "comment": "Malware payload (RedLineStealer)", "value": "862769c777a16b41d925fc395299ab3997110f336a1b72c4799e599a943e51f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336573, "uuid": "faadafa6-95fd-4a90-ae15-96967ec47b0a", "comment": "Malware payload (RedLineStealer)", "value": "8a480564646ae8bc49e8be1a69a59fc0b1c7c410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336573, "uuid": "9681e006-fb06-411c-977e-92c98172e153", "comment": "Malware payload (RedLineStealer)", "value": "9d6f93a149f98823a512347cf9dc4f198e2395c9ad78411ec92e66e54e1274e4266cf2e7da2c3ea9334e90e5519f0715", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336573, "uuid": "ec4edb82-283d-4f51-93d7-9dc3cee53c40", "value": "T10B94BF02B2D0BD59E9328B319F1EF7E47A1FF9508F0977B62214AA1F14701F2C9A2725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336573, "uuid": "4fe1af72-e5ea-4380-886f-456089d6269c", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336573, "uuid": "fa802c6f-a849-44a0-ae6d-43aed8be23c7", "value": "6144:13LA+MR/9dJEwrr/4SiYxRmgqavMSzsaF8QWXw9/CJTk637eQfnd5LGwMB:Bq/CSZiaogqavMxaEw9CJb7d5LG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675336573, "uuid": "fc147e6e-0046-4e00-8429-b0dbbab2b272", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675336573, "uuid": "93db7f8e-e492-4c5c-a1c0-9aaf4d2cbc25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336573, "uuid": "7214817a-de19-4629-b5d1-60efc0b52cdb", "value": "a690e92f86769aaf046fba0274315c54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169e29b2-a2c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675321577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321577, "uuid": "f056e806-e4ed-4f03-a5d0-7f8b7d4c8264", "comment": "Malware payload (RemcosRAT)", "value": "48a13c217c965ed66e5d6c018b89217b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321577, "uuid": "4e5eb078-b6a2-49d5-b1f8-f31fb216d5dc", "comment": "Malware payload (RemcosRAT)", "value": "8650dcaece1489d98b7f6782ae638de33797f2a1018f949ec270054f0893aea0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321577, "uuid": "427ab8f0-bfc5-4ff7-8371-ef953a568c75", "comment": "Malware payload (RemcosRAT)", "value": "2d8b62d02c73e7e2fc367fc64b51350564c7acb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321577, "uuid": "6e88e872-04ad-414e-9611-89a60e5069b0", "comment": "Malware payload (RemcosRAT)", "value": "0e83c23e84b412830b046bc9f970a7ee15f1997d1ec754d6a668dcebfc231f1d896b527b0388422a66d8d79b88984782", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321577, "uuid": "0ea61907-d087-4a2c-92a8-54c242003587", "value": "T11EC1C410A3EC8273DEB74B36AEA3934057B9B7165867CF6D78D0610F6D11AC84A227B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321577, "uuid": "73907c73-e921-4dfd-bc07-2435299c24f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321577, "uuid": "e0150539-3151-4542-b3d9-d8b93e9fd13f", "value": "96:4rs7rOMGPGDupbGL7g8y23I6mUUWH78kVl6l2xzNt:oKrsPGDupKL7nNhVlk2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675321577, "uuid": "4c168927-3a2e-4ce0-97c1-c2ab301dad72", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675321577, "uuid": "ee0ccf9e-bdef-4662-bf88-8ccc6712f3f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321577, "uuid": "9a28fe2f-5b55-4599-a2d3-099d16b9d7f2", "value": "48a13c217c965ed66e5d6c018b89217b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e33c860-a2c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675321241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321241, "uuid": "948cad9c-b66c-43c5-9b90-5f66909eedda", "comment": "Malware payload (Amadey)", "value": "fff25b6fe4c10e12ab96ba2184a10b82", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321241, "uuid": "d08ed4ed-aadc-42a7-a310-199948b8be3f", "comment": "Malware payload (Amadey)", "value": "867b1a20e726db6640d7ebc24ba73bcdc67fcc79fc49d79d10b0e98db91836ac", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321241, "uuid": "db72d8a9-c8dd-4721-83b4-6f357051e245", "comment": "Malware payload (Amadey)", "value": "ff65d6653792ea56d2ef9c6b200b9a0185513a19", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321241, "uuid": "aed2bddc-1e37-44d9-8818-216c4d5ffc4c", "comment": "Malware payload (Amadey)", "value": "471bc42c157e2ba4a7ab2f0fa8294cfef2b155b293d828f7709ba28d70df01c59c982f155d36f1f5f1e408804a6a7ce6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321241, "uuid": "2f422ca7-59f2-4170-a3e2-eee18358e746", "value": "T111648E0272D1BC49F536CB728F1EE7E47A1FFDE28E5823B61224AA1F14711A1C963725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321241, "uuid": "e7bd3ad0-85ba-48d2-8d2a-aaa5f4704c2a", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321241, "uuid": "8ccc4c56-1cb2-41a1-827f-c81cbae12a63", "value": "6144:KRL3ySV9Ib4JEexyAwIfd7k9/CJTk637eQfnd5ZqB:ChVqFlDqS9CJb7d5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675321241, "uuid": "a01ad680-62ca-48e2-b28a-b2a6680a25f6", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675321241, "uuid": "1aa2402b-d162-4045-8ec2-e86bcdd7f656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321241, "uuid": "5a9b17a8-b8b3-46b8-b6fa-bc389cc195f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b64d3e2-a31f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675359112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675359112, "uuid": "af74ae97-90f7-4a0c-9b8f-e2f608323e00", "comment": "Malware payload (Rhadamanthys)", "value": "2df51d5b46185a312c096f7fd196f82d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675359112, "uuid": "05bf613d-4a39-4f29-9c6d-d7d1de7e056e", "comment": "Malware payload (Rhadamanthys)", "value": "87be18edc78a55e6545cc26c6d4f3dc43f6d6b12e123031c9a2035812b39560d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675359112, "uuid": "7456b278-29fe-465c-8f05-52bd2fb3ac9d", "comment": "Malware payload (Rhadamanthys)", "value": "4dd5e2cd5f74f3bf2461670f05b587cef71825a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675359112, "uuid": "acdac6bb-0237-4153-9320-9825f0b8174c", "comment": "Malware payload (Rhadamanthys)", "value": "4a6ff390ba9f16e77114ee01569a12459469d74fc92fddbb86c12c7ae14133d990321d2285501d8bc105aa7ba9a304d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675359112, "uuid": "ed2bd690-ab6a-4ccc-9d58-8f9725141b98", "value": "T1DE648E03B2D1BC58E5314B73BF1EE7E47A1FF9508E59777A1224AE1F24701A1C9A2326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675359112, "uuid": "6e2a853e-3611-4a77-a6f5-b3c58dcf57c4", "value": "64f2017133017378e6738b9a4be235bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675359112, "uuid": "635056a9-01de-445f-9f5b-c5e6bccea664", "value": "6144:tGQTLjwSA68Ts90wBms9/CJTk637eQfnd5HRWB:tGQTvw36820gms9CJb7d5HR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675359112, "uuid": "3876b107-73c0-44b1-b9ac-0ee97219f1b9", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675359112, "uuid": "6f02af78-5652-4f10-ae88-f6ed21f22dd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675359112, "uuid": "de0094d3-d5aa-483e-852f-2f9e9b63e95d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec222128-a296-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675300460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300460, "uuid": "8a7174d8-419c-4cc3-9aa5-15246e0cdb90", "comment": "Malware payload (Amadey)", "value": "d9a112b65110b0c6f694fb441d3fd29a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300460, "uuid": "ab7bb09d-cff8-43f6-95dc-989fdde9580a", "comment": "Malware payload (Amadey)", "value": "88294b5ff980e8d16d46e65608fdf678666f7a8d45581f9dd6e8d3d209f93612", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300460, "uuid": "630be2a5-8b77-4cd8-b990-6b7b143ab5c6", "comment": "Malware payload (Amadey)", "value": "12cbc8d4fe4e0d6bee9a3e86191cf9df8af1fcef", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300460, "uuid": "4ac435f0-dee0-46c2-946f-33395c838890", "comment": "Malware payload (Amadey)", "value": "ababacffcf1aab55d9b1ec1bcd04d4497a7dfda9fe697df2e0d95380ae8f118cb187ba97856be7bc061bc4568517531b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300460, "uuid": "f5f442a7-6b9b-498e-9267-589320b86fef", "value": "T19044E0323990C073C17B44745C24EA857E7EE9305936A96BB79816BE9FB02D0773A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300460, "uuid": "f9a13a92-2faf-4a1a-b2ae-1abac3e2f13d", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300460, "uuid": "88fe9f04-ca83-4ed4-babe-757ca4ca3c13", "value": "6144:flKRLLkmt0rlGq+TN7IBQd9IDta2T5cjk5:flKRr0rEvTN7IBOIDt7Taj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675300460, "uuid": "865bf827-ec5d-4a9c-9313-fd97737cec8f", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675300460, "uuid": "ecfde59a-a7e1-4fa7-8b56-1b9398043da3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300460, "uuid": "b71c98f0-2ebd-4d42-9cce-3e7705e94899", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b860deb3-a329-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675363510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363510, "uuid": "5e15e4ca-796a-4968-8c2b-33613cf37ac7", "comment": "Malware payload (RedLineStealer)", "value": "ca228f20fdf78e9574d287b9cdd1428a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363510, "uuid": "68ee2b93-ce23-4c0a-a1eb-57ad2281e9e2", "comment": "Malware payload (RedLineStealer)", "value": "88ff16020c29ab1c2348ecc5c055b49344019dae1a55b3731ec1bd6f35ef5e8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363510, "uuid": "af322f63-cdcc-4e05-87d3-eb648d14f96c", "comment": "Malware payload (RedLineStealer)", "value": "094f380335079288094e0ef54aec889259241e8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363510, "uuid": "e1c3fe66-1f64-47b3-8378-4f3365de47ca", "comment": "Malware payload (RedLineStealer)", "value": "52ebe62671ed3c7b80439e2d02783bc116104cfddf8fa5adfab938bd161ab7ee1503550bd6ac3fe3c8af55604155a40f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363510, "uuid": "80bc609f-020b-486b-a525-4a8a509d1642", "value": "T10B740B887670FD9EC867C47F8A681C24E6636466570BA203B05317ED993D79AFE070B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363510, "uuid": "5bfb8621-f87b-42d4-8a11-a8415905ecde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363510, "uuid": "4b217c99-d76c-4d67-8aa7-1381ddcba9f4", "value": "6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675363510, "uuid": "df28b5d1-f5b7-4936-9896-f254b1f8f9e9", "value": 345070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675363510, "uuid": "90865d93-e5a7-411c-9178-c6b062ea5ca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363510, "uuid": "12a619ca-ec96-4bea-9426-003f8dcfe300", "value": "ca228f20fdf78e9574d287b9cdd1428a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504a6fc2-a2db-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675329834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329834, "uuid": "084cd922-0cb8-4355-a64a-b782ea9bdaa1", "comment": "Malware payload (Quakbot)", "value": "f421b0c375dc3c11adca4a82bca7cc65", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329834, "uuid": "f7566b3b-812b-40aa-9775-5c76e499e396", "comment": "Malware payload (Quakbot)", "value": "892e637a6c3909097d99972b8210947f4a228c49b9ad88ff802ce94f3c10b3cd", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329834, "uuid": "17689241-52bc-4eb1-b560-21617f5301ac", "comment": "Malware payload (Quakbot)", "value": "d40d4fb307e270b0cf73b0fc94adb27bfdf8ecaf", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329834, "uuid": "cc444602-8ad7-46b0-9792-412d880a86ae", "comment": "Malware payload (Quakbot)", "value": "961c2fd4b249ce77e5b725521b75a7168a0038e68e8a40ce765c83ed770f472c77b5408b76c387591f09565269352164", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329834, "uuid": "586cf45e-864d-421d-83bc-c31402db2551", "value": "T1C904E11266F545E5EFE07BB24DA3971DAA2BBE27E212035F4BB56A2D4D64300DC04B0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329834, "uuid": "61acb717-2d03-4ced-b50a-cfb0c5b6f562", "value": "3072:haA0YRw9/WITtTWR7IbNzvL1aEHuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCCCH:Ba9xytedL1jr4iERByf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675329834, "uuid": "c0a66772-d3a0-43da-9344-515d220f56b0", "value": 181442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675329834, "uuid": "fb8dcafd-e9c6-4700-8058-b36fa758ad86", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329834, "uuid": "038b113e-ff87-4324-ad3e-c7e6b5b29f32", "value": "ComplaintCopy_63372(Feb01).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f7b0b4-a333-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675367695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675367695, "uuid": "1a5fc898-bcca-4c20-b281-00589ad6a72a", "comment": "Malware payload", "value": "e4d9015e2bed3af0480b51231b68bb23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675367695, "uuid": "5754835d-4b1d-4f84-9b33-d61d9a30dbaf", "comment": "Malware payload", "value": "893f1df3f71f13731482f53655a5f6470ee00eae87f84e31da4af2950df80cef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675367695, "uuid": "2e9565f5-2590-4465-b68a-fbafc0cb49d4", "comment": "Malware payload", "value": "c148f8cc0d8930602a00155cc0f370d2e22a811a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675367695, "uuid": "378443e9-3b8a-4a2e-9e45-92c4be13a7fa", "comment": "Malware payload", "value": "a679160b45af98a6841795c708a469366c1f31e531a0ba5d4f102594860488e3eaa6829e7bc67c5292fbf144f46e47b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675367695, "uuid": "5440b331-1ebc-4efc-b225-c04b2b07abd3", "value": "T164142A2CB770A51DC586CDFD76059F6DE6F1B81846C71316B235ABBBDF273A08A40282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675367695, "uuid": "355f5b63-0ae8-4774-9a96-4de7d4bc90d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675367695, "uuid": "dfe319c1-74d2-4c6e-b4f8-3598ad0a46f2", "value": "6144:+rdOfeBDRzseSmV7v2PCc4gorppZiG73TAW:+rdOfeia79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675367695, "uuid": "007873a6-d667-4997-8b87-13f1525644da", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675367695, "uuid": "8ec9b111-dc27-4cf3-b55d-385161e78238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675367695, "uuid": "c29afe9a-c2ee-4ffb-977f-74109e79e59d", "value": "e4d9015e2bed3af0480b51231b68bb23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25cf721-a309-11ed-88f6-42010a9c006e", "comment": "Malware payload (Metasploit)", "timestamp": 1675349729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349729, "uuid": "65ac8bec-f9b1-4685-a58f-cdd6992fb7d4", "comment": "Malware payload (Metasploit)", "value": "0ebb7d6aee08a1fd0144b6600d5f6d9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349729, "uuid": "05b32506-af80-4d13-8893-03fac97802d6", "comment": "Malware payload (Metasploit)", "value": "894b5e81fe56418b8df30639fd8b8c484c934aba8a121397b592039e07f766ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349729, "uuid": "40559bd0-b478-4dfc-ae6e-e88d71bacca0", "comment": "Malware payload (Metasploit)", "value": "ea49c6cd2e55cb1cad438d22a704cec610e691a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349729, "uuid": "c2a18381-84db-455f-92c1-da9f87f7f27a", "comment": "Malware payload (Metasploit)", "value": "6a3a1fc534c5abee955a9683943700e9c722e3c1daab8c16525e90f40bb2d7a8c7f8143a91a0dcb7c7673f4d6aac39b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349729, "uuid": "d70ab315-315f-48da-aa76-f7be617cf9de", "value": "T1137207C28B784443F9A66C7043E8EA877D3C97C72921817E569AF1492C933C5DF10A7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349729, "uuid": "184ee939-e349-43a6-a05b-b76c294b63ea", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349729, "uuid": "40f1de31-e7bd-4fae-9c37-26ae265494c8", "value": "192:0vtigbWBcCroDBQABJUWgoqnajKszMXNs:0igbWwDBRJUWnlGsz0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675349729, "uuid": "444eb562-b129-46c5-8ce6-52ec990c905e", "value": 16712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675349729, "uuid": "f2eef2e7-a3ef-4c3d-9c1c-c5bc773fb717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349729, "uuid": "981a9352-558e-4916-97df-396a2769ef2d", "value": "894b5e81fe56418b8df30639fd8b8c484c934aba8a121397b592039e07f766ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8d1cc4-a33a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675370769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675370769, "uuid": "2dde7982-63aa-49ef-88ad-776629d192d1", "comment": "Malware payload", "value": "f29af455752fdca2694d46148ffac72c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675370769, "uuid": "cf3c6608-503a-43c5-965b-4b55f7e2ed0f", "comment": "Malware payload", "value": "89ff3e40188be7aea835c7cfc95ac85db7052514d9b0869d278400b91c860da7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675370769, "uuid": "8ec54509-b9e1-47ec-8778-54f018c73736", "comment": "Malware payload", "value": "ec7c5211e7b67641a9ab92253c8a0bc94fdce997", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675370769, "uuid": "4b7d464c-7d89-4f79-90e5-ab098a69e719", "comment": "Malware payload", "value": "625d84fc705e43b5bc336b1bdef076982f971113d590ecd53dbe805652e479fd8f35239530ecdf23666060e220ba00b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675370769, "uuid": "f354b385-f679-489a-a548-c807fb3c66c3", "value": "T155A53391B9D98ABBE043AB791E5803EAE4356D3E18781510316F306F2C77328D85EF67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675370769, "uuid": "d432fafe-f44c-4178-9a9a-7192e45fcee2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675370769, "uuid": "ecbad484-731e-46ec-98aa-8517362a8cff", "value": "49152:bgQNqGKFYlLrKxVxBdjgmMpHiB2kdECtMy5ixMxLCgv2MR:cQNqGXlLuVxBpyHEECtMyDv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675370769, "uuid": "579c8e76-ce4a-468f-9061-711cedd1aa27", "value": 2098904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675370769, "uuid": "bf55a777-acc5-4882-bdac-14f7010dd173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675370769, "uuid": "f1be26cf-7959-4241-b542-afdba380a5c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8445236-a30a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1675350222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350222, "uuid": "82d103ad-670a-467d-85ab-9adbe3cfe7e0", "comment": "Malware payload (Chaos)", "value": "697deef7b2ca6b79c3608ebdf9c70977", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350222, "uuid": "39af4d0f-a809-4a0d-82fe-6f710458c96f", "comment": "Malware payload (Chaos)", "value": "8a6aa9e5d58784428d0b1641e99f024438b20747993039e16b8d262f3f5fd347", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350222, "uuid": "1b1f888f-c12a-473a-8da9-67e2d51c27db", "comment": "Malware payload (Chaos)", "value": "64fb76029f4d7b3aa06646f286182daf4de2a27a", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350222, "uuid": "e9394ce4-15aa-437e-95c6-4a5a3834afa2", "comment": "Malware payload (Chaos)", "value": "d9e7600660f5100a70d5c962e1980cf08c1aafc360890c963ad599565cb595a2a8e07881b8033231deb4d63aa6609c25", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350222, "uuid": "affb87a8-a760-4721-a9ce-b17d619dc98a", "value": "T156D42B381EFF441AE1B76F3D5BE1722AE67DD7922507C21B3024478A6B23F819CC1666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350222, "uuid": "1872a13a-003b-43f1-831c-7fb2c06c1253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350222, "uuid": "b1e0ef88-3afc-435d-afe8-1df11d01b36a", "value": "12288:/g1YsKMSiS9SW35dmhqoeBsGJGKlOD4BZXu3lKG3pHLb4:/gd5QSW3rQqoeBsGJGTyG3JLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675350222, "uuid": "962638b5-e2bb-4da4-9e92-600e066efa04", "value": 618701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675350222, "uuid": "0c2ee362-dbd4-4578-8007-94746c55593b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350222, "uuid": "53c15f77-99e8-4ce7-801e-3586e16e4092", "value": "2023-02-01_697deef7b2ca6b79c3608ebdf9c70977_krakencryptor_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa047190-a2f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675339863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339863, "uuid": "5be54d6e-22ae-4025-82af-eb3aa1b7ffb5", "comment": "Malware payload (AsyncRAT)", "value": "111433346b5ca903e26c8489e774b6b4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339863, "uuid": "7a611086-450c-46a9-bfb1-b8853dab98af", "comment": "Malware payload (AsyncRAT)", "value": "8ad4f42e0e7ffa6d68f50ead4cbf115bea0935eb5ac921443d27bd3094998dee", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339863, "uuid": "b71d4619-46fa-4de8-bd28-c7f1b4ffcfeb", "comment": "Malware payload (AsyncRAT)", "value": "f2c6ac777a74a96b994c54cb76cfcd5cde8ed923", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339863, "uuid": "e70c53a7-1fa5-4641-bfe3-5b257257a076", "comment": "Malware payload (AsyncRAT)", "value": "7276fa9ef96cabe75b63de3e272c04b8147be63090ad4e33b9a8da80396bc6025e5355e36c2826bccd5510ca97887ea3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339863, "uuid": "f59bcd3f-3746-41e7-9c84-8cccec965197", "value": "T1DCE39D113AE5C8F9E6121432CA99BFD0D1F5FE690F3188A773C43A1C6E3C945C626A6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339863, "uuid": "f3bc20bb-99e6-4d95-8512-d2411e299bc8", "value": "12f12d364f5f6a801e52c9dce28d1965", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339863, "uuid": "516ce266-9eec-4bdc-bca6-c157363b7102", "value": "3072:X8FHdppuOf+wMSHjnywM0vY9t8Qkh+nXeu74NiSqmV1WbJzlDrj:MFPMOf+wMAywM0EJksnXJ74sm6bBVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675339863, "uuid": "6d8a8bc5-d6f3-44b0-a379-47d08e157d99", "value": 154456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675339863, "uuid": "ba38ebed-c0de-4f7d-9f27-81627765a9d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339863, "uuid": "0a7eca6e-9918-4c79-8dfe-c0f43d4b5667", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c3d1dd-a30a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Dharma)", "timestamp": 1675350219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350219, "uuid": "d531254b-66de-43f6-b6f0-cfabfbee7538", "comment": "Malware payload (Dharma)", "value": "8f43f5d7a93639cebd1ffd4e84e867a7", "object_relation": "md5", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350219, "uuid": "3b91d153-91b0-497a-9d6f-ab2d29632527", "comment": "Malware payload (Dharma)", "value": "8ade68d429cd44a78e5cfb108aac846eff7e04f57e4a92cb73c66de569eac968", "object_relation": "sha256", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350219, "uuid": "9e0ead8e-ce88-487e-977f-042df3b51dce", "comment": "Malware payload (Dharma)", "value": "4dfb2e434c91e0c849776cea07b952e55f2c0beb", "object_relation": "sha1", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350219, "uuid": "65582e2b-d047-4311-b3ba-f4fe2213f573", "comment": "Malware payload (Dharma)", "value": "b27392a937ef805ab6aa6ff6bbcc54eb0b79c5c73e060fe8fbe7e36ef83a68ad22e75cd905ca2ac371be854200d12dde", "object_relation": "sha3-384", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350219, "uuid": "5ec639d7-6343-44ad-9daa-57cc1ea7c01a", "value": "T1B4939D29E521C135F8A210FFCBFA55BDAD644B201307D4DB93C11E89AB869D2F932633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350219, "uuid": "a54fc716-cd6d-4e08-abfe-f57a99d115ce", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350219, "uuid": "0b5ca768-8aad-44e9-aa2f-2ff4a14c2a2c", "value": "1536:tBwl+KXpsqN5vlwWYyhY9S4AZkXTr3H3JnaRhuxWGbDRw6:Hw+asqN5aW/hLuTr3xoIWGbND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675350219, "uuid": "293d2fb6-c55c-474c-8a3c-5b39f7ed2c44", "value": 94704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675350219, "uuid": "1783885b-67f6-4ce7-af6c-f99303041451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350219, "uuid": "1185b963-402f-4242-9b2a-d00e493b9ef8", "value": "2023-02-01_8f43f5d7a93639cebd1ffd4e84e867a7_crysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0682310b-a2ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675345172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345172, "uuid": "fbb1d5af-2224-42f2-8f5a-af06d5bb6549", "comment": "Malware payload (RedLineStealer)", "value": "23433bb231fe79c4597a02145198a986", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345172, "uuid": "c5e91a75-598b-475b-bacb-b7ac99bcd561", "comment": "Malware payload (RedLineStealer)", "value": "8b21ba49206b5d19bfd65a2445e66d59b126dc0266bccccde0b606c6fed2f6de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345172, "uuid": "da993e9d-ecf8-46dd-8eb2-df4304d97dcb", "comment": "Malware payload (RedLineStealer)", "value": "fa00798a7b7b2963e91fe3d3ea010c5f2f14e326", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345172, "uuid": "0541dac7-6b3e-404c-900c-13d1e5479c7b", "comment": "Malware payload (RedLineStealer)", "value": "adec658351d05d8925c295af0f5f2549ac6b2dee062b96ee00c3eadb9dd731b5cb50a29dd39637ac3afc866e7b613aa9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345172, "uuid": "097516ea-0493-4a41-af6c-f0559ba949b4", "value": "T1EB740B887670FD9EC867C47F8A681C24E6636466570BA203B05317ED993D79AFE070B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345172, "uuid": "97f35352-83bb-436f-adba-4c28aa722c13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345172, "uuid": "367e9bf0-6dea-4bab-ad75-178e4dbcb173", "value": "6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675345172, "uuid": "15f44c40-5e1c-4e37-8951-6c6fb75bf334", "value": 344814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675345172, "uuid": "ff783748-b7df-4255-a27c-89be201bfacd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345172, "uuid": "8e509499-b877-4657-bc1d-0f630344e5b7", "value": "23433bb231fe79c4597a02145198a986", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3362bf2f-a327-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675362427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362427, "uuid": "bc319b88-291d-44bc-8315-e4b3b6403e39", "comment": "Malware payload (Vidar)", "value": "094506dab589aa3933fe28379d607e4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362427, "uuid": "3c7704aa-6b3a-4d4b-93e8-02fdf4d8c052", "comment": "Malware payload (Vidar)", "value": "8b45ddb55c917429dad237eac7bce95e29808c4157d098956144d19f247a1c0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362427, "uuid": "5bf80488-c727-404b-b481-00bd47242e4d", "comment": "Malware payload (Vidar)", "value": "78b35e6e1c254f31079ea22a35fe5e0dde83848b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362427, "uuid": "30c32963-9d40-4f92-b72f-aa8cd305f95e", "comment": "Malware payload (Vidar)", "value": "3f51b6574c9768c069979d725ac945fa7cbf4a839568d157a277d0b094b90caf9fc0dd6e448f537521fc26e39e49fd7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362427, "uuid": "199d7d95-0392-4aa1-a5b0-c1c443202af1", "value": "T1FAD5BF245CEAB1E76A9D7534DF42E6EA345B3105BC89943718D388DC1EB1BAC1EE1F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362427, "uuid": "42625c6c-a9a6-42ca-b95a-683f5b691c8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362427, "uuid": "8369ceea-0461-4b4a-b917-cf79b9390308", "value": "49152:ex04mKYkbtgQ/MwW/qvf7RZoVZZOHTjqFfK5r9oQSP1vh4CTRCC2OFj2OFS3:8juTq9zzWk99o11vhbTRCH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362427, "uuid": "cf183987-7acd-44c5-90d1-57668f453295", "value": 2977896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362427, "uuid": "21b3c5a8-05a6-48a0-91a1-10b033153d9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362427, "uuid": "0b3b0f33-9437-44c0-9849-5f532340ff12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81e2c09-a314-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675354597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354597, "uuid": "4fa7103e-0280-48a9-93f4-ab838dca9472", "comment": "Malware payload (GCleaner)", "value": "be74eb508d950d9809f16c323b399089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354597, "uuid": "d54a768d-84de-4053-8b4d-16a811fac585", "comment": "Malware payload (GCleaner)", "value": "8b8c5ac3ff9cf8660516f82cf46e53a6531e0af1e3b5be56e74e55912c136b47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354597, "uuid": "227ac578-c5c0-4a1d-90da-55b1b7db6aef", "comment": "Malware payload (GCleaner)", "value": "461cfca9041467bb118b2bc747047b643c156197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675354597, "uuid": "16fff1ca-58b4-456e-ac51-c2a6c6687608", "comment": "Malware payload (GCleaner)", "value": "ab7096793a49d049342f8fe0a294e2f024bd8de9d3f70cf6f96dfa6129f461fc027b7a1b261cdfcc2d370ce9fe5fd748", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354597, "uuid": "cdcf2cc8-90d5-4657-94f7-16411be1199b", "value": "T160A53382E1428337E099C376193A86097D33ABE24A34473575ADB14F6BF71C5F98B24D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354597, "uuid": "3a8beb23-46e6-4bff-a3db-5884a88b932a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354597, "uuid": "44f32d64-71f4-463a-9297-287abcb93325", "value": "49152:bgkZQtp7slf9tZUZTLAekHQgalX0vW/yMZ0LCgv2MR:ckZQtFsd9IVLAeeQ190+/3Zkv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675354597, "uuid": "6fb04a97-33e2-45bf-b329-cb10f6daba66", "value": 2071824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675354597, "uuid": "7c1cc647-e708-435f-8eaf-30616c4ef624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675354597, "uuid": "7541d0b5-ad6a-42d0-83e8-0747474e195a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad145e73-a2c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675322259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675322259, "uuid": "debe04c1-168c-447a-a4c0-6246262db09e", "comment": "Malware payload (AsyncRAT)", "value": "2bceb5c8c2a39af07abaa5a5c97e331a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675322259, "uuid": "3e4fef18-13d6-46cc-aa34-c6e893b3012a", "comment": "Malware payload (AsyncRAT)", "value": "8d07d16f63cb3b3a11c929cc58d0bad2428b4364b3ac76f09bc3e0f1df8f0483", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675322259, "uuid": "b4bdf400-b15c-4370-9a0a-d29441cb48c5", "comment": "Malware payload (AsyncRAT)", "value": "561847569c6287d9ada7e3b1ad551b034068d0c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675322259, "uuid": "198c1e6c-c949-4b50-9b0d-276358dd48c8", "comment": "Malware payload (AsyncRAT)", "value": "e867bad246f2f4296fac07c1283eea2d5969c649bd69d43225999b1eb3a2138821889992f149aba275b7aabfbf7e860c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675322259, "uuid": "ddaac3b2-84e0-40de-b085-5c073faf3f8f", "value": "T167E3AD597AEDCA83D25A25B4EC1668F04365DCACD462E31F248C7E2A7F733C4850276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675322259, "uuid": "ad462929-384a-4f99-b191-5b5be878a6e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675322259, "uuid": "6cc4d397-eaa1-4a1e-ac0a-906e37882f36", "value": "3072:4lMukwW8OcQA5M7CZm3GwrR7U6I2I4swxNVSogh0ay:mo9cR5mC0W54Sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675322259, "uuid": "bf9fd011-ab49-4a3d-aa51-e03215d39094", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675322259, "uuid": "a1e1adf1-cd33-4474-80c5-ede7c4b5c976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675322259, "uuid": "b5dd1dbe-218d-4679-95a4-6cce222b0546", "value": "2bceb5c8c2a39af07abaa5a5c97e331a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ebd733-a2f1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675339566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339566, "uuid": "062f8599-40e8-45e3-9d08-dba5338694dd", "comment": "Malware payload", "value": "aff30c5e7fb20c0942236d7dad9ada25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jaik", "colour": "#AB1E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339566, "uuid": "e103a51f-4efe-4de8-8163-3e39d197410b", "comment": "Malware payload", "value": "8d30e5ef4ac0fd3b249af6af394a17b1251671478533f989f4051e467428a7d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jaik", "colour": "#AB1E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339566, "uuid": "57ee14a8-c9a2-4526-ad2f-bafcaf98be55", "comment": "Malware payload", "value": "eec1f6fe2928d6e62ab52401d362e0786c617a8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jaik", "colour": "#AB1E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339566, "uuid": "fa3c59f4-1c61-4c1b-9fe9-5a0a5cbbf3a2", "comment": "Malware payload", "value": "297a48b130f68681acdac5e1eea6b5f2082b81c13d9c32cca0317badb303ebfdbfad75b67b0e4f4ce1047e06ccf5c858", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jaik", "colour": "#AB1E6B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339566, "uuid": "1d736e62-ba63-4776-a48f-a347628bc7d1", "value": "T19145AF32F753D072E8D200F552BEABFBAC6C6619072948D7A3C429754C704D27A3BA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339566, "uuid": "f643b53b-0ff7-4da0-9ecf-bb7d9c533494", "value": "2eca8f83bbee2f11ca833570183c37f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339566, "uuid": "d31edc71-0855-40e7-ae45-f08426d13d0c", "value": "24576:9KXg+xx9wiL/Zp/GPVzd/Mk/0FwgiiPtRbZxqMfx:y9w+X/GPxh0FwQ1vYMfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675339566, "uuid": "ae80d957-8a80-417d-aa12-e0c59cf8f2bb", "value": 1243648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675339566, "uuid": "262ccef3-9149-48ac-8e93-fd072b2a0f34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339566, "uuid": "94685ce6-a489-4624-90fc-de9a03513234", "value": "setup3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25686d8a-a2cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675324608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324608, "uuid": "361aab14-c179-4b61-b5d0-f8f89d89a6af", "comment": "Malware payload (AgentTesla)", "value": "3705837de89238077b3934dfe66b9c88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324608, "uuid": "19028015-9a42-4f05-bdc0-9efd75e7e01b", "comment": "Malware payload (AgentTesla)", "value": "8d3d94b6330378809e984089d9faf9639506575d8987a7f8f01d9b6b66fc74e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324608, "uuid": "845fdc7d-48f3-4b58-932b-a85843c6de6f", "comment": "Malware payload (AgentTesla)", "value": "97548e483e4772dbe46fef072bcc296ae900f74d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324608, "uuid": "4806227b-a931-4317-996d-31d94f9eba4b", "comment": "Malware payload (AgentTesla)", "value": "843b5a3165d5f3b1c147dfedfb679f0ebc5603ccc8a4516568ecf8d425c6bd2ac4f97a78582f41d54504859eee8233f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324608, "uuid": "868cd8ba-7aa8-4f7d-b2d5-d38fcba1d673", "value": "T13472D144F5BCCD7B81F483351DE2108913F8D9A0D1FB83F526B53329AADE506955712D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324608, "uuid": "fc063fee-ea3a-449e-9e80-57da424ab546", "value": "384:RfQdpbjIsfGo3nDYJb1PaV9YIKl0q9lt3d7EWSE8g5noyQF:Rodlj7nDa1Aapl7PP4jKo7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675324608, "uuid": "098e38b9-e15b-4418-8005-2c6cc53dbaae", "value": 16189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675324608, "uuid": "4a5cb650-dfca-4e7e-a10c-8cffd65dddf8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324608, "uuid": "60716364-8287-4945-b1b2-7242ebefa14d", "value": "INVOICE AZ340098.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05effae7-a28f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675297068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675297068, "uuid": "c916eeac-0e9d-446f-b027-661b979c89e8", "comment": "Malware payload (AgentTesla)", "value": "7b83d435365d83345fa3a9117fe4b784", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675297068, "uuid": "45e4b5a9-8953-4333-be8c-945307b9d27d", "comment": "Malware payload (AgentTesla)", "value": "8d4e8edf683d42f1f5287ae5d25f57d93285fd6b32f2198a1a2545cd17b05a1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675297068, "uuid": "4eb62059-2aeb-4a50-ba50-c4dcf460a6a0", "comment": "Malware payload (AgentTesla)", "value": "a437e84a6289b927e4d90294feba652853472bd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675297068, "uuid": "fcb2a329-727a-4f28-8c1d-369c0b9e4e53", "comment": "Malware payload (AgentTesla)", "value": "319635c0955d97869ae9c8ce123eb0e41f652d92ed4ec8c8e73def918cee2cc2f88aa0982eaf48b1c4fc3983e31bd2b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675297068, "uuid": "e33eeac7-dea7-49d9-b0f3-270eb2b752ba", "value": "T1B7A30E08A3EF5E23D96AD7781953F2722725CCA245A1C7031EC4ADA73B5BB822E500F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675297068, "uuid": "7323cdf7-0f5a-4578-b3ee-e6ca8912b7bf", "value": "768:YgUNNaXHErJkoOrGYPN3a+VflOD5NbcVfup+btYAJHa4H:YnNaXHEaZr33a+V9ycVfupotYyTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675297068, "uuid": "066c9f2c-17db-4104-9a69-2b9f6049fe08", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675297068, "uuid": "74149610-b5b6-496c-9173-1853a74c09f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675297068, "uuid": "f57fb272-898c-4095-b65b-79f9926f23e8", "value": "STATEMENT OF ACCOUNTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6a3548-a323-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675360857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675360857, "uuid": "0ed8e8e9-3dd6-4c1d-aa42-e8fd3bcad3c9", "comment": "Malware payload (GCleaner)", "value": "bf4167b6d85023974481afe4bbd91915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675360857, "uuid": "3c1bd566-26d3-4bf7-854d-92129130d466", "comment": "Malware payload (GCleaner)", "value": "8d8bde638b1102ca4a1745b250aaffc8c00325eb7bb337baa7d4c2b2aa553eba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675360857, "uuid": "a5206fa1-a67b-4d1b-9d5b-390f5fe9d811", "comment": "Malware payload (GCleaner)", "value": "6910997121f18af29dfa376bb19b52698102bde9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675360857, "uuid": "4a8d2bad-4ee3-48cf-ac50-1fa5c87a599f", "comment": "Malware payload (GCleaner)", "value": "0bacfdbed8cec3356ba5e3a393e1c35f435bbba07a955af2c3e64d3056ba918a1cd7ce88c9dd06fbb6596aa328c5c487", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675360857, "uuid": "979f5abc-ba05-4b45-8e14-490559e87393", "value": "T131A53317FA36CC7AF59383F5DE25E169B980AFBF91310114B04D038A072B2B1AA59377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675360857, "uuid": "a394f391-9e9a-4ae9-8de7-72f90a374985", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675360857, "uuid": "55315d2b-8854-4918-a0b2-97d33ec6b37b", "value": "49152:bgvOgJlotJxiE11BtN+QIBJG/axr9YtnF8v8Gy4h+jf6cQnLCgv2MR:cNivbPQG/htWu4hibQzv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675360857, "uuid": "7cd5307c-dc19-4ae0-a927-d93b8952568c", "value": 2079010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675360857, "uuid": "50e66fe3-e5d8-4ba1-b3da-11485a82eb71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675360857, "uuid": "78cf68f1-dfbf-4250-af14-a29b03923628", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc09581-a338-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675369852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675369852, "uuid": "ddb3ae4b-5b5d-4184-8894-2d0a89d0079a", "comment": "Malware payload", "value": "1dff8183014c0d70c0c3aee7adfb8266", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675369852, "uuid": "822f9638-5b5c-4620-8c99-116795a1260f", "comment": "Malware payload", "value": "8e555a0ab5347106a91b603e9d5d96bf23ba7b6f6fd7e892e9f6f7e4d82dfb61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675369852, "uuid": "6d808bfe-eb4b-4761-8755-3895640a2af9", "comment": "Malware payload", "value": "25ef8938b15abcc1c07cdf4ca292c2919a061f5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675369852, "uuid": "36661c25-e2dc-4a3b-93ff-2943c1cdd608", "comment": "Malware payload", "value": "a85f128e9f6f8fc7e4a6167f26eb4ab742e872ac411da7864f62ee7451b54da3b34e2e21210f2a6467d47fe8cc05efaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675369852, "uuid": "78c9bb59-2d0c-457a-9dd0-64b33354f6d0", "value": "T1D7647D02BAD2FC51DA21C7728E1FDBF47A1DB9514E69BF6A12185B3F18B2173C5A3210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675369852, "uuid": "635369bc-a384-46b7-9576-11b20b1f6d4a", "value": "2ff60b2f756b6533c2643b340c02a5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675369852, "uuid": "114ef0be-27ce-4c6b-a1c6-a692469417ca", "value": "6144:V48hLvUidn8hFwM/bAFbUlwKwpxIwjV6ptCbNKN:V48hjUu8Y+6UleI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675369852, "uuid": "e4a8a803-f7f0-422d-8c5b-65b1b6606419", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675369852, "uuid": "31985ac7-a5df-42f1-a4a2-bfb8f1f80dda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675369852, "uuid": "a35bbc27-e692-4b39-857e-978983e9eb90", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a60e741-a2c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675321207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321207, "uuid": "8559ffb7-7ecb-4151-9dbf-3239511744bd", "comment": "Malware payload (NanoCore)", "value": "6df2c2caaccc7947f8439f248cdd386f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321207, "uuid": "32c545e6-afa1-4cfa-ae4c-4bb82817c1d1", "comment": "Malware payload (NanoCore)", "value": "8ecc4898d03bf034a6586ff886d9883b2ac27d08bdfe70dbd9878a4d77d5dce8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321207, "uuid": "f8a438d6-6633-4dc1-b879-903fab10e997", "comment": "Malware payload (NanoCore)", "value": "419ab96d1452301f126f63ab7e3135c9201e3f61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321207, "uuid": "0b80e570-b7cb-43cc-8f2b-4c4ee7c4bf61", "comment": "Malware payload (NanoCore)", "value": "4b9130726e61be92d316865b65dd57c5f01a19c482873623993e2635012a4f66f1734e709cf5ec64d77a27a831993af9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321207, "uuid": "12ffef5e-7986-4122-97b1-38ea4285c700", "value": "T12A158D8737B1A8BFF68B407544283F886FA07113BF56E25397373A849B098FBB694151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321207, "uuid": "c12051c9-6829-4dcf-a6d9-ab266e907f23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321207, "uuid": "d361a8df-7b11-4da4-b451-9c44b7297a79", "value": "24576:IsC41FjAqn8/ysidgzWrSrLYo6F0xMpqG4yPa:JXjAANsSgzWrSvMWiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675321207, "uuid": "daea59af-d312-4c63-a242-f164d301eb68", "value": 934400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675321207, "uuid": "d1ca2dd8-61b8-4e3d-b621-131b488bacdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321207, "uuid": "1ffdff5f-da00-45d5-bde5-ae3fe73128fe", "value": "6df2c2caaccc7947f8439f248cdd386f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059ce5b8-a329-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675363210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363210, "uuid": "6a24e883-39c1-4efc-bed5-50ef22ec85af", "comment": "Malware payload (RedLineStealer)", "value": "838d046757f2807340f3da26861a13e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363210, "uuid": "13c117c4-aa81-4342-a2f8-1f1b0c92a0b6", "comment": "Malware payload (RedLineStealer)", "value": "8f15c8aa0b68db884f15a62c147f88fa2742a6cff8e656f49cef13ca84aaddc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363210, "uuid": "636cc22e-6b80-4d1f-8c4e-a3753597220a", "comment": "Malware payload (RedLineStealer)", "value": "97b9c032162702814301cdbae235f2eef5cb4fc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363210, "uuid": "5c4a1a28-ffc8-4423-9de7-30aaa077837b", "comment": "Malware payload (RedLineStealer)", "value": "78ce6c340b2ca17ce589499f29ed59c87c2b62412eab3446a48c14c758c9c5e8c02a4875ea365294b9d6779105b92ce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363210, "uuid": "16dcf3d9-fa35-4806-b64a-01d24426673b", "value": "T1A5740B887670FD9EC867C47F8A681C24E6636466570BA203B05317ED993D79AFE070B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363210, "uuid": "727d5050-0a94-46c8-bc24-587771aa7324", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363210, "uuid": "acc6841f-10ac-46b5-8640-d414aef5056c", "value": "6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675363210, "uuid": "6434c172-133a-45f7-8b64-3792e011ceb7", "value": 345289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675363210, "uuid": "40dce5bc-d0ef-4f51-b60a-9e293f347fec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363210, "uuid": "b424091e-1e98-49b6-bffc-4ad74606b7a0", "value": "838d046757f2807340f3da26861a13e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "215ac00d-a2ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675310428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675310428, "uuid": "20160734-8bb2-4185-9659-3a847347cc69", "comment": "Malware payload (Amadey)", "value": "d87245f621f741175f8b115f338ed94e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675310428, "uuid": "e771b4e1-cf0b-4c7e-b007-41f91e2345f2", "comment": "Malware payload (Amadey)", "value": "8f30fe8afc92b02ca3a0842d194c61ca495aac34307a5610942d1c9585adcc93", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675310428, "uuid": "29244dac-7c15-4f19-baa1-9281a4022bd8", "comment": "Malware payload (Amadey)", "value": "b90831639b1562af748e80c0ad378b183cddbaf2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675310428, "uuid": "c1e6b5d2-c09f-4ce2-bc10-2fd1bd410eea", "comment": "Malware payload (Amadey)", "value": "389345bb00bf68b7f83b5e51d02f48a8c31566a1118bbeda400f07f30edcab33cafe5c2512e65ee9d261b7db2ddde8e7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675310428, "uuid": "edb21500-ee99-4bef-9a36-2101a188cf52", "value": "T18934D0327590C072C5A711304C20E691BBBFB931567979DB7BA81ABE6F302D0673939B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675310428, "uuid": "d17a2da4-f0e0-4bd4-b949-8765e7155502", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675310428, "uuid": "a9dbf996-3fc3-4200-9e16-e66415363063", "value": "3072:olxO5yG25H6BLEiWX15oEc81PbaNEavnToGP+y1I1xoKu0:olthMLEimpccPbaCavTx+yml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675310428, "uuid": "93429f58-795a-4478-a842-a8e6cf3a0eb1", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675310428, "uuid": "7c314a4a-c2ef-4f6f-81f0-fb71d482e6a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675310428, "uuid": "b6b493b0-4055-4c0d-ac45-591308d59871", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f081644a-a2c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675320654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320654, "uuid": "c9141703-1e4b-4f27-9156-64f855d7d6d5", "comment": "Malware payload (RedLineStealer)", "value": "c9a04f74a6fccdd73cdaef10f65c357a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320654, "uuid": "ba6e6b95-b4d2-45d6-9a3b-15c586a2c0a5", "comment": "Malware payload (RedLineStealer)", "value": "8fb600b8f74db4b37a558ede015e4b8fd93ac52ea5439f48d74cfab53e32490a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320654, "uuid": "589ae390-3431-4937-87a5-a54f295ede00", "comment": "Malware payload (RedLineStealer)", "value": "bfb30e0ed7a5abbed0ff6842bb84a23e61d8d747", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320654, "uuid": "64ac3f08-597b-46f1-8df8-1555e3d143ca", "comment": "Malware payload (RedLineStealer)", "value": "a1daa5241986de0342a8f120ef11e497583a6cff890a02430c1909fdaa8dad5a65c46852ebb84664e7db5706d0a781be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320654, "uuid": "d46a9352-7224-479c-8749-7786c8d0a565", "value": "T13874F12339D0D372C56714309830EB56BBBEB03118B9951BBBA80A6E5FB03D1272B357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320654, "uuid": "2923507c-2c73-4dbf-b341-34a094d5e8c7", "value": "5b3e1365fd24e4232cba105b88665e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320654, "uuid": "384e5de8-383a-4998-81c8-aa4c09d3cbb9", "value": "6144:aTm3lYLu+bhxGHkv4usj/ZlntgYlrV+n+BCIWCF2R:aTqO6+bhQHkYhlntgYlh++nRF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675320654, "uuid": "5474cac1-9263-4358-a97a-9f5c53ba39dc", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675320654, "uuid": "20a4f198-0bbe-499a-a168-ae7409acc3e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320654, "uuid": "64e31608-c14d-4cba-b909-06e492615e30", "value": "c9a04f74a6fccdd73cdaef10f65c357a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5feae0df-a2e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675332008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332008, "uuid": "00a1e44d-0d44-4375-a4d7-e77c97302e1f", "comment": "Malware payload (AgentTesla)", "value": "0c2c047a1d2c4ff8fa6e686c23efc053", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332008, "uuid": "6cf8a23a-f412-4f48-8c1e-245f49233088", "comment": "Malware payload (AgentTesla)", "value": "910a3e2b42fc09af8ec79b33d06ed634686afa36fe89c339fe9fa3e0705b703a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332008, "uuid": "5f7bb58e-4da3-4c7d-8161-60bd7924f74f", "comment": "Malware payload (AgentTesla)", "value": "314f690b9c8fc7bc9221118ce53db1a5e1ae9298", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332008, "uuid": "38b103e0-9c34-4581-94d1-8d47c88e9098", "comment": "Malware payload (AgentTesla)", "value": "7a01df91a2e9bbf169febd327d65ba1ac8b2a34342686d5961ff357a3de615ad6a6d2424582184647678d7be1104a80e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332008, "uuid": "fb65ebaf-81d2-44ac-9564-4264ac5964ce", "value": "T1D3157D8777B1A8AFF687407154283F886FA07013BE46E25797373AC49B098FBB798151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332008, "uuid": "a241bc7c-4d1c-4230-b654-95ff7d33cad8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332008, "uuid": "fd95e270-df1a-43f6-8c4f-37b1112e598c", "value": "24576:le6F0xMWE7M3Az1c2F/R29IIejoqG4yPa:lWiH7Mf6R3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675332008, "uuid": "33238597-afa4-45d8-9e58-972c5c0790fe", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675332008, "uuid": "65d26dcd-ccc4-4fd1-a535-de9a9fabbbab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332008, "uuid": "40b396cf-ae19-487a-a446-29f8c7ba6b72", "value": "U820764D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10119417-a30f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675352060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675352060, "uuid": "b36cb5ad-4774-4463-9a10-7be1b53bd24d", "comment": "Malware payload", "value": "c187268b466a3059073a1494712b1e72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675352060, "uuid": "9ae023d2-a82d-4ea4-9284-ff38afcceaa3", "comment": "Malware payload", "value": "912a709819892a175b2bed25888d0e8f4d665a78eaba17d5466da17361a2dad0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675352060, "uuid": "f0e55b1c-28ec-443d-99d8-fd236c46094f", "comment": "Malware payload", "value": "d641934c7b038fe5b543d93bac4c342514587d66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675352060, "uuid": "be2ff10b-1498-4c22-ac58-9aba427d33c6", "comment": "Malware payload", "value": "8fdea4ef6e193fe73c8d1881e4a5722a51c37bebfd67644fe9050bb0431d387133da626cf8bdbfa61bd28b527a887125", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675352060, "uuid": "cc8c9891-e8f8-4d56-9f17-75b0f9e15cf1", "value": "T135A3024132C7679ED4122E3820F7CC719B72A8553CF5AC2BEAD4F1E9EB4111BD2958B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675352060, "uuid": "d1ff678b-d79f-49ff-8a10-6c53dfb8b672", "value": "1536:W6aXdGP4rr+RRm5Q3UV+XAJ+1SGQJlYGlm2YG6pHWhwuKJifSfJggBGErqahP/qg:W5dGAqDqP+gPYHWwi8JmEJh685Ug7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675352060, "uuid": "2b9feaa4-2dfb-4ef3-86b7-d16e4b4cad5c", "value": 107152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675352060, "uuid": "8237e716-6607-4ce2-900a-b55c2181cda2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675352060, "uuid": "b10dad6a-5478-473e-877b-63c4fa87df74", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.6245.25884.4242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd09d2a-a29d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675303305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303305, "uuid": "e8ad571e-4ac0-475a-87a2-32305ee79bcf", "comment": "Malware payload (GCleaner)", "value": "ecf701dff8e4cbf7aaa5de5b88f388e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303305, "uuid": "b34aad79-444e-4e32-ad93-1af09163a803", "comment": "Malware payload (GCleaner)", "value": "91c9550525e7c4815c258d626cc3e60ecfd4ee8aa9a8c8b8f89a3c0ced57449b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303305, "uuid": "4e379073-522e-4146-8ca9-ed16f84460f8", "comment": "Malware payload (GCleaner)", "value": "53ad1cc3c29f73b3fd2b13ebd6cbd41b5d7f3f87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303305, "uuid": "86f02363-18da-431d-b8f0-4fe08d9f87c3", "comment": "Malware payload (GCleaner)", "value": "8184b887753e0d5860215d140f75c6facb257e07f7788de6eba0c49de57b9785a4f6f2f070f3e3dd5eee4f0010ba152a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303305, "uuid": "867d3a39-2081-45ae-bcbb-e5e311f3ab8e", "value": "T1F5A533229879CD37D1513EF84921C072F3B16E9A367A8301B1E67E4B377EB924C09B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303305, "uuid": "0349c58d-b37f-4611-9cb3-1ecf085bfe2e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303305, "uuid": "9eb06e6a-960d-4819-9594-319bc20f39a1", "value": "49152:icPLnQdazwwAgedPWuvNgCCeUrafdV4RVIY7pTjYXpZLCgv2MR:XPLnQSRIVgS34UY7d0zv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675303305, "uuid": "8a1f1682-e330-4a45-9922-eca2613d26dd", "value": 2230007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675303305, "uuid": "0b130b58-4348-4f3e-b466-04eedd3ccc70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303305, "uuid": "fdbc6027-8d13-4e8f-9074-78b06a932847", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f08e785-a34b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Arechclient2)", "timestamp": 1675377936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377936, "uuid": "fb758bb0-099e-4e16-bc9d-20a7a70e1a9c", "comment": "Malware payload (Arechclient2)", "value": "88c98533ed7883475b8b48f07d8dff9e", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377936, "uuid": "72bbf37b-4f4d-46bb-9d02-885f86e3976f", "comment": "Malware payload (Arechclient2)", "value": "9248bee7564f0d6849844fe5f57f1a2d8c0327f2113f594485449ac2539fe987", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377936, "uuid": "22dcda10-11b8-455d-bd36-75a2dbd7fd91", "comment": "Malware payload (Arechclient2)", "value": "375e72a8a376f443ed366da805dbeab3641c34fe", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377936, "uuid": "6ea5b01f-b3ab-493e-80ec-511e508848be", "comment": "Malware payload (Arechclient2)", "value": "270b6c261815a2aaf18b4d59500632d12a73e748db3df1b55657e6d8574980ef77e9d08f21f10ebc15fb1152484d4fd8", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377936, "uuid": "4877f572-198c-4dc1-9dca-a116c6df047d", "value": "T17275223AF1C0E473C0710D78CD96D2E4A239B7213D1D645F76E91F1D8E361A256AE28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377936, "uuid": "72a8c57c-95c3-44cf-b0d1-dd71ce311008", "value": "baa5b88b6bb86e914d34b43be035dc81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377936, "uuid": "8d2c53a2-6087-48ed-8d89-0af534180233", "value": "24576:OWmAFubS7x/dzvikB31a3xkpIe4Uuh6Rv9nYZGbfLV36bAIJ2zzP:e275d3BDph6MvZYZ4fLVkAI4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675377936, "uuid": "f10cc0b6-eb8b-4790-9720-66d226ad0dfe", "value": 1690706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675377936, "uuid": "71b4893f-4691-4f5e-b6cc-28f8a2a8e8b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377936, "uuid": "e2da88e7-a5ff-406e-985e-4251025cb1e8", "value": "9248BEE7564F0D6849844FE5F57F1A2D8C0327F2113F5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4155061-a2e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675334753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334753, "uuid": "e16be1cf-891c-4fd2-b76b-af7c07771d95", "comment": "Malware payload (RedLineStealer)", "value": "edcef5c438b6dcc5577fddda5ed4d3a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334753, "uuid": "d9cd3387-cecd-4d9c-a6cf-c8961ad84f34", "comment": "Malware payload (RedLineStealer)", "value": "932e06ef373d93ea1cde5e4fef13d321e5ce8b3b707be937e87264fb64c3a545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334753, "uuid": "fa615e78-02fd-4c7c-bcf1-1838b9d0a119", "comment": "Malware payload (RedLineStealer)", "value": "fe528c9c99f71b5b57135e78e75930709adb00c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334753, "uuid": "f1c9b30f-7c73-4d8c-b5ad-7648f80192e5", "comment": "Malware payload (RedLineStealer)", "value": "e43978c5e39f356a0c315ab60361fe2a8d788ed084895963524ef0cafd9b2004a780780e8466ab1f1c0e05f2a20ce8cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334753, "uuid": "72355877-b11e-43d4-9b9e-1f268bdd0339", "value": "T16594B01272D0BC4DEAB587319F1EEBE4796FB9508E0B637A1214AB1F34701B2CD62725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334753, "uuid": "27670775-0012-4154-aac7-62e395098d34", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334753, "uuid": "6dba4d1e-2b3f-4aac-a614-8d3ebd6293f3", "value": "12288:yuOPg6ULiv3/tptEjL6EPybrhc9CJb7d5:RUgBLm3VptEvnj9qb7d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675334753, "uuid": "0bb67325-4269-4382-82e2-31e3965028d4", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675334753, "uuid": "3e1131c4-d5e7-4f18-b649-31dc727eb342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334753, "uuid": "9e67e5ed-f807-4975-a74f-f4c9ce6eeb95", "value": "edcef5c438b6dcc5577fddda5ed4d3a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d45461ec-a304-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675347665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347665, "uuid": "383eff6f-f311-4358-a342-c6a4941fcc99", "comment": "Malware payload (SnakeKeylogger)", "value": "0ad901aecff7abb6941efdaf3b1ec866", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347665, "uuid": "bebc5505-716a-4c9f-b75b-1489c720bd8b", "comment": "Malware payload (SnakeKeylogger)", "value": "9354b4508b68e4610346573ceee0b88a8c356f9683f9ea6bdce5d704b2723539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347665, "uuid": "6b000501-63b8-4e7b-a5ec-7a6ea90c8956", "comment": "Malware payload (SnakeKeylogger)", "value": "973981e05f05851c810f98e064a5b07bb9db07bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347665, "uuid": "ce745b11-ae78-4243-aaa5-a43982aff33c", "comment": "Malware payload (SnakeKeylogger)", "value": "33154ff9beb3e2cc48009daeca704807f819760e00bd4199c7a49ad1d394242eaa1dac8c8cbf03346cf172238be37acf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347665, "uuid": "86cac78d-7cfb-4e79-a0a6-b1d4427f0203", "value": "T181057D8737B1A8BFF697407154283F8C6FA07113BA46A253973739C4DB098FBBA98151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347665, "uuid": "b302ede8-0068-47e5-b354-da1bd7c62191", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347665, "uuid": "2007d912-ebbe-4859-a9f4-b3e8d379778d", "value": "24576:JrjGZv8a2/96cotAnM8ypQe0F6F0xMpqG4yPa:p09AvnQWiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675347665, "uuid": "35a2918c-e691-45f0-b197-794e434d22ed", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675347665, "uuid": "d8ebc58b-eced-4d12-92dd-2547e4b2fd74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347665, "uuid": "d2e7acbc-d5b5-4e51-a563-19e24263f304", "value": "0ad901aecff7abb6941efdaf3b1ec866.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732834f2-a2ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675338053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338053, "uuid": "59b5cec5-658c-4895-95c9-db2dbdb52f75", "comment": "Malware payload (RedLineStealer)", "value": "03896b0acceca37119af6673fdefc75e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338053, "uuid": "9a3dca7b-65ff-4f67-8e8a-1cb747c6209a", "comment": "Malware payload (RedLineStealer)", "value": "9366cb55bd2fd2021696d0c007781a9afd01cdfd88bf575b627d8346c0c8a7aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338053, "uuid": "3308cf51-ae2a-4b3b-8448-73ff7bc9aeba", "comment": "Malware payload (RedLineStealer)", "value": "2b920ced4b2e1cfbe37de79cb1169ddfa28ab708", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338053, "uuid": "47de753a-1179-4134-aab4-7ea2915dfcec", "comment": "Malware payload (RedLineStealer)", "value": "40529f036f16d50df4c3a009bec0b0ba011d820ab693e4bef9608dc70c10c1164dfb07c9f68c8a7fb007a917405a9b8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338053, "uuid": "613423a6-c9f1-463c-8a47-ff7f72124575", "value": "T19E740B887670FD9EC867C47F8A681C24E6636466570BA203B05317ED993D79AFE070B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338053, "uuid": "9f0094d9-ae2d-49c5-8cea-df4f5ebd0eb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338053, "uuid": "e76e1aa4-0672-4ef3-b84b-d28d218483e0", "value": "6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675338053, "uuid": "091512c4-adb6-4de6-93c3-ad52782f420d", "value": 344421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675338053, "uuid": "ae5b9b6d-0824-45f2-9fc2-45e6e8fc275f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338053, "uuid": "29abf922-86e8-4a4e-b557-fceadd83b733", "value": "03896b0acceca37119af6673fdefc75e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a36506f-a317-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675355728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675355728, "uuid": "87d2ada2-0028-4511-92d8-57dd6ccef1c4", "comment": "Malware payload (RedLineStealer)", "value": "d1433f5b2eada044678af57d87ee31e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675355728, "uuid": "03b2898d-d942-4992-a580-a52630f5ae75", "comment": "Malware payload (RedLineStealer)", "value": "95702883e883a7fa3f7f20ecf6713b03cd00469644d777b73f36351db97ef3c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675355728, "uuid": "a003e122-7a2d-41ac-acf7-aaa7373b899c", "comment": "Malware payload (RedLineStealer)", "value": "0493152ee8d18335fa5043be0f80d12331f2ea00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675355728, "uuid": "9a58384e-dfdf-44f2-b3db-8eccfeee47db", "comment": "Malware payload (RedLineStealer)", "value": "072e2fd953d15b61251ae392756e9c86f701aeca364810dec599398fef3ccb4c98cc2fd9c08c83a282b73ee1a70ceeb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675355728, "uuid": "e236b888-58ab-4fbf-b0f0-2025acfffbdc", "value": "T164A52303E5E685B2D0720A365A29EF69347DBE206F458FBFB3892C2E85701917634773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675355728, "uuid": "3ac3179d-1785-46ca-a4df-5b3c404669e2", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675355728, "uuid": "2bdd3d73-1f10-4870-bbbf-3833c66dc471", "value": "49152:V5OaOl3UYvrbFueD40EJbAXOUghn/WsAXZ//t:V59Q3UYvrBusTM8OUgNLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675355728, "uuid": "6ff7d383-d6fb-4e93-9d1f-c3defe1b748d", "value": 2150907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675355728, "uuid": "8d1188ac-935b-4e01-aad0-8fd5e2194953", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675355728, "uuid": "44e76094-b781-4105-811c-2aad69b059e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91145cb4-a2b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675314911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675314911, "uuid": "17e1c4b5-8b77-46ed-b0d2-ae87edc4678c", "comment": "Malware payload (GCleaner)", "value": "40a10ce2b86fa64965773268e98ec74a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675314911, "uuid": "58b75f2a-49fc-4eb1-a64f-2afbdf799658", "comment": "Malware payload (GCleaner)", "value": "961541ba2f20ae1f9eda970515e3a453a89cac0395d73d57345a8e07bb839870", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675314911, "uuid": "71f2ba8d-89c5-428a-ba1a-56a2b3090f72", "comment": "Malware payload (GCleaner)", "value": "ca14b2bacfa627241eb15d0955c28f01013624a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675314911, "uuid": "126baab9-e6cc-427c-bc3c-f2a2fa44da74", "comment": "Malware payload (GCleaner)", "value": "07d28bf88ee3070fa5c80972d61aa1f9eedbec6ee64bf2e033b18d16de37c69202d3ff456fda3a3bdb69f00eed638128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675314911, "uuid": "91ef9d7a-ed48-453c-a47d-0ced570845a2", "value": "T1C9A53352A6226436F2E1C5B17C33CCC1FE39BF6866317011385DE6CE9F772121A6AA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675314911, "uuid": "698839f8-b0a9-4471-a886-95815bf23f43", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675314911, "uuid": "1fc3a2da-7177-4650-9527-62e5a3b50d1b", "value": "49152:bgvCcuf7PSUBVIRjGMyXDlbeWRIk3pyRJcLCgv2MR:cqcuf7lJ95yEv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675314911, "uuid": "3049a7d4-1b1d-45e9-8fa2-51aaa364b2ee", "value": 2110769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675314911, "uuid": "b24d4835-6122-4c64-9c1e-54d3fc97a98a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675314911, "uuid": "26b30ab8-48dd-49a6-b935-592b7fd514fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f4ebc1-a2e5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675334275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334275, "uuid": "74122b8b-18b3-40be-918d-49e20820734f", "comment": "Malware payload", "value": "8ca28702c755c3722b28269c7b07677e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334275, "uuid": "09fa0f52-ea4d-4dc5-8a0c-8a62189babc2", "comment": "Malware payload", "value": "9623ad0b0988c2e735a5707dd7088cd7dbdb40793fdd48efaee57900f9efa2c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334275, "uuid": "61794094-65ef-4313-9e9c-8303de675a2d", "comment": "Malware payload", "value": "03851a2d95e1fd8a47974fd99144217d5ecc86af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334275, "uuid": "35b0d33d-a3d3-4b6b-937a-2df329aec7fc", "comment": "Malware payload", "value": "67422ba7e0ead7a799d8be9dda6bbd1af9d8711086c7a896ff4a5f6491a1ca52948999f0c9f1abc7123a6b57e938ff6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334275, "uuid": "0e81b21f-8535-4840-ba9f-4e06ca1d760d", "value": "T1B47633203FF665B0C0909137FB983EE85131A0A58D91C573D3AD8D5E6F3C069E53AA9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334275, "uuid": "a2b0a3b7-34b1-4564-a00e-4cfae33f3846", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334275, "uuid": "9b108cf6-a211-4091-b586-cb088c90a076", "value": "196608:91OE3dAocK94opgQ+u0v/TYcqXOOgsTtAMBCPnM:3OEtHjWQ+u+YcWNTtA5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675334275, "uuid": "bc94c357-f4c1-4987-bc30-104eae62ffb1", "value": 7652547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675334275, "uuid": "c8d3cd3b-b5f0-45bf-ad42-81b4f5d7366e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334275, "uuid": "bf85bca7-8425-432a-b3c8-3a959f592d72", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108e625f-a302-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675346478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346478, "uuid": "b4fcb7ac-89cb-48af-9a9d-bded54c91928", "comment": "Malware payload (RedLineStealer)", "value": "1808eb6f26588ff256c9b10375b234d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346478, "uuid": "8095c4f3-be36-440e-8754-5dc948e6802d", "comment": "Malware payload (RedLineStealer)", "value": "966d8abd0c9e9ccfaf38c8a492be749847fed9dea13cf73b513a5185c52b913b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346478, "uuid": "a8b0bc3b-d408-4bdb-9f1e-5dc269de9d7f", "comment": "Malware payload (RedLineStealer)", "value": "97366eb321d08a208163c45d4fe184b753227a88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346478, "uuid": "2afefe83-bf84-487f-b940-ab22ef5c555c", "comment": "Malware payload (RedLineStealer)", "value": "faba7c3b19ead8fdc8a6ad8400684c66eb5f53c55ec384c943cb3f766d321ab304a4950cba2cce9c7278fd1f42f0a8a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346478, "uuid": "fc5d4d6c-5c0a-45ca-bc70-57cd680bed55", "value": "T1C694BF42B2E0BC49E9358F728F1FE6E47E1FBD508E5877B61318AA1F14711A3C962325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346478, "uuid": "f94fa977-b0b3-43b3-ba38-1a1ee4367b49", "value": "d9bb3534629ee1e0adad5f89cd30d412", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346478, "uuid": "d438be33-6d0a-463a-b924-0f0fb2128dc4", "value": "6144:L3enLGybhxIojXIbqPx7G2y32e6CoLoyHXjPNxx59/CJTk637eQfnd5YtBD:ga0pXIuxG2y3F6CooCPNv59CJb7d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675346478, "uuid": "1ba81af2-f6fc-4203-9758-6cfcb685930d", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675346478, "uuid": "3fabe3fd-fd29-4345-9aae-90bbe11463e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346478, "uuid": "fc767dec-4394-49e3-9de4-e16326847694", "value": "1808eb6f26588ff256c9b10375b234d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13e1a36-a2a6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675307314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307314, "uuid": "03636370-3c95-473f-8c6d-d6fbfd8c8c48", "comment": "Malware payload", "value": "039443c1f76642d717fd28f904e7d7bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307314, "uuid": "9996ed61-b9ad-4bfd-af9a-d81b59883e98", "comment": "Malware payload", "value": "96ab912e1a44d60fe9d54cd2a8ebc3f09eb17ef1f9eff76bd6151851af0e3c9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307314, "uuid": "e2df3574-d2dc-4b6d-b366-1643240c6fec", "comment": "Malware payload", "value": "32fc1879bddc17a71089ace0c2d888eb5a52be4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307314, "uuid": "b6a652bd-5b3b-4480-a739-743523fa5e14", "comment": "Malware payload", "value": "8fbbb6379b65aa1e749dfe2f426082a3bc28595f3758b74c332d23e85cf1bdc54a31f648ae25879fa802b0b8c2d0de7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307314, "uuid": "2986b60a-176b-4a9c-8194-8fd0202217d9", "value": "T10FA35B5EFB66C837EC1415B1816F7EB8821BED146F5042055AE8FE6F1ABB100D63E122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307314, "uuid": "e816860d-077e-4350-9f77-e2e44dcdae9f", "value": "59c90a6fe23e38502acae76880bb0754", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307314, "uuid": "acf10fc7-13f1-4663-9513-d3f09491c385", "value": "3072:Z3+yl/XUoxzImC0/N874Tt1wJxqUBQz88HmUyDJ1EsNN7/OyDf+4EHcdvAHvUoDi:Z+mUaImC0/N874Tt1wJxqUBQz88HmUyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675307314, "uuid": "ebb759c6-b166-463e-badf-8c2129cfcd7c", "value": 104482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675307314, "uuid": "d334e55b-f03a-42f5-9eee-052a31c51dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307314, "uuid": "176b0ee6-6819-4a0c-9c7f-6cdb6d334bd8", "value": "document.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33afb332-a2f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1675341812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341812, "uuid": "b2b39acf-caee-414a-9a42-0a2c12476d8a", "comment": "Malware payload (zgRAT)", "value": "d72cb8f8c13071f104e38525402cac22", "object_relation": "md5", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341812, "uuid": "1b46d216-bd69-45b1-9b0b-5895b530a060", "comment": "Malware payload (zgRAT)", "value": "97433fbe8a67f92df2245d7c35ae714e94d6a8875e5d38335adc540777f09a47", "object_relation": "sha256", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341812, "uuid": "ccd2fdae-5789-4688-9bb4-66a48eed47a1", "comment": "Malware payload (zgRAT)", "value": "55f3d71a208fad62526ce2de9b0bdddb300081f6", "object_relation": "sha1", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341812, "uuid": "7f8c9428-f23f-4c62-85cb-2982bb1011d7", "comment": "Malware payload (zgRAT)", "value": "06daa4102e2ebeae849139b3e070d257a76ec729874f0116c34716b178fc5298de3dd25db0c3aab9d6b961514e6e8f6c", "object_relation": "sha3-384", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341812, "uuid": "e3d12603-0bf0-4dbd-b4e0-9e4717e53a0f", "value": "T180054D17855F578DDD09BA60001B5C89FF9DCAACBF75BBC8A08F80E910EA3920B455E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341812, "uuid": "9dcb9abd-6a46-4b87-9e0a-0920802c0bae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341812, "uuid": "de84496c-75e6-4b28-bef6-0cb2e5e68a0c", "value": "12288:lVaXubHbaWv0KjBVXc3RZ4BtlIrDfVGLaDLV6odWBYSBxOiuM/fxXpIZLuCGXpII:lVaXujbvz9IE0/MONox6ZKGam8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675341812, "uuid": "948e6fff-ea7e-4640-98ab-6d150112ec36", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675341812, "uuid": "8d3b8057-1b11-4d43-933e-06ebd77e3fc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341812, "uuid": "c030f511-faa4-4723-b01b-a978c80c6526", "value": "Paralysis Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c47856-a326-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675362322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362322, "uuid": "dad53b5a-0d9f-4547-be3e-d17f3b53a779", "comment": "Malware payload (RedLineStealer)", "value": "2640c694829c4a7d31175c3a5b9e8c68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362322, "uuid": "19012287-8087-4a74-ab7f-bcb7cab06be6", "comment": "Malware payload (RedLineStealer)", "value": "9b937c2d0300b162822d6aefaadd4a05aa6005444a6ebb0c34be78019f50da8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362322, "uuid": "6ab6ccfe-49de-41e8-8593-28d7ceb6fa43", "comment": "Malware payload (RedLineStealer)", "value": "42604e53f93f32a5fefacf3c0d39c9c5a3f2d66c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362322, "uuid": "af689045-7fa1-4f1d-897a-f6ecb729a3fb", "comment": "Malware payload (RedLineStealer)", "value": "7fc7402d4d03c5477e563254671196e07c05d8b2312d03798fa2ea6b7a0036e8d91313ab2a092f93ef1066c93dcf357b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362322, "uuid": "5512cd83-f772-4dc2-bf4a-5d1e84586456", "value": "T10794C013B2D0FC5DD9354B729F1EFAE4BA2FB9408E18F7761314AA1F18701A1C9623A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362322, "uuid": "2abf90ef-8811-4072-a9e2-02f8fcfbc0b8", "value": "64f2017133017378e6738b9a4be235bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362322, "uuid": "c8a87b78-d1ef-4907-b763-e5d2a6e1682a", "value": "12288:UUoavRFka1e7H1vwNJrodCVzWb9CJb7d5ZZ:15KPWnQMzWb9qb7d5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362322, "uuid": "efebaa34-13f1-45c6-8b60-da64666c51f1", "value": 435712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362322, "uuid": "7ea75db5-2bdb-45f3-b293-5d919ac465be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362322, "uuid": "7e927e05-158a-483d-b90c-fc1e271c42e3", "value": "2640c694829c4a7d31175c3a5b9e8c68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a717f757-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675337281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337281, "uuid": "be7dda42-4549-4eac-a0c8-84f46c3d896f", "comment": "Malware payload (AgentTesla)", "value": "353767ae4aabef05a4ad871c290e62fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337281, "uuid": "a564e635-af75-4043-aee1-d68183de7594", "comment": "Malware payload (AgentTesla)", "value": "9bab499bc1624d4dae5a0eef53ec2932ef9ec4cc1ba5b13f7daad130de651e7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337281, "uuid": "006f7295-d23a-449e-8cc4-33032d0ae6a8", "comment": "Malware payload (AgentTesla)", "value": "4d53498a0b343680bf5bda29cbbbf6ecfd5dfa54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337281, "uuid": "39a89f23-ba5d-4c31-a342-6223917a83bf", "comment": "Malware payload (AgentTesla)", "value": "1dad7e43dbde5603de73cd66545214d9192e6686e8d803208b8f4574f6bbeb5d716f241a192fdcab3a4a1d0dbb99332f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337281, "uuid": "9f702651-4eee-43c6-bb18-28d4e1bd8767", "value": "T1B2158D8737B1A8BFF68B407144283F8C6FA07113BE46A25397777AC49B098FBB694151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337281, "uuid": "089715ec-4de7-4a31-b684-1de51b603d5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337281, "uuid": "e9093857-4f25-48f2-98f6-5f438ffbda01", "value": "24576:Yxr0HQPe7QiypPCsooBD6avAV6F0xMpqG4yPa:SWso6PCoVAAWiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337281, "uuid": "c02d7516-a2ce-4a66-a07a-a40e462573ce", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337281, "uuid": "7c5f1c94-1292-4cf8-b897-834761745a0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337281, "uuid": "4ccbf584-bde2-4751-9f68-dea543964cdd", "value": "DHL Doc 8318869311.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f770c0f-a2ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675345187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345187, "uuid": "6552a619-d5bc-41b4-800a-d1d056c535f4", "comment": "Malware payload (LaplasClipper)", "value": "ec18563c1adbf599ea6561b1c1da1e6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345187, "uuid": "896af244-bbe8-4a37-a444-73c48a3da153", "comment": "Malware payload (LaplasClipper)", "value": "9c4f46a016b340b3ccde483ed280083c933cc05c0f62f305b1fb3fcb76fe6a42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345187, "uuid": "c9ee5d96-6833-479c-8d89-28c9ba2292d6", "comment": "Malware payload (LaplasClipper)", "value": "91357b76bcece4918e4d4cd0db8360f420b8d61f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345187, "uuid": "914af623-8486-4197-a468-8ec79978b213", "comment": "Malware payload (LaplasClipper)", "value": "7c86f0eb21c31113caac2530fa03d590a2e211c0340c1857d420f8bfb1c0631f4f6255e3635e9ec5c5d17ef6e555a800", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345187, "uuid": "c33569f8-5b20-490b-9e02-c1c1160cca2b", "value": "T1A5853391F8D64473D56D19741A1AE3E3AF3F0887F53C82472BE46E692FE8280571E398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345187, "uuid": "2e5fb65b-e1b8-419f-8a23-65ed23141bbc", "value": "20540b45038474bafe70cf1c181e44fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345187, "uuid": "3a0610a0-f3bb-4214-8fcb-8942f1c0a466", "value": "49152:TELVE/GqgKXFEgbXgyQqsprvQ1RExpPE0kblOis:TEhENgKVEgUqMrQ1SEVsis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675345187, "uuid": "060f52bc-35cb-4c53-827c-9df59bf2dd72", "value": 1826816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675345187, "uuid": "fe5a5737-f71b-4b37-beba-c876e0764cbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345187, "uuid": "cc05f4d8-4835-436d-8f25-458672b7396f", "value": "ec18563c1adbf599ea6561b1c1da1e6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ffeb5a5-a330-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675366341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366341, "uuid": "af8ed03b-8df7-4c46-ba78-f3764f470e33", "comment": "Malware payload (SnakeKeylogger)", "value": "cc85ca802857b7b8c8d387e0c955ae78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366341, "uuid": "38e8eb0a-801c-4917-8fa6-602039ce546f", "comment": "Malware payload (SnakeKeylogger)", "value": "9cdb2d1ee24e1074a50d1d75ab57418d72d19b7e3fc8c33385e7329e81c24951", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366341, "uuid": "06df2ff9-dbb4-41d2-92de-1f629fca213e", "comment": "Malware payload (SnakeKeylogger)", "value": "619a03b2629f2d19aa00807ce2ba9ae20dbb4c69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366341, "uuid": "4d6e86f0-9daf-4b7c-9156-3eaed41e667e", "comment": "Malware payload (SnakeKeylogger)", "value": "f08a50bc5f5899a16453829b555c7d9dba1863f36edd19e083dac0c188406a78749734fb53b7bc62c61f5c21e4a9ae45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366341, "uuid": "3d79fde0-7fa4-4c3e-9c47-45cd26bbb0e7", "value": "T12A058C9337B19873F68B10B5142877CD2FE07603BE95A253A77B7AD09B118FBB298141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366341, "uuid": "c968b522-9df4-48b8-9fab-163e8cc903a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366341, "uuid": "a61c3e97-4133-4d5e-8545-1d47699a9931", "value": "24576:71dH+AX6F0xW9u2LbMCCUapMl7xpqG4yPa:7PHrKWoPTCUapMPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675366341, "uuid": "fbea312e-9bf8-4a38-bac8-ae6a03a0e4e4", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675366341, "uuid": "ffff3936-edab-4948-9469-9bcee1f95075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366341, "uuid": "6da2b415-3356-46fe-9aac-24a33f95d7b2", "value": "cc85ca802857b7b8c8d387e0c955ae78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47654833-a2e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675335832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335832, "uuid": "ead228df-0e24-45e9-bd05-e5459e677fa7", "comment": "Malware payload (Formbook)", "value": "033ae26107106b9a23d781e2b905dd53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335832, "uuid": "c40d53e8-562b-47ee-b674-84febdd003f6", "comment": "Malware payload (Formbook)", "value": "9fa6051bbc6360a9543398d476e888306b777d891348a2c2897454d34834c731", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335832, "uuid": "15cff2fb-7ac1-48ce-88bc-b9dbf1fb3e90", "comment": "Malware payload (Formbook)", "value": "79fb0fbe86d842d2e28ba7b2aaabcae7323cb0e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335832, "uuid": "404b6a8a-4aa8-4f69-9b81-8102af801aef", "comment": "Malware payload (Formbook)", "value": "17d34e5f2a5832f661f629ee1573c7128302c7443d8b3d000431350fb43de00963951fbfd753c4834c9eca1b1d4f27e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335832, "uuid": "48b5ac00-5065-4c39-9370-15c60065dd87", "value": "T1FE159E8737B1A8AFFA87407154283F886FA07113BE46A253973739C4D7098FBBB98151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335832, "uuid": "d2a89ebb-2939-4d3d-bc5e-3cc4891b7cb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335832, "uuid": "1e41b426-5712-485d-adcd-bfb341f1022f", "value": "24576:aWvJULTuf+H2fNbB/7DWpDbt6F0xMpqG4yPa:DJUfuf+WxB/nWp/4Wiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675335832, "uuid": "aff7ab16-0697-4d5c-baf7-a9ca0c9dd99d", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675335832, "uuid": "e38af078-01b2-4e34-98b9-4243e580c022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335832, "uuid": "c66d653d-be72-400e-8959-b2e4319d6055", "value": "Payment Notice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e23e21d-a336-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675368942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675368942, "uuid": "103b584d-dd4d-41dc-89c0-1e3f087ae3dd", "comment": "Malware payload (RecordBreaker)", "value": "bc46af138f661c31bd23dfed643aec0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675368942, "uuid": "736c0745-1d4f-4cdf-b0b1-b397230df657", "comment": "Malware payload (RecordBreaker)", "value": "a02b961c3ee8f672f06eae019c1b5c1c753126b95edeb57458fea177f1f08828", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675368942, "uuid": "9e5f8700-6b1c-4836-a5c1-217f751ede48", "comment": "Malware payload (RecordBreaker)", "value": "db363d46dfb756f97c7cfb3b0be91d1af5200a6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675368942, "uuid": "8af4e26b-97ba-488e-b7f7-d9291bff421b", "comment": "Malware payload (RecordBreaker)", "value": "df337f5160f2a0278d3d19061aae996ea778920bdabd1b247b53abdb71b50887c6d0b59175f6c694f8cedec8bb30d8a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675368942, "uuid": "15274892-adcb-41d3-a6b4-c089250bb577", "value": "T11C057C462A6B87E2D4B84D34817C54082BB16CE147ADB23ABDC67E3E8CE739F0455793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675368942, "uuid": "710d25eb-ff46-400a-a888-4fce5bd24861", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675368942, "uuid": "f16cfd23-4c6c-4674-a820-acaf87bb5de1", "value": "24576:K2zMwwTlE32rV9AFLVGpMo5c+idrNtNNx8qR1g:3wTlOEsMK8c9dd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675368942, "uuid": "80a7fbf7-2f60-4d6e-a4ef-956a5b152d44", "value": 850080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675368942, "uuid": "1261e191-d3c7-4ff7-bf89-420c7c0fddc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675368942, "uuid": "20c6d75c-761d-41d6-a85a-4cfb4dd46cd6", "value": "bc46af138f661c31bd23dfed643aec0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999fcb24-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675337259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337259, "uuid": "11c2bfbf-fa27-4a83-adea-2f751db5a5b2", "comment": "Malware payload (AgentTesla)", "value": "723e92e8100db2c5948632b8c138fdc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337259, "uuid": "a1780987-25b8-4e5d-a397-17909b2138e1", "comment": "Malware payload (AgentTesla)", "value": "a1f66a446267590878b9f19882e9a06ba814a1bd8ea3c97d933e91fac1eb51dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337259, "uuid": "b925e52c-7e70-4a07-9d73-1b611f9ff1ff", "comment": "Malware payload (AgentTesla)", "value": "2cbc8534cf0f2c4431483f931cba972c65e15ea6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337259, "uuid": "760d10b5-2793-4fd8-8da0-f42517573560", "comment": "Malware payload (AgentTesla)", "value": "8dc358dbaf7ed5c2198a4ceeaf3d1a9017c56cf6a3a075bbd010e79bc10661b5de7905e302fb281130c5fa9340098274", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337259, "uuid": "a2b1f4d3-f2c8-4e83-a97c-d2ec6fafa70e", "value": "T159E3F1C0FBDC9C1FCB66E37E4AA2199C0B71C156210BE38BA9E615FD0D6A35D1A03791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337259, "uuid": "53946fc0-aca7-44d0-904c-bde3999ca30e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337259, "uuid": "a7beeca6-6c71-48a3-beae-4e13d94679ff", "value": "3072:c9Btalmz4qLloDwiE0fCe4I+sMXttqWHGcN/vy9t9XWzk6UmLMR:sBtalY4koDwiE0fClkASOXyZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337259, "uuid": "5b5c6d6a-db60-4735-9e16-067840cc6bdf", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337259, "uuid": "e9a427a6-ebf6-4847-a08d-179c3a2903b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337259, "uuid": "edd57de2-664c-442d-b23f-7686df4fd3a5", "value": "TNT Express Consignment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260d0987-a2c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675320314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320314, "uuid": "3b01f1ff-895e-4260-a888-f1f0b5028a31", "comment": "Malware payload (GCleaner)", "value": "bb0973b5d31c792e86a2a3d2502d462e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320314, "uuid": "e6ca7b9c-9f53-4348-b9bf-25404ffaca02", "comment": "Malware payload (GCleaner)", "value": "a26e450cf6a4ed0d40fd09f3dfe9d0b9064ad71b573e063ecea4c70cd422796c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320314, "uuid": "431826fc-972b-472d-83cf-36949e74db81", "comment": "Malware payload (GCleaner)", "value": "2b541761de659ad6f0d9f2a5b1a068c122d8e47e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320314, "uuid": "0a6387e6-03b4-4d2b-abbc-c6d6046feba4", "comment": "Malware payload (GCleaner)", "value": "5f79da6a1c1a3728e842a655e2f03a04f89290531329aa08ed824bd2640d89d29406b896cb3e97bb85bac0dd37693693", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320314, "uuid": "38a441f8-5cdc-42c2-848b-8c4565b26b92", "value": "T1D7A5330B60EBC63FF3819D3098364045BE31EB5A14741A6C74CEB19D7D373DAAA4E692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320314, "uuid": "5bfbaa62-dee8-4fe2-9e2e-d96a41afc669", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320314, "uuid": "363002c4-0f26-4645-ba4a-034f75a964f2", "value": "49152:bgnZaUbYQToqCPT9m23xcIVCOrFgEDOiN+EOJLCgv2MR:cd8QzCPTY23yGxJg6slv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675320314, "uuid": "42a00ac6-919b-47df-948e-46d7a2e5986b", "value": 2113221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675320314, "uuid": "d6d11c16-a359-466e-aee4-47a45605316b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320314, "uuid": "30c69065-0a03-41d9-a9ae-9adad2ccee3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4330e7-a304-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675347492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347492, "uuid": "4cebe9e1-1281-4b2e-8377-68d2f6f28668", "comment": "Malware payload (SnakeKeylogger)", "value": "98975865c4d492a761aba67b63fc5cd6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347492, "uuid": "033aaf61-15ab-4979-9edc-e26317fb0930", "comment": "Malware payload (SnakeKeylogger)", "value": "a3e1420a5070b68c12e43769dfd8cdec7ddfba0061487d66c36506382f1192e7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347492, "uuid": "3f6430a9-c6a6-4ff6-8c48-f037e2f27967", "comment": "Malware payload (SnakeKeylogger)", "value": "773a5957c8a34d9cdac358289e3db29024fc633b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347492, "uuid": "99a9c613-b59e-40d8-8531-cb1b2a5b4fd7", "comment": "Malware payload (SnakeKeylogger)", "value": "7222c33f20f0592172339e48415af7dec6e112f09cbddd21fbaa486b4b814935c8a14efd5d5fc7bf3ab6439e105bbb32", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347492, "uuid": "7671d1dd-eb80-49c5-9ad3-205677a9367b", "value": "T13D134B5AE74F02A4CF552277131A0A8996FCB33EB35154B174AC933833EDC2D4266ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347492, "uuid": "35dc83a9-1fae-4c84-bcdd-76767dce357f", "value": "768:NVFx0XaIsnPRIa4fwJM7oMoYWvRTj4lfDRUauMEKx+L55i5etdPua:NVf0Xvx3EM7XvWJ4xayx+bi5Sma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675347492, "uuid": "af9cd992-3e2e-48e3-97f1-6b1014c91329", "value": 42362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675347492, "uuid": "0becc276-3488-4d06-991b-4b89ab777870", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347492, "uuid": "26422788-2c87-445c-b932-cd89586614dd", "value": "ENGUIRY.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6bd988-a2f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675342367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342367, "uuid": "72585a25-26d1-43f6-b40a-0497e677541d", "comment": "Malware payload (Loki)", "value": "8bc6ac8a482e0ec67fdbba6c3471c0af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342367, "uuid": "db62a7fc-7d6a-439d-bc86-7e4fb06c4b32", "comment": "Malware payload (Loki)", "value": "a407c255a2db0f10f4e06f1fae936a0f07b18401d824e7454bca9f0a132f3e01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342367, "uuid": "c093e1de-ba12-4912-a9d1-19265a02bf15", "comment": "Malware payload (Loki)", "value": "e43fa55a91c8392ca547b010238270f8895292d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342367, "uuid": "a6555d50-2985-4c57-953a-a6f0db754797", "comment": "Malware payload (Loki)", "value": "6df554b1994a33f145e6c5e36850cf198ef8cabd7abf5231d59f85c5c1f804d4345ee3850249b04e3a7f3e16d5718e35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342367, "uuid": "37baa994-8dac-4a54-80c5-eec445b531ef", "value": "T1E1058D8737B1A4BFF687507154283F886FA07103BE46A25397373AD49B098FBBB98151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342367, "uuid": "81486ef1-6a29-4040-9fab-7aa30a830e15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342367, "uuid": "2b877bb1-dd6f-44b2-9ce5-d802056f6339", "value": "24576:hX4+B6F0x3PjV122LcGtnEFuZ6xpqG4yPa:x8WtR126jtCuZ6xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675342367, "uuid": "f476dfc5-6638-46b6-b010-c1044b84435e", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675342367, "uuid": "9b8fa5f1-2fde-421a-83a4-f2f94787d91d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342367, "uuid": "cd98eac9-bdf5-41d1-859a-0f86426e86b5", "value": "Payment Advice -0009000012900093 -pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5916b9-a2bf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675317939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317939, "uuid": "2c4dbee6-51b2-4ce9-b880-5bfea5dc50e4", "comment": "Malware payload", "value": "05e5c9767fb190fb5205eb3a04c5090f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317939, "uuid": "2c36216b-da80-4521-a7b8-92c5a9e13544", "comment": "Malware payload", "value": "a41fee5d078720117af6d5cc0146c994fbba618aece68eb3ddaf977d119e079e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317939, "uuid": "dcba3394-a012-435d-bb15-ea574c654a5c", "comment": "Malware payload", "value": "8afc8b848ad32ac6a4e2bdba686f471b7347ddbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317939, "uuid": "3496ddcf-b507-4cab-ac31-47b66b0a35bf", "comment": "Malware payload", "value": "9d0183f54f739ec3cb446d7c010c0f630f6de5d794e80b5903745d00f1b1eb36a7274a124ead150051b972729a375060", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317939, "uuid": "2fc06c15-5797-471d-8663-8002ccee97bb", "value": "T1E67633A27AD008FAE375063205683F95A6FAC44D0D5429535FA0422DFEBC6C1D7AFF89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317939, "uuid": "e80a3e46-2959-4224-a70c-a5a0712d3c4a", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317939, "uuid": "fef5521e-d215-4f70-894e-a243e31c23f3", "value": "196608:91OZBOnLnkQc5ljV7FufBLZNxhKy8TzN/4XAVwizavSDMwZUBLKRq:3OwujlI7hwzN/4XAVwma5zBLKRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675317939, "uuid": "0643edea-5b7d-4dc0-903c-ef1336c8fc21", "value": 7633328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675317939, "uuid": "b1182f0b-9d74-4469-9187-59d4e856c2f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317939, "uuid": "19b6d460-28b3-4428-94c7-b2e0c4896ee3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25c3660-a329-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675363526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363526, "uuid": "9e2035f2-a984-450b-a22f-5412e7419920", "comment": "Malware payload (RedLineStealer)", "value": "e74993daa9c0dc6e2cf47f944bb23c80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363526, "uuid": "1c6f4da7-1347-4494-b225-57e506d650ca", "comment": "Malware payload (RedLineStealer)", "value": "a4b84e177edb2a3bc5755d3a1f88595d8b830f88377aa6f91f296b1b59b6aebe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363526, "uuid": "f2c9ccde-6ff5-4304-b20c-9a2209aad43f", "comment": "Malware payload (RedLineStealer)", "value": "20baf6fc84ec7a340d769b520367d18c60cee9a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363526, "uuid": "7e42ccd2-be2e-47cf-8c65-f018f1667c1c", "comment": "Malware payload (RedLineStealer)", "value": "28c804bee95b6b54a91c2ee6e9040a03de65ecf282a57f7dd96adbb667b60afe8f725ecfd4bc6fab44b9002270b401a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363526, "uuid": "e3d9afab-8242-4326-86db-3885411d3444", "value": "T19594CF42B390BC4CF5318B729F1EF7E47A1FBD508E1877BA2224AB1F14711A1C96A725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363526, "uuid": "ef8eda58-5a6b-4db4-8598-08b724c34932", "value": "d12bc67e05b268a2576f8b46d3381c86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363526, "uuid": "d686b48a-4245-455e-ad1d-b5002b5ff090", "value": "6144:IALYIqypOh2iD/OH1fL2xjnQpZsWkyfI9/CJTk637eQfnd5U8aWB:9EjN2HxL6TQpZpkyfI9CJb7d5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675363526, "uuid": "a78fd716-69ae-4698-b87f-718c14a35390", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675363526, "uuid": "0e47bf7d-951e-432b-ac5c-beefb3a8e4fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363526, "uuid": "165abcbf-73b3-41ae-8e9c-6e3e6cf28d67", "value": "e74993daa9c0dc6e2cf47f944bb23c80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53dc4a90-a29e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675303641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303641, "uuid": "680f9830-eea1-4314-a975-5467dc2c8004", "comment": "Malware payload (Smoke Loader)", "value": "ff1eaf52cc5220bbc3f2155afab853ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303641, "uuid": "99953839-b3a5-4391-8171-25edb81917b2", "comment": "Malware payload (Smoke Loader)", "value": "a4ec22bcfe6b8aef8e52550999e2651c9d396604e9b966a3ab54832cb6e5d008", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303641, "uuid": "8d046a01-3111-4dc7-8b5f-5b99aab46fb2", "comment": "Malware payload (Smoke Loader)", "value": "eaac3f018469268acfc86d8bd3161571cc275c1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675303641, "uuid": "f397cb25-af32-4f50-9d7d-63f09b7c02de", "comment": "Malware payload (Smoke Loader)", "value": "7a22bc13ad610c3d3b319456b2ebad85bb8c9cad14530c5140c0a7d0b696d133aa03e46ecc381588e88987b6802eecbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303641, "uuid": "776699b8-d80b-4218-bc01-2a851fb15ef0", "value": "T19E34D0327DD0C072C566C0309C20EBA5EB6EB5315975994B7BA817AD9FB12D0273E38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303641, "uuid": "ef65346e-5251-443c-bedb-2c3cbcea0d71", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303641, "uuid": "11be2b6e-71a9-4c66-8855-acbb456e73db", "value": "3072:rpRaay9OIlO9jLp7WKI5we0LxWmzMkJvmFS8bz:rpCwJLp7L/zvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675303641, "uuid": "8edcf317-8a7a-4e72-9bb4-94e9b9bb996f", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675303641, "uuid": "b82aea50-cfdb-49ca-9f41-b2533e4717a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675303641, "uuid": "6619a4af-66b3-4d68-be6d-2b19fc260d94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9493a13d-a2c4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675320070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320070, "uuid": "2d12d7ec-f9f5-495d-82bc-a2e4cc875538", "comment": "Malware payload", "value": "15c048da1c6f3c4cb6973f13e1dc33de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320070, "uuid": "0435863a-4b3b-4376-b33e-8072fa3f1d8b", "comment": "Malware payload", "value": "a5160f7add889498753b3a094fb98bc37ce8b383be83df976c40f9ff336e9721", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320070, "uuid": "d97d2bd6-be0a-4ac1-8c75-553c8f573107", "comment": "Malware payload", "value": "8349ebbb452958711ba4e3b8076998d762338edc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320070, "uuid": "d221e017-13f1-4f94-8c89-4462f71bdbe2", "comment": "Malware payload", "value": "1b70cd7021b5c6e99983d0f2c26e00d2408dd44775eef8e52aaefb04f4434c27eab86f40ad17f17b5d75afbca419cfe8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320070, "uuid": "bf5572f4-7460-427f-bcab-d278517db5ce", "value": "T1E1252735ABC24AB5E39395F25BF397EDB821FDF2B412825EC28B4F213A125E14441F19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320070, "uuid": "d3ecb67c-8931-43a9-90b9-36c7deaf6ea0", "value": "be934b29d9a83548878d0187178aaf03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320070, "uuid": "5fecd47a-6d4e-4dd3-81db-d2e285f433c0", "value": "24576:vY+UB5TsjZ03clghyKm1QgRHYKPUQ4U3yzZy5gFxopP:vUbAjZ035mMOyDFxo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675320070, "uuid": "dc044d42-a73d-435b-9edb-be00aaf241d6", "value": 982204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675320070, "uuid": "c7fc2ff4-e93f-4cf8-8f48-349c36bc148b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320070, "uuid": "955aa4d0-6321-4a16-9230-a0a57a01b7c3", "value": "un.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2e09c6-a2c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675321643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321643, "uuid": "17c5a522-e752-4cef-a1f3-7c69b6a21313", "comment": "Malware payload (RedLineStealer)", "value": "ef7f9739337bc657cd0a63e32e27d0a1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "toxicnetarmy", "colour": "#2DF4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321643, "uuid": "d4bad918-a68a-4b4b-a029-67a7e05d5c8c", "comment": "Malware payload (RedLineStealer)", "value": "a517abf69af75cef34cc2db14981ea42b2ef4424c140e37363f80badb2353c6c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "toxicnetarmy", "colour": "#2DF4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321643, "uuid": "810262e7-7c0c-4184-915d-2e39401371d8", "comment": "Malware payload (RedLineStealer)", "value": "bf67555a7272f24ceb57b1c49e4cf37dc17b246f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "toxicnetarmy", "colour": "#2DF4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321643, "uuid": "0a9d20e1-e47d-4c28-b479-da1458ed7761", "comment": "Malware payload (RedLineStealer)", "value": "84d759181ac3f89d0a515c3dcdd6b426fea10790d4219f7b8173c39fe415e8b903541b02d770dbf59b08316349f25699", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "toxicnetarmy", "colour": "#2DF4FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321643, "uuid": "c54523e2-9d79-48cf-9e0f-3556dcafc1eb", "value": "T13C4103104BE50324E7F29B7A6D7AE30148767C55EE52CFCC0150919C2825621F4B4F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321643, "uuid": "e51f0942-6ace-44f7-966b-de15cfec9ca2", "value": "24:8Ad/BHYVKVWU+/CWT+Oy+brUMkWq+/E4I0aHz:8A5aby+brHCAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675321643, "uuid": "d06f5b28-d659-4515-860b-ac9347fb9890", "value": 2238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675321643, "uuid": "33f0c582-585a-4e02-a5ed-9ad67b77782d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321643, "uuid": "9f84e410-07d3-433d-adc5-9e13c5947a96", "value": "07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e412d4-a327-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675362705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362705, "uuid": "adbc9ae6-04a6-4f00-bf58-9bc1913ab9af", "comment": "Malware payload (Amadey)", "value": "42f5c4d4500addf3d7cf351d703d0660", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362705, "uuid": "ba1565ac-28d6-4a23-bf99-7cfbca297f6b", "comment": "Malware payload (Amadey)", "value": "a62886bc68ff441898700433805f6afee393347cda559796cdfecde223b4feb6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362705, "uuid": "fd41d0d2-5aea-4b0b-9b0c-286d4ae4af28", "comment": "Malware payload (Amadey)", "value": "f36045a3207348b1081f2cfaf9e01a50c2b27f85", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362705, "uuid": "72087b6a-650b-4e00-8e72-3b8b640f78b5", "comment": "Malware payload (Amadey)", "value": "31f05abace1db3b970e20655a725aaa78a14c851ef80d687be5f1c2117af12a9c73ce35eaa48b6cd390dcfab4d2441cb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362705, "uuid": "fbebaec2-4222-4231-af11-10e923484020", "value": "T1FF649E02B2E0BC5DD9328B718F1EF7E87A1FBD504E5977B61324AA1F24701A1C963729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362705, "uuid": "827e80a2-ad33-4369-94ea-7553f09ade33", "value": "64f2017133017378e6738b9a4be235bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362705, "uuid": "fb0dc467-fdc0-4527-a480-ea6744f9e3f4", "value": "6144:eTd7LR+ONreH9yvZbHGq9/CJTk637eQfnd5UFPwWB:eTd71+CAEvZjGq9CJb7d5aPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362705, "uuid": "1df59c1e-d2fe-4e87-b83b-4fcce646989f", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362705, "uuid": "7b6ef506-4c18-4d3f-b2f5-375fa29bb4d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362705, "uuid": "bf055c54-0739-4d1d-905f-a6d6630cb352", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac446616-a2e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675333424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675333424, "uuid": "0e2c38c7-15ae-450f-9819-af39743838e2", "comment": "Malware payload (AgentTesla)", "value": "036894f48b296e2bcda4316b7ae774f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675333424, "uuid": "40b67a86-f8b9-443f-9d59-ad2e5d707e45", "comment": "Malware payload (AgentTesla)", "value": "a6e89ab2a24715ba778e9734ebc434f80feb6188d01eeb1ff4d3004863fbd6b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675333424, "uuid": "53f0040c-ff0a-4ee7-8f16-76b62a1edf1d", "comment": "Malware payload (AgentTesla)", "value": "a8723b52256ec54e03e9897dab5346eb0f2297bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675333424, "uuid": "fd5fc5d5-c6e7-44a0-ba63-112eac5db4fa", "comment": "Malware payload (AgentTesla)", "value": "4148548cb0b1df2daa7308b235c4004a92722ed9c761565d29e7fc51cdac652da0dd63b15971c449ecf6bae20724d0ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675333424, "uuid": "3ba91d5c-00ff-4e46-90f4-012a626218e8", "value": "T18262CF66E7008BCEE6D653F258F4646AC17AA074D37622BF1F935BB58431942E44888E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675333424, "uuid": "19b5506f-f825-4dc2-836b-37b09bfb1dc9", "value": "384:J9m4N8rTpPAtiPhB9ujAvppAl9xULnFDS69O4jGOW:D6rTppPhB9rsSQ60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675333424, "uuid": "ccc5e322-cd08-421f-b511-39859d9a7526", "value": 14979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675333424, "uuid": "9afece94-8be7-4c26-b057-078ba10997d7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675333424, "uuid": "85bcce00-01c3-459c-98b6-b59b8b42e1d9", "value": "STATEMENT OF ACCOUNTS.LZH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c4bedb-a2ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675338588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338588, "uuid": "3da4d7cc-9cae-4cf4-8916-97fd2f4b671d", "comment": "Malware payload (LaplasClipper)", "value": "7c9ae9ccfe7eac83b4ddddd9cc01212d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338588, "uuid": "9fcbf448-d3da-466a-b7ec-85e878dbd8cb", "comment": "Malware payload (LaplasClipper)", "value": "a71bf0c058f1e499400fc4d75dbb5bed6a90526cbc7597317b702f20c464c7bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338588, "uuid": "a11d8133-9d33-4f95-a27b-a445ff8f2f2a", "comment": "Malware payload (LaplasClipper)", "value": "bb07847d73cd18caee230b59c8077915c091a9b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338588, "uuid": "3a2f7362-400e-43b2-95b3-bd1f3c5c7c27", "comment": "Malware payload (LaplasClipper)", "value": "43ab8482e3ede1be678a9b1668e439339d4503fd06e2b1e10414723b001cbf0cf96e98e70ab48be14fc1151b891eeaca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338588, "uuid": "55876d4d-b05b-41ec-a1c1-575209aed579", "value": "T10B853326FD728263E4B580398870D9F855374C21A197C9D739A9A3BCCD707E1872A3BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338588, "uuid": "158bdd2e-cdd9-4433-b07c-026f29718591", "value": "20540b45038474bafe70cf1c181e44fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338588, "uuid": "8cbeeffc-2df4-4290-b9c9-ff972baf65e6", "value": "49152:sMAaOSOOSjiNN+x3Oj1UMXg6iVTC6YLElQItj3kiU:7tQiT+x6eTQe3XU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675338588, "uuid": "a30c2461-b847-4492-9c99-5559970b93ae", "value": 1827840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675338588, "uuid": "602ba4ed-73fd-4f9f-a12a-6d934a47c3bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338588, "uuid": "4326e566-3b14-4b5d-88e0-99171e65d0a3", "value": "7c9ae9ccfe7eac83b4ddddd9cc01212d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b911732-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675337208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337208, "uuid": "13a61189-f0e2-4fee-9b7a-23031659ef0d", "comment": "Malware payload (LaplasClipper)", "value": "bffa0615d99b62e6aeb7824e34f87d98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337208, "uuid": "196613a0-3389-4b71-aa5f-1d599dd50f8e", "comment": "Malware payload (LaplasClipper)", "value": "a770b9ce3548557620a5366d8d9c8e318a8cc153a4f83970e8a5e7d10ef933f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337208, "uuid": "39c7f497-5e0d-4999-a095-a2f91b4ed9ed", "comment": "Malware payload (LaplasClipper)", "value": "64002c1cbcb9152fa683538f21d4023a36c0658d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337208, "uuid": "8681459b-f0e9-484a-a051-72ac966eb96c", "comment": "Malware payload (LaplasClipper)", "value": "7d0049d168883795c7508d0873d85fa3c229838701e6453c4dbcf05ce77b5fac9a996ea07f62c67581a756c15510750c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337208, "uuid": "6d710040-ce54-4fd0-9f42-799db3acae30", "value": "T115952312B2D07D48EA368B768F0EE7E4691FFE218F0463F611E8A61F34711E2D952725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337208, "uuid": "67985e1b-ffce-45a9-8795-1f044bc13ae0", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337208, "uuid": "c24aabf0-24f6-48e5-813f-17d23fd54240", "value": "49152:asLUhUEvQ+cLUFs1af+pAlznHxrMQH+9qb7:aJc2CPAHxr0qb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337208, "uuid": "c81f924c-17e9-4af0-9b23-41b86cff7746", "value": 1986560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337208, "uuid": "db8e041a-93ba-4531-ae7f-c68b4a1f82e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337208, "uuid": "0684e849-2100-4478-952c-661f2fc25c99", "value": "bffa0615d99b62e6aeb7824e34f87d98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0588293-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1675337324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337324, "uuid": "47c8f5a2-dfc5-40bf-a1bf-781d8ae3b85a", "comment": "Malware payload (Vjw0rm)", "value": "eeacf758acc21133811bce63aa477ee7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337324, "uuid": "5fa36a30-60a6-47f0-9dc3-d94eba9b74a9", "comment": "Malware payload (Vjw0rm)", "value": "a7ff79a11115a66f2450844c4b115b799d388d7157ee9d2df27286c0e5acf7ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337324, "uuid": "c04b6854-5287-4fe4-bd12-83ce8e9be3c4", "comment": "Malware payload (Vjw0rm)", "value": "d2ed9bfbfb8dd47ac3120efc757f43adf3ce3dbf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337324, "uuid": "6ee33f6c-aeec-4416-b0f7-4b4c4b3d3df2", "comment": "Malware payload (Vjw0rm)", "value": "57f2fa96226666772aaafe7b533c051ee7bd6058129a163442b36511093b0b62c9fe2c1a99db5914adde63ad06b3b84b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337324, "uuid": "45a3958e-4c48-4d38-a211-ba771f30c56c", "value": "T1DE54E1419E941F94CF591A0282FC9D2DF7B45D8E18E09E9FF712EC8C97A6104A06F1BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337324, "uuid": "cb31f4e0-a9a5-4711-a686-dea18b5cadb7", "value": "6144:7DrOg9pEJX1WPNSrV8iLgENxGVc+2dfpMAZL6sXZ7lorHawkkt:7DrOrJXAPGZxGVsl6mlsNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337324, "uuid": "3fd6444c-ae7a-41b3-a528-7197192ec091", "value": 292292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337324, "uuid": "4ae11f3f-1227-4ef7-89bc-0d8b60cc4e7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337324, "uuid": "02380269-81ff-4453-8c73-3fc7290acfe7", "value": "Executed Contract.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf7de89-a2da-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675329532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329532, "uuid": "294349b8-0f6b-439b-bb40-f22a4b2bb21d", "comment": "Malware payload (Quakbot)", "value": "d5d71689de4eeb348047a19fa481f034", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329532, "uuid": "689686bf-6f3a-491d-a195-866bdbf958af", "comment": "Malware payload (Quakbot)", "value": "a870d31caea7f6925f41b581b98c35b162738034d5d86c0c27c5a8d78404e860", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329532, "uuid": "571944a8-195b-469e-94a1-50723f330fd2", "comment": "Malware payload (Quakbot)", "value": "4f4d378aeaebe2563105b0679bdd2d5a1043f31f", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329532, "uuid": "ea3868a6-5d44-4608-989e-34285e79ac89", "comment": "Malware payload (Quakbot)", "value": "d498728db46c9ee87a8932efcccf40dd43122b70cadfac6355246db97f8e83cde6108dbd6bfbb23aa93f44bd0773184e", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329532, "uuid": "d5547b6d-5abe-400a-a0fe-f18fd276c1b5", "value": "T15004E11266F545E5DEE07BB24DE3971DAA2BBE27E212035F4BB56A1D8D60310DC0470F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329532, "uuid": "339a389a-c661-4ad1-8938-ac5f4f65c04f", "value": "3072:iaA0YRw9/WITtTWR7IbNzvL1axbYCuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCa:Ia9xytedL18Ew4iERBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675329532, "uuid": "c5f1f181-9bd7-4c2a-8eb2-ee0e51d50c76", "value": 176252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675329532, "uuid": "68785fdd-5e4a-4457-907c-d10fc77d0dca", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329532, "uuid": "3aeee181-3e1a-4618-a308-bfc3d3449e43", "value": "ComplaintCopy_64825(Feb01).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6d32b7-a309-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675349720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349720, "uuid": "41fd69c5-7fc7-46b4-b381-15ca36579470", "comment": "Malware payload", "value": "aa37cad59cfd57972002d89fe6037704", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellCobaltStrikeBeaconReverseHTTPx64", "colour": "#D504DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349720, "uuid": "00f4b438-7e76-4c97-95ab-d374f620a5a9", "comment": "Malware payload", "value": "a91a5adbc0aaa88c4e03a2447a25935d3948b85fdfee6c7523ac1e6b553f1591", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellCobaltStrikeBeaconReverseHTTPx64", "colour": "#D504DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349720, "uuid": "776f8667-0145-4cc8-8cfc-9c603f917b12", "comment": "Malware payload", "value": "ac8661f4c28595180e27801c2c06d92d64429f97", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellCobaltStrikeBeaconReverseHTTPx64", "colour": "#D504DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349720, "uuid": "a9067dc2-810c-4f17-9ab6-39bcd4a55114", "comment": "Malware payload", "value": "5b1a4be5b3e153fc3e1202eb762c4997486f51c832d36dda8fc00e082d1af7b45a2be58eb8cb8094025265e8c27578c6", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellCobaltStrikeBeaconReverseHTTPx64", "colour": "#D504DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349720, "uuid": "9f8e1804-594b-4c00-bef7-06550ddb60ba", "value": "T1D1F11136C631FCD8875C354092291C9F31E8555793F74E28C7062CBA3E62B57EF65A88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349720, "uuid": "d720301b-5d41-4c24-a559-03ed308515f3", "value": "192:BA3hdr7ci9UBvqbuZq+07FK9NtkLISbniReShqz2A:8klfq+07FK9r/Sb49hLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675349720, "uuid": "531d4d2a-cfd3-4ede-a868-9080fa9fd50d", "value": 7594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675349720, "uuid": "7b3adda5-e119-4cb3-a7b3-d7206372023d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349720, "uuid": "3bbd5bd3-a03a-433b-8036-9687b9cdd2b2", "value": "G2spVYnf.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd645694-a303-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675347197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347197, "uuid": "812fc764-c0eb-4c7d-8049-47c518730887", "comment": "Malware payload (RedLineStealer)", "value": "6991818e08082c4c140db502d2aff79f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347197, "uuid": "77624040-f2e4-4a28-bda2-6d970d343f16", "comment": "Malware payload (RedLineStealer)", "value": "aa0a99779ffa4aa30aa23c9dc9db17b250457c5902e7d06aa785be97d764c3d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347197, "uuid": "a11f9239-f982-4611-abb8-9003f33db254", "comment": "Malware payload (RedLineStealer)", "value": "020ee1da61473dcd090805343601c1ae3d265032", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347197, "uuid": "accd934f-dd24-4aae-9b4e-1aaeb784c868", "comment": "Malware payload (RedLineStealer)", "value": "d829c2fa55ab606cfa6e129a7184c549ec1d558682c79179da928f2a68e75386e339699aa3570151b0ea3a84c4694293", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347197, "uuid": "080ccf34-9da1-47d2-adc3-7124de64d890", "value": "T1D104C51437FCCD11E1BA6A3F6961A05146BF98026C42F25B76C367CD1E32B40FA57AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347197, "uuid": "a0f110a5-0b39-468d-88c6-49cb7108bde5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347197, "uuid": "e3d06ce9-24b7-4c1d-9f93-d358f6b6ead7", "value": "3072:txqZWPTa9ApGvkpKEpk8PefbFhhTfxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jc:3qZvkpnbchh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675347197, "uuid": "9709eeb5-a5c2-4a7e-a8b0-628bbf25171b", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675347197, "uuid": "17b8b956-0c06-416c-856b-40f1a8f1b684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347197, "uuid": "a514c3c7-17fd-4bce-a42a-358547ecd6a1", "value": "6991818e08082c4c140db502d2aff79f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af2daf3-a2db-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675329879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329879, "uuid": "cef56482-2c47-482f-99a9-e10c649f588d", "comment": "Malware payload", "value": "4188912c5c2eecd432b6b458dd8af06d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329879, "uuid": "8064ddc8-8f91-413e-a2ec-4e05aba6f6b5", "comment": "Malware payload", "value": "aa0f3f9480e72c2c0e2dec6c54b822a4d9835d80f3b6ddeb9a5dea5a04b59e23", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329879, "uuid": "48b06bc6-f31b-4698-bf20-828c47447e06", "comment": "Malware payload", "value": "1a216f88a4eccb6acc9741e2e5bcc6662b59e190", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329879, "uuid": "1b72f2a9-ce35-47e6-8f46-df9391e954a6", "comment": "Malware payload", "value": "d0dd371427686d7ffbe81e425df718dd7368f6806ab1cc90c4ad46b6453750bef847f0a2509d27146881a5e8edccd7c2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329879, "uuid": "e320ec21-11e7-4eb9-b0ea-3750e0b88bf3", "value": "T128D423BD4ED1F043DD27102096E8BFE2E9CEF06576740A23E6C1B837E89B961E45D264", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329879, "uuid": "47cb723b-e12e-47c1-a249-13e29d40267a", "value": "12288:QDFmG405c9YUleDkAsyjHkRBj66LbPOy6fShJwoXfI3SZ:8YG402yixyG6WOyDhHfIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675329879, "uuid": "10878d10-4724-48bc-8ac1-a545f9f50e02", "value": 607085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675329879, "uuid": "c06b9f69-0829-4a3a-9258-53a39661329d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329879, "uuid": "996fe0d6-25bc-4d57-89dd-e88fa6c354c5", "value": "New Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f04a96f-a2af-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675310827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675310827, "uuid": "3f28d705-5484-425d-bcc9-2f2207e70950", "comment": "Malware payload (CoinMiner)", "value": "dfe5ec5f30ed30b29ba05bee477e89ac", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675310827, "uuid": "5992b701-b434-4aff-8f04-961d79764e9d", "comment": "Malware payload (CoinMiner)", "value": "aa65bef2ccb960cc83fcc7630d4b852276d062c4713423c41aa18fcaafc91fcd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675310827, "uuid": "667ca218-18bc-4073-83ba-e6428a78b942", "comment": "Malware payload (CoinMiner)", "value": "efe93834ea54bb8235376a00815b6bfbe38a48f9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675310827, "uuid": "bd39c5a9-9d5e-41a9-9598-8a24733e7520", "comment": "Malware payload (CoinMiner)", "value": "ce2c9246b8828e558c884d9aae0d825853ae85f8a1b8673eba45e288d01fe2e1bcb3951cda0e12ccc5316e0adb914471", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675310827, "uuid": "48bd864e-3a9a-46ab-98a8-ab2ff8a73202", "value": "T1C6A52383905E1964E1ED4334DF7525B3E82FB4904257765E4282B431EAAEEAF277F308", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675310827, "uuid": "b6889d30-cabe-4058-b8b8-feb95248e2bd", "value": "df9a7bc1c6c6cd97d04c3762fdde6719", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675310827, "uuid": "6c62c2f8-909d-4a6a-a60a-0bcccd2fe600", "value": "49152:rYgmDONmcRC3Ok3T8zbResSERqcIh2q24aEjHkoWMQOvXn8FuuyxilL2ijx:rxmamcR5IkR5/EjHkoWMQOv3V04ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675310827, "uuid": "9e480c2e-a2a7-438c-89d9-cf8093182f70", "value": 2137088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675310827, "uuid": "c51fe25d-8214-4e4f-8395-6b1898c134bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675310827, "uuid": "f03e1ea3-1244-4cde-a5b8-8e640e67af50", "value": "dfe5ec5f30ed30b29ba05bee477e89ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515b1d29-a2f2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675339714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339714, "uuid": "af4439fb-53f0-4ddd-8dda-06818b1c7286", "comment": "Malware payload", "value": "5e4e191b8bdf043a0e76a76a3714fd2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339714, "uuid": "a26687da-b85f-42b3-8fcd-69f5e27b9f31", "comment": "Malware payload", "value": "aabad6c8fcb63f2732ae0b0d768fbc6098a17813a7b0a8eb7217b3cefb85e347", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339714, "uuid": "ba3b7770-3810-4bbc-b544-ac2f9c5b8804", "comment": "Malware payload", "value": "cde2e4916331fac4c8c563f9afa556a0c882c979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339714, "uuid": "5c4096df-9b67-47dc-98dc-7a6eb81def05", "comment": "Malware payload", "value": "8965b76bc564c19d23d3f9bae8ed7959501738a659cfb9c77af52526e4ee246e0b504a96faf20e5cc4d87d50bb6fba26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339714, "uuid": "9bc3266d-6f20-486a-9018-c62e7bbcd2ce", "value": "T197D3E131FAA0C033C416A5B14865D3A5AA2E691117B4E85777E81BAD2F313C3B77E21E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339714, "uuid": "0a62591f-655c-4b4f-a418-82dd145eeef5", "value": "20540b45038474bafe70cf1c181e44fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339714, "uuid": "bf8253c6-abb4-4709-b281-076c4d1897e7", "value": "3072:GMKP2tLKU+R6KdjarOWKyHC9rM+JDWpkeWzKrlMl:n/tLKUpieO5gAD7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675339714, "uuid": "49c82867-36b1-411f-9dcd-ae66e252c1a1", "value": 142760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675339714, "uuid": "fada5d9e-4f41-44f5-9303-4ec457e4f16e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339714, "uuid": "d6eb8bf1-8b87-4efd-8956-5322926cf961", "value": "5e4e191b8bdf043a0e76a76a3714fd2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa66c213-a2dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675330844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675330844, "uuid": "e1f71dc2-e1d8-478c-b7c1-92378206f6ec", "comment": "Malware payload (RedLineStealer)", "value": "ba05aa05612678241f55ddca000e2f61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675330844, "uuid": "cc179cca-56dd-4f9b-a8d7-31e4d51206da", "comment": "Malware payload (RedLineStealer)", "value": "ab1aefbe820f7c7dfa9e0ccb6089da9ec71f11a0d44488054c5a8b8b52e925e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675330844, "uuid": "26c7b619-6ffb-4879-9a05-954e58d35c75", "comment": "Malware payload (RedLineStealer)", "value": "6d0c71ab98ec5a3686ae7a63108398a71a56972e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675330844, "uuid": "55463431-cf30-4f52-8fde-01c0b7f8d468", "comment": "Malware payload (RedLineStealer)", "value": "8b3f92c9fcb3796e7b4c0a8adb2133be7b81c9baea5278d63770595ae2121129392b9cb8520130180ffd4e346869c858", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675330844, "uuid": "e18428ad-ec0c-4827-ad69-a04a4334da27", "value": "T10994C00276D0BC48D5368B728F1EE7E4791FFD508E59377A1224EB1F19701B2CAA2725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675330844, "uuid": "a8a3ce07-1511-4151-8e27-3bb13cda8ae9", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675330844, "uuid": "b0bd70c3-99c2-4bbf-825c-8dac91816cbd", "value": "6144:rYL8gwE59S9dRd9qM3SVFLjruj8zeKsGhc9/CJTk637eQfnd586V9pGB:U15E9dRd0lVF/y8kGhc9CJb7d5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675330844, "uuid": "170e341e-8c95-4b0a-9774-554aa2e277cf", "value": 427008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675330844, "uuid": "592da000-7d81-4b60-88d6-87c62f2b608e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675330844, "uuid": "a007484e-119e-40a3-b243-d62101b71427", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de4f08b-a2ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675338313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338313, "uuid": "ec570562-c2bd-4975-82ca-ec563a813622", "comment": "Malware payload (Amadey)", "value": "ab4075d7e7f1ab37e44118c53f585ebc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338313, "uuid": "677b8ea1-dbda-4dba-9e1a-3ce560ae95ce", "comment": "Malware payload (Amadey)", "value": "ab20677e0e62506c46f898df6a58bfce510999ed8ad13dc328aae56ef5000bd5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338313, "uuid": "42222e38-9257-4347-9f5d-6ce6f0e9f845", "comment": "Malware payload (Amadey)", "value": "14ad9b338e440d56949dd866266314c450ccee2d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338313, "uuid": "9b8e2c62-b2ff-4643-83ad-393aa65aa123", "comment": "Malware payload (Amadey)", "value": "450fd10d178b9151015b491398e4ec59646d2d6aea621cadf4c168177e4c75b7dc512a7b15c99d08e65011cd1caec6dc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338313, "uuid": "82201529-c172-4d90-8ab9-932fac0d43d9", "value": "T18E74AF42B3A1BC49E5398B329F1FE7E47A1FBD408E1877761A28AB1F14711A1C963325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338313, "uuid": "8b329358-78ad-4d43-b116-07fc56a85c0d", "value": "20540b45038474bafe70cf1c181e44fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338313, "uuid": "78802d6a-53de-4158-a27e-238e1aafbee8", "value": "6144:DNL4fYSxAT+3HEgX5M6BEiajuoo/h9/CJTk637eQfnd57B+:hURx53HEgXi6Zaje/h9CJb7d54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675338313, "uuid": "b71befb1-0415-41df-affb-7c95d8511234", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675338313, "uuid": "50b72611-b1ff-46c6-9e17-6930fca3af2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338313, "uuid": "9d878ab1-1479-41c9-ba93-a9e721089275", "value": "ab4075d7e7f1ab37e44118c53f585ebc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2238a759-a301-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675346078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346078, "uuid": "c52b8ac3-f76d-4d6a-92cc-4ecad3dfbf11", "comment": "Malware payload (RemcosRAT)", "value": "67d13c97623a1bf611722b5df735d9a8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346078, "uuid": "05ba91e3-28a3-453b-a6f8-688ef98f27f5", "comment": "Malware payload (RemcosRAT)", "value": "abc1ca283231d983a3ff89f162b878576323380579ffef0165bf17cc71f772e9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346078, "uuid": "d6c2a07f-5e04-4c7a-bbf9-0f8fed150023", "comment": "Malware payload (RemcosRAT)", "value": "41fe1797b329de1f7c82e5634ffdb50dfb88c570", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346078, "uuid": "3800cf50-d7c3-415f-8839-e9cfdd7e1734", "comment": "Malware payload (RemcosRAT)", "value": "cb138d7808d323e4eddd94b220786011b6f5074e301210141516848281822770114a7c176fda33d7777a75541312441f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346078, "uuid": "8a519814-05fb-4253-b0bf-feeaa7c0fdc5", "value": "T19AE42390CEB71066D86C492EE68A6D63C61CD65E9CAAC31FC6B8B00548E31791F03F7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346078, "uuid": "36cfbc21-167f-4cb8-b4fe-63e625411f79", "value": "12288:4M6kIzshGhOSsEHznoiICBTIVGDDuPM+Vm77wAyWPAxhuwDkfn5T3d:4MOzoFQHznDiODu0+oHyLGnt3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675346078, "uuid": "5b687e12-87c0-4312-bdaa-de15df47d589", "value": 707175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675346078, "uuid": "8f7f6378-dd0d-4f12-a583-9d413674c802", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346078, "uuid": "c17dde32-8f86-44de-b2a7-e234c2beb2fc", "value": "AlXMurad.02.2023.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad14dc8-a2d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675328456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675328456, "uuid": "e8eee446-0f03-4e0f-9ee7-b4143e51e692", "comment": "Malware payload (GCleaner)", "value": "3f86d22a4bbe51b1f9d247632815c80c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675328456, "uuid": "cdd69f4f-9e55-4aeb-a582-c91e21806b06", "comment": "Malware payload (GCleaner)", "value": "ac17e990740c99b365938b8dc678823f7bcb902030e5abe1d90e1267e1789bed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675328456, "uuid": "f1209151-e6cb-41ae-b3fe-668a8ce7fa24", "comment": "Malware payload (GCleaner)", "value": "9270c74c8a7245fac7e3dcd31628c1e0d7f304be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675328456, "uuid": "47cbb4a9-4b8e-411d-9ab5-ae256a59e23e", "comment": "Malware payload (GCleaner)", "value": "0e9996938ae74bba11f150c89dabcd0beb30b9288684b5ae07757d6f0fa7f2ecb3a24398f138895b1520ef3d8b49b3f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675328456, "uuid": "a89f4e7b-47a2-4ca6-89a0-c170d6bb8b09", "value": "T1E2A533C39AF698FEF0119B3E5E3C481DDD33BD1126A4427178BF669D1F2B588680BA11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675328456, "uuid": "a4c865ae-88f1-4a5d-860c-706483c4988e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675328456, "uuid": "9a251ded-d046-4062-8bb8-214c79e770df", "value": "49152:bgOSAJGAfDXQRSBHdEVhpF3NyD2t0jaLWLCgv2MR:cOSAJGAbdmVhLoD29Gv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675328456, "uuid": "a33234be-0859-4f78-8543-e6d5a8c3ffc2", "value": 2122766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675328456, "uuid": "313ae452-db2f-4d16-b256-6c22c5e1615e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675328456, "uuid": "01444221-18b5-49ea-985a-34c7b249ff34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12856d37-a2ff-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675345192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345192, "uuid": "99887109-08e8-4587-872d-e54017117712", "comment": "Malware payload", "value": "b8b89da3b83fb5b39b96ca101515c126", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345192, "uuid": "adca82ab-158a-4927-b6ec-7be16fc5ea04", "comment": "Malware payload", "value": "ac7fa93c55f117a6b6ae118c703d4c19c31e8a14837927d019afd6ccaa50db44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345192, "uuid": "fd065564-26a4-4e17-8281-11cee4dda215", "comment": "Malware payload", "value": "60e3e25178330764a448a4683ad85761894c2aad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345192, "uuid": "0a10258e-e0c6-4eca-b0bf-632afc017840", "comment": "Malware payload", "value": "fb1f29642cda84d5ec73370ee11392a5b9fad28d5db65df7f61a81fd9ab84403a6aef2b0aa4556b7208ce40ce0c5e78c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345192, "uuid": "7921b94a-a8fe-48b1-ad81-c8320edb6638", "value": "T1696412C97994E87FCC17D03A49598D948BA67677226FE293404362DA5C4FF1B8E1C0B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345192, "uuid": "235ccc50-a557-494c-9d90-5f38c5da0bba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345192, "uuid": "6b5cc929-a18d-4c68-bbb6-bfa0ea985433", "value": "6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675345192, "uuid": "c13e103d-1f0a-4a93-ae7e-f6361a8dd532", "value": 333580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675345192, "uuid": "534845bf-db84-47ba-8e04-849208f92158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345192, "uuid": "4ec9d1bd-14a7-4935-acea-5f727c4f1967", "value": "b8b89da3b83fb5b39b96ca101515c126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d455db-a2ea-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675336548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336548, "uuid": "75e98e6e-7033-4dbe-a4b6-2a6b9817f6c1", "comment": "Malware payload (GCleaner)", "value": "e9da0a1195749f4da8bad7a416cf73ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336548, "uuid": "cfebdcf9-9c0f-4aac-b1fc-fe0bca2bda5e", "comment": "Malware payload (GCleaner)", "value": "ac8cf31be976dc8553329d49cbb5f926f09c67603aa3a8c6ef05d7e87f27a162", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336548, "uuid": "09d7d33e-fb83-4fa9-a6fe-8384a862e921", "comment": "Malware payload (GCleaner)", "value": "0a48e16083b43e981a56c03b29cdceebfe299e19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336548, "uuid": "ee582b2d-777a-40ff-92eb-ae4dd2a07a4a", "comment": "Malware payload (GCleaner)", "value": "5031a01dc5c86c67ea56c2039ec4794033d873dedf2ce7a14566517f4b047af50a75d8b889571aec0a7904bbc32a6e02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336548, "uuid": "075af9ec-6199-4aac-b7b1-d7592c2f9da6", "value": "T19395330EA2958933E042C5B56D38CA87DEF6FF395A740018B4FEB6791FBB580046D46B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336548, "uuid": "f8c76cdc-2a58-485e-b4d5-05fab6e13a8a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336548, "uuid": "86fc162b-b47b-44da-b4cd-a85d2ad9db99", "value": "49152:bgmflh4Ftfl3Klv2idlp/BU5lPjTubfKctLakLCgv2MR:cAlhWtvivp/B2PjTefJtLvv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675336548, "uuid": "8b8b2e35-a971-4d8d-82d2-0a527af4971f", "value": 2032902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675336548, "uuid": "4758f267-a88d-4c54-97b3-09bf4b6c643c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336548, "uuid": "e8652f8a-f508-464b-8755-2dd65a3277c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fbab2a1-a2f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675340275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340275, "uuid": "ab144635-ef35-4bb4-bfa1-399164b9f6a3", "comment": "Malware payload (CoinMiner)", "value": "2e650376cd95f186c48b3c2a55e73129", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340275, "uuid": "e32a7235-0132-4a0f-99d7-5e48f1b774fd", "comment": "Malware payload (CoinMiner)", "value": "ad8302cc27bcb2b8701aa1cce10c6b08ebef18aee1c77853e6d76a90558957f0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340275, "uuid": "24fa7586-7f9e-496f-b2dc-9ebbe26121ac", "comment": "Malware payload (CoinMiner)", "value": "db0dd8ab08d23e64d4ade4c0f9e900252fcaa4d7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340275, "uuid": "1a14c20b-236f-4d09-940e-d9cee995afbe", "comment": "Malware payload (CoinMiner)", "value": "8f4685dad1567a9eb2e61d1507c4a80328431d72e38f8b9c2e9319abb6b2e3eecff55480f54599a8410b93172baa719b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340275, "uuid": "059b5564-f73d-4ebb-8f5c-e2ea317b1d11", "value": "T18DF500736348C829C4987C34C796AEF79753AC74DECD072B3395FE1A3972A845866C0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340275, "uuid": "b71fe992-6119-457f-8c6d-1aa6af01b709", "value": "c6e651270ff4ad3a6770c509750d26a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340275, "uuid": "85c4bd01-c831-45ab-85e9-cea1d6c8432b", "value": "98304:/dHXuzq3zvG40UcGwOI54HPXVk79/Cyf31DA0R:F3uzczaUx/I54H/0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675340275, "uuid": "6cc66927-4218-4474-992b-b057434e506d", "value": 3573536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675340275, "uuid": "d1eb534b-82a7-44c2-a499-67a8d8fba2fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340275, "uuid": "deb0c393-6949-4147-8567-5a0822195819", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc96e08a-a31b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675357557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675357557, "uuid": "0f33bd4d-5269-4f5f-9041-a2b14c85354d", "comment": "Malware payload (AsyncRAT)", "value": "e16de135773985fd9ef2e0afb94f774a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675357557, "uuid": "686eea57-9abc-4983-9c38-5ab61fb86430", "comment": "Malware payload (AsyncRAT)", "value": "af32b03c1fdbc8a4dd60fdea328134b6a34946c7c77cd743600a2101a70c6630", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675357557, "uuid": "816a63ab-13b5-482f-b4a9-6f0f304f3445", "comment": "Malware payload (AsyncRAT)", "value": "84c2dd69ec6247cea480925d9ecfc728f5d04c58", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675357557, "uuid": "daf75395-2363-45c7-9db1-e1bd6ff4e8df", "comment": "Malware payload (AsyncRAT)", "value": "78db0a96c62c42c7a0677d16d3ede281bd9497c4c2f6171122ade2da4ea4c7bbe13ea1a7d1e122b6df23db8d6dbc0c0f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675357557, "uuid": "13ac22a0-1520-4004-b758-17a343406c23", "value": "T1C4231A003BD8812BF2BF4F7859F2624586BAF2633603D64A1CC451DB5713BC69A526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675357557, "uuid": "d3804814-d15d-4201-80d8-2cc780a75e5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675357557, "uuid": "90a0c6b7-ed0c-4257-bb88-2a8e4a69f91f", "value": "768:DuwQNToEjaNLWU3zKZmo2q723YZJugbbb409ybdPIK/JjbOgX3iWS9UmozmBDZfx:DuwQNToqaS2DYosymK/pbxXSzdfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675357557, "uuid": "49018537-c8a3-4d0a-ac39-84e79ef2e2cb", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675357557, "uuid": "47036256-8132-43b6-8352-3dbd80fdf198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675357557, "uuid": "67010f1d-2175-4046-8235-9dac43c3f87b", "value": "e16de135773985fd9ef2e0afb94f774a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52c3409-a2f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675342888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342888, "uuid": "731bb996-0ae1-444d-ac6a-6a8a94b79dfd", "comment": "Malware payload (RedLineStealer)", "value": "7697395c5202388edaacf4270ddfcc09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342888, "uuid": "014ff525-8573-4fcc-b836-8e203376363a", "comment": "Malware payload (RedLineStealer)", "value": "af7bc7da8a078a53b9b0e620891e8f433a00ca03a86bae9c45ab91a103432493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342888, "uuid": "0b6e1517-90bc-427b-9900-1ae918251cdb", "comment": "Malware payload (RedLineStealer)", "value": "a6607ba4ffc01d85e40e3c4d9dec75dd50a4bc2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675342888, "uuid": "7ba8a7ce-adbe-4b16-8698-9c3cfeed6a5a", "comment": "Malware payload (RedLineStealer)", "value": "3124c1d4aa011567abe079fad91d482f11a39c9ca44bb326df095fad9d6aed5558f6d1cc85cb42338295c42efd2b8b6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342888, "uuid": "dbaee35a-fad8-4ebc-bdf4-be1ad406e491", "value": "T1F894BE02B6A5BCC9E5358B329F0FE7E4791FBD508E5873B63324AA1F24711A1CD62325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342888, "uuid": "7a5fdaa8-f29d-4cd9-8b45-91263a21c5bf", "value": "20540b45038474bafe70cf1c181e44fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342888, "uuid": "d0fbc62a-7dd4-4daf-9a0a-80ac7983b9a3", "value": "6144:s5LHIYhbKp9mIRdJUK7LV1qYs3KGSgRDLLdDORNVsd9/CJTk637eQfnd57eB+:ATTbS/REQ633KZ4PdDcHsd9CJb7d5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675342888, "uuid": "eaa676a7-89de-44a4-bf6d-70adf9a6f760", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675342888, "uuid": "cd58d757-9052-414c-a815-61f1449a266c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675342888, "uuid": "d37bfada-cf88-4198-821f-091ddb343f1e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a28764-a325-11ed-88f6-42010a9c006e", "comment": "Malware payload (VirLock)", "timestamp": 1675361514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361514, "uuid": "07c452aa-4093-4fba-af16-9110dac45070", "comment": "Malware payload (VirLock)", "value": "b2173c80e9503fae772ec37341f4af16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361514, "uuid": "44b1fb99-31d6-46a6-8c0d-f35329b36715", "comment": "Malware payload (VirLock)", "value": "afa4674776e47b3b5b4a59090c3c2fb7408470e08328aa6f3010a145182e519e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361514, "uuid": "313488c2-3c5e-47d6-a980-b2962530d2da", "comment": "Malware payload (VirLock)", "value": "f93e7e34ff845423133c7e5f7e21557725db1818", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361514, "uuid": "b3e47af7-1504-40e8-a422-b135ed4e71a0", "comment": "Malware payload (VirLock)", "value": "ed869f8e59a5d8ed702c5cc066abc26a54d47378ead41c9604acce8133f7ca1f8f68bb140df06e2f09711342713e126f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361514, "uuid": "73c24765-0598-4024-91de-4911d885f152", "value": "T1237599040B60ADDAE97139BF73C688984D81C8C3DD671D56EAD136347734CB9BA8DA0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361514, "uuid": "6cf77620-43ab-44f8-a719-42e75ea76916", "value": "24576:SMRgUC5SiGpvdRoUoeNX76KgJ9hZX/OtIb:SMRHC5pGpPoYZGKYhZXWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675361514, "uuid": "671e0536-dad5-45f5-ba8c-944cdb7607a8", "value": 1703424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675361514, "uuid": "4c6cefc6-f153-4bfe-a18c-267bacf79161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361514, "uuid": "97e1ee6f-6fbc-43d8-ad6e-3a6aaed118f5", "value": "heart.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f9bf07-a2fe-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675344881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344881, "uuid": "9a899374-e769-4085-ac43-9b761b09621a", "comment": "Malware payload (AgentTesla)", "value": "dcb80e6ddebe648cc889c3c4fdbc1140", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344881, "uuid": "7567f1d3-f4ca-4972-af72-42c84d61a516", "comment": "Malware payload (AgentTesla)", "value": "afc282bc05bba0fc2376caf8a82a72c1e708620fae92b1df63575132f159802a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344881, "uuid": "5ad40353-d0f7-472a-a8b3-695c14469b6d", "comment": "Malware payload (AgentTesla)", "value": "405b0cdb08732a2fa8c8b71ff2b962fe2bad4a1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344881, "uuid": "03804039-c92b-47e2-9437-7d8010695ad3", "comment": "Malware payload (AgentTesla)", "value": "66a6455b86e921337ee72ef3ea5d1c8aef91ff23bd7fe9d7d56b96007af55be5138d62126ca36a74b254953e24151be7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344881, "uuid": "4ae04e7e-e4ec-488c-b71c-db6bedfaa7be", "value": "T195742344BAF0C0C3F8610A361BB54A979FFADF1249BD9F070798BAC8B5B73824905765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344881, "uuid": "ba624b6e-c379-486e-a6ab-c9cfaa65739e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344881, "uuid": "21eb978e-a510-4a60-8b72-a984b4b1489a", "value": "6144:9Ya6tmSVQonSN1rUfxr6wggwhB/BNjee9e+bjCF1eVMhLkK2ge1h9Xhj6NodEaVN:9YPJVtSfIfAwgfhFH/eE4eVMhLj2gs7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675344881, "uuid": "df933cc9-7800-4a67-9a62-790a0a3b3867", "value": 339162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675344881, "uuid": "1f3cad94-8189-442d-b865-9ebf9e6b30e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344881, "uuid": "7c81d283-dad2-490e-ac5b-12602bc1dd9f", "value": "Quote_specifications 09321_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf5d473-a2f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675341586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341586, "uuid": "42170645-5ff9-4454-a842-d65ac14000d9", "comment": "Malware payload (RedLineStealer)", "value": "f79b6f47cd9b84d8c4604610de55a485", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341586, "uuid": "01a537ab-f0db-42e2-8cae-a7a274237e77", "comment": "Malware payload (RedLineStealer)", "value": "b0122c95f4294b9ffe605ae477aea84f929b2bd492a228245009ebe5cc45498b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341586, "uuid": "661a3320-5197-403c-94e3-98fabe9f0241", "comment": "Malware payload (RedLineStealer)", "value": "98cc65a463cb4ff43457e93d51785efdbc16d657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341586, "uuid": "1334d2ee-1154-4b89-8b72-0dc3af050aa7", "comment": "Malware payload (RedLineStealer)", "value": "6d85f9cfc70de6bb7a4ce9ed8d704e35fd93b09ab6302b3e03ee9b4f474b947b49714a92f6d8b2195ebc52a7d797b601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341586, "uuid": "8ad4a776-ed39-407d-88ed-c81b8ded2270", "value": "T12706233311611085D0E1CC3AD63B7EE5B0F747EA8B52ACBD669D7DC928125ECE622D83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341586, "uuid": "4adf22c0-9108-404e-be30-7b166f2e019e", "value": "dec71b085dc5a08706fa389ac5f0718d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341586, "uuid": "71b6dde8-3b6a-4c43-85d9-9cc27cfcbd18", "value": "98304:U2LGW6oyYCIkaVWexKn6e3qNVHRQmokVlHBWEhOv:xLGd3YAaVJPeKHC4tFOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675341586, "uuid": "303133ce-449b-42f0-a3c4-30d0d64cdb1b", "value": 3825152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675341586, "uuid": "86d79d20-295f-4c96-9a64-a79ca82f1c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341586, "uuid": "ef448588-b312-47d2-b82f-d570a5c87049", "value": "Executor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8018cdb7-a296-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675300279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300279, "uuid": "6a92e7b3-b0c8-4125-a06d-3b93464936b3", "comment": "Malware payload (RedLineStealer)", "value": "ac77d649ebe1b648b4f67d023764a6ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300279, "uuid": "2a685d7c-900e-4aed-b8be-91bc9743aa66", "comment": "Malware payload (RedLineStealer)", "value": "b1e6b40dc89067c0df47a56be6d53dc365f154fc99985926e0db267d291e494a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300279, "uuid": "14c17ca4-c3e8-45a3-91d0-6ff2b80cf95c", "comment": "Malware payload (RedLineStealer)", "value": "7df085d7d03e34ee988a1cb5f436454f8dbc69bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300279, "uuid": "741784c0-fe10-47c4-bd20-ed8e40b1bd6d", "comment": "Malware payload (RedLineStealer)", "value": "33464a045aa2d40a01b173d4ee3319a5ff793835c85b2b507a067c5f648bc7824f321dd2977940a9d839766fd49c95c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300279, "uuid": "f97c035f-911d-4cc4-8fba-46f4a95e8706", "value": "T1B1A35D3067AC9F19EAFD1B75B4B2012043F0E08A9091FB4A4DC154E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300279, "uuid": "e1b1248b-58fe-4860-a6dc-9a5d47d95bde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300279, "uuid": "c515c9e2-05d7-4912-a0c8-6d9c5e2d8449", "value": "1536:5qskbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2utmulgS6p8l:X2wiYj+zi0ZbYe1g0ujyzdS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675300279, "uuid": "d3e367ce-4949-4fbc-a941-80694c015011", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675300279, "uuid": "23b932ed-94c0-41ce-98b5-2e252cd3caaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300279, "uuid": "7b860ad1-42d9-4c64-abf1-2543980379db", "value": "ac77d649ebe1b648b4f67d023764a6ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639397cf-a2ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetWire)", "timestamp": 1675324283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324283, "uuid": "025d4ee5-ce9b-4a1d-8b9d-0a88c219dd6f", "comment": "Malware payload (NetWire)", "value": "f35c9fa6756cbc5e791367d675cd5791", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324283, "uuid": "74e2b0aa-ad0d-413c-9b78-e116cd50bb50", "comment": "Malware payload (NetWire)", "value": "b1f7c395aa293abc666ae5548a3d36c683e24917c190bef16f1d11add0cf5fea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324283, "uuid": "a74c8301-7dec-4fe3-b568-aa24206262ae", "comment": "Malware payload (NetWire)", "value": "5c1b25e3eb653e39dff6969ac64b24ebca2646a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324283, "uuid": "d5560cd1-a2d8-4764-8cf3-b76924817fa9", "comment": "Malware payload (NetWire)", "value": "2684da51248cb5da51b947a9633019878de8140b8f152b9011e7db0343185366228fa7de49f20f21f197996008621daa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324283, "uuid": "55e2127f-a9a5-4e38-8dd2-2b4ec8e06d7f", "value": "T1B654F198F99489A3EC9A0973BC6BCD065776FD212A640D4A73C8BB5F2D73443C10E693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324283, "uuid": "836d6d59-d0ab-4495-b561-029d27c88ae4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324283, "uuid": "e2b8a7b9-1042-4c5d-b515-a57a3117d9cc", "value": "6144:3Ya6U3Pc/eEvhW0ZPmRlfwL8FUq+snr9PAM20OAURe7pfI:3Yi0GEvh0R5BbhBP20OAU4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675324283, "uuid": "fb20ebad-67c1-449e-bab3-4e85f6632646", "value": 297706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675324283, "uuid": "cf8e146c-735a-452c-950e-ae332eabcb42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324283, "uuid": "d22ccc98-de4b-4f37-81ca-e413c77cf724", "value": "f35c9fa6756cbc5e791367d675cd5791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98515c9-a2f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675339943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339943, "uuid": "de303158-14ae-4d1c-9b2c-898f517b384f", "comment": "Malware payload (Smoke Loader)", "value": "05e29acaed866ce861227e4e0a287890", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339943, "uuid": "ba67cb8e-3a8e-4b15-a153-1d543b413f00", "comment": "Malware payload (Smoke Loader)", "value": "b2e449dd5938e3461527526ba950af67894c6c3a3b01f79aa2a0d38cc64327b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339943, "uuid": "a26b6aec-f275-4cf7-82f7-1df59a1207f3", "comment": "Malware payload (Smoke Loader)", "value": "87558dd11c4cd704566877cb2fb8e0f1fb71d59a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339943, "uuid": "5f56c996-94d0-4c4a-98da-956312fcd11c", "comment": "Malware payload (Smoke Loader)", "value": "e942fc4629a8a8b68f24db4bc96a258ff2d6064b4b9caaaa501d768699dff652ce5432d6ad18125894acc0ac9ae3bf2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339943, "uuid": "f47bc6be-79ca-40db-bcbf-38d330e046de", "value": "T159648D0272D0BC49D9328B329F1FF6E4791FF9518E9977B63214AA1F28701B1CA63725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339943, "uuid": "a51c0f73-b260-41af-882e-cf8a03af99ba", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339943, "uuid": "204d7b60-f5f9-4e25-9b35-9f59ef57b2ea", "value": "6144:4wL7M7b9k5actb6E9mpC2x8zw6EG6L9/CJTk637eQfnd5wYoB:p+bS5act0OzgG6L9CJb7d5wY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675339943, "uuid": "d1d1bb62-bb47-46a0-bbca-12200bff6ea7", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675339943, "uuid": "0b3a80ea-cc91-485e-b585-10ef87392c75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339943, "uuid": "714cebdb-b78a-48f4-93fb-5a29531e4bcf", "value": "05e29acaed866ce861227e4e0a287890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911efda0-a304-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675347552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347552, "uuid": "d6f9ab5e-3198-4903-ae7c-1d3bad4a6371", "comment": "Malware payload", "value": "37e728d5d377c838dae63e4fba1bc195", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347552, "uuid": "4ab4d903-aacc-46d0-a8dd-b9d8bcadc0a4", "comment": "Malware payload", "value": "b30d3418488c5765a2c65260ce6c1080760790d6daea90a7df1207edeb6950e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347552, "uuid": "24def4ea-9c19-45bb-a0d1-9c2ea8dc2756", "comment": "Malware payload", "value": "5dd3d521e776ef83b5181ce1d9a9a46e4f10da66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347552, "uuid": "9aed51b8-9be8-42c1-befe-76e330492b99", "comment": "Malware payload", "value": "9a91b63921ef02bcf31c2504d5fd09c763ad09dbba829120681fc95e57a0a73df230b4c2f23084f3d4bb513c7f003956", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347552, "uuid": "7fb9dd89-a712-46fa-9c3c-7022d696218f", "value": "T1B86412C97994E87FCC17D03A49598D948BA67677226FE293404362DA5C4FF1B8E1C0B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347552, "uuid": "25f5f34f-9173-4674-a15a-347c31b32890", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347552, "uuid": "48cbc893-b9f5-42f7-967f-c57360cc3aad", "value": "6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675347552, "uuid": "e9aa0c1b-1732-44c7-a95a-464616e2a939", "value": 333676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675347552, "uuid": "af0e5a72-9457-4726-a5c8-94d7a84ccea1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347552, "uuid": "91bb661a-e933-45f2-a427-d451181270e4", "value": "37e728d5d377c838dae63e4fba1bc195.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfebeb8-a338-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675369824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675369824, "uuid": "77353304-aa47-46ed-aa1d-158e0a55a55f", "comment": "Malware payload", "value": "29038a2c03e1691bf7f192d3267d6839", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675369824, "uuid": "b073f1ee-1d1e-453d-9ba1-6939ccd6ecad", "comment": "Malware payload", "value": "b3b5859e2c54f73338be0a6f06b1b836f77b1c6368be12e1154b3b17d98674bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675369824, "uuid": "c6846053-4f2c-452b-a0d2-9934e83020cc", "comment": "Malware payload", "value": "913afd1bb870d422ce98c169b25f3c700189fd40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675369824, "uuid": "b51db509-00ae-4c76-b5f6-557c9d285b91", "comment": "Malware payload", "value": "7b6231be52ba38862dd0914aa8e84326bd6a17c47b3fab3bd206a74eee9a948200b7bc550983d46bbdabca41b846bc63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675369824, "uuid": "4ce0f029-9fa4-4ed6-8388-8d0edc30d0ae", "value": "T19C94BF02A2E2FC51DA21CA729E1FDBF57A1DB9414E687F2612185F7F3872172C5A3B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675369824, "uuid": "cbc405ef-b64e-4933-b8b9-253070e262c2", "value": "2ff60b2f756b6533c2643b340c02a5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675369824, "uuid": "95b824c6-1f21-483a-b73a-cac3e3049273", "value": "6144:hnxpLsqhmEaKvHDEX9tClggJ963KxrE253lwKwpxIdjV6ptCbNKNc:hnxpQqUEagjEXyJTE25leIJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675369824, "uuid": "8bf13da6-47f5-4287-af5e-b17cb90e290b", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675369824, "uuid": "efebe2ec-f5e9-4a74-9c85-bef02abb72a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675369824, "uuid": "f5f0ae8e-765a-4e5d-851e-3d237bb9415b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5fa19a1-a2e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675333843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675333843, "uuid": "660b3522-72dc-491c-a3e1-699f50ff925f", "comment": "Malware payload (RedLineStealer)", "value": "8d411fc8855b010bf2d4baf32eb10172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675333843, "uuid": "b67fffd6-b1dd-4b1e-bc66-3b37479425eb", "comment": "Malware payload (RedLineStealer)", "value": "b4fca86320683b5176268d1d5abeacb58e00524fc8313168d54e12060ac49e70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675333843, "uuid": "542c6f38-4c66-4454-ab65-0314cda85a36", "comment": "Malware payload (RedLineStealer)", "value": "8b7205ad49f10acf6f66b8ad68a9d10189f1dc3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675333843, "uuid": "7bd9e1df-63d1-4f21-a225-55ed97980324", "comment": "Malware payload (RedLineStealer)", "value": "633a477c6a71ba4338d7a169126de5d865043cb94c8730fcf12f1f48c0d98e96d644aca5a6ce75deb641c0a4be15dcda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675333843, "uuid": "71795dd4-d526-4de5-8126-8aa2743c8bcc", "value": "T1F594BF0372E1BC49E532CB718F1EE6F47E1FB9508E1923761218AB9F17721E2C962725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675333843, "uuid": "8e075530-afe4-4eca-ab59-1cccb1456214", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675333843, "uuid": "7551e1ad-fea9-4e60-9680-08f3741edb4d", "value": "6144:adL6wfH99TKO/n07oFe7kApKdb26XOaHO0/ToWvLXoplGW9/CJTk637eQfnd5MDB:2HHnKin077kT75/zoplGW9CJb7d5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675333843, "uuid": "f990cee5-d958-4ecd-ae9b-b25328e15090", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675333843, "uuid": "fda2021b-2075-4637-848c-069fc77bace9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675333843, "uuid": "5c5da3b7-6fd9-4f6c-b0e9-e9e51b9bf555", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fbc9cc6-a2e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Royal)", "timestamp": 1675333645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675333645, "uuid": "c2bc9249-166c-459e-b168-90129601cad7", "comment": "Malware payload (Royal)", "value": "2902e12f00a185471b619233ee8631f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "royal", "colour": "#57A996", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675333645, "uuid": "10309763-c663-4c5e-949a-013e4ad84dc5", "comment": "Malware payload (Royal)", "value": "b57e5f0c857e807a03770feb4d3aa254d2c4c8c8d9e08687796be30e2093286c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "royal", "colour": "#57A996", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675333645, "uuid": "cfbb729a-2839-41a5-8d9e-05b194528f1e", "comment": "Malware payload (Royal)", "value": "7e7f666a6839abe1b2cc76176516f54e46a2d453", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "royal", "colour": "#57A996", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675333645, "uuid": "242a7e18-9a83-421a-9462-2c37dab6a256", "comment": "Malware payload (Royal)", "value": "b5134bc64916b1ff9764f47b97b9f609489fcab1409f26309bf18e3ca8389ccc10ea478a5d8a40a6d57b95625b6c38f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "royal", "colour": "#57A996", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675333645, "uuid": "b86c7e2e-26a1-4215-ac9a-4899f968500e", "value": "T117C58D27B8A610BDC9DED430866F8132AA74B45C43607F3B2295D6313DB3F286F1AB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675333645, "uuid": "e015bc09-4207-4d3b-8c14-ddbb64b71284", "value": "49152:2bZPXEinhLENX/bX40MA4sDM9RIfiv2eZRBqnlptIU6iQnkgWbwL/KIRpvg9Suj:4KinhLEBo0MA4sDoIqv2eZOnlw+QnHp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675333645, "uuid": "53aa6bdb-f09b-4c3b-8aa6-6db3a2a467a6", "value": 2558055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675333645, "uuid": "ef56b213-0d0e-4d4a-bd1d-a762a3e61956", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675333645, "uuid": "1881eae4-ea14-457b-954d-0cfc7055c059", "value": "b57e5f0c857e807a03770feb4d3aa254d2c4c8c8d9e08687796be30e2093286c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536eb982-a2ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675324256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324256, "uuid": "7ad9111b-245e-4b2d-acf7-c2a2f71e4be6", "comment": "Malware payload (RedLineStealer)", "value": "a7055f37f4eab727ca0765cb26a0397b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324256, "uuid": "256b1524-9694-422c-ace8-244a5b958584", "comment": "Malware payload (RedLineStealer)", "value": "b58e634e48d4b316fae9c0b9b826aabaaf01276051e2a145985e22886b50461d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324256, "uuid": "e64d1799-ccca-4c8a-8350-cc67e5c1ea26", "comment": "Malware payload (RedLineStealer)", "value": "eb771bc6154c05b55ad6c5887da3b3133084334f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324256, "uuid": "ac18b46a-e1ee-4480-94e7-ecc55b194cac", "comment": "Malware payload (RedLineStealer)", "value": "c1bbdd0ef80b89f6696f0cdfef95ced326cec408125debc43f6b43433ee7f70ad61c0caba3ecdf895ea6d76ece5f6efc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324256, "uuid": "dfd94e29-4b63-45ce-9aa0-aeca5e116c23", "value": "T16CB5F8D1A7261EEBC78414FCF4C78A43AB1457B19578C8E1CAE738BB7882D123D96718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324256, "uuid": "daf5d0a2-1539-4336-9f7b-bc80781aadb6", "value": "a3017ccb2c25f455f959277b4c3674df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324256, "uuid": "1e5391c0-2d8a-4614-812a-6a4c6ec0f659", "value": "49152:lQ5QOMv9Ia36OBS8ajFB2Yf3XJ1ZoEwDm4C:lQO9Ia36OBS8axB2a3jZoEwDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675324256, "uuid": "32ce1712-707a-4566-8b30-0c61fcf3f318", "value": 2370954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675324256, "uuid": "11508c85-cdeb-4849-94d5-d4e53389bcbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324256, "uuid": "840828e5-6d28-4e85-8c9b-70c4dc013870", "value": "a7055f37f4eab727ca0765cb26a0397b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a02b550-a2c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Downloader.Upatre)", "timestamp": 1675319516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319516, "uuid": "da8b5013-25eb-4222-9d2e-3f4da3ba0af6", "comment": "Malware payload (Downloader.Upatre)", "value": "2ac44482006814710b4213000b27a7b8", "object_relation": "md5", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319516, "uuid": "0d4c817b-7ba0-4b39-933b-f662e1d70f99", "comment": "Malware payload (Downloader.Upatre)", "value": "b592a44f67e06e47646ade57f8737600011b7317fd9c130b5835e9aaecf795c2", "object_relation": "sha256", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319516, "uuid": "936fc172-8b9d-4118-b7e2-ecd23fe273a3", "comment": "Malware payload (Downloader.Upatre)", "value": "3761276bd7aca61e4d14c70fa2d15e32bc0798a6", "object_relation": "sha1", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319516, "uuid": "9093abee-5181-4dca-9fde-009e4225dffb", "comment": "Malware payload (Downloader.Upatre)", "value": "7483745d877ebb86591bb4baa305d4ec84081196176e4341a2ef7a322560b8563d1060671f1d8ab4cb21628c76807338", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319516, "uuid": "b6cd62f8-fb71-4f20-b923-4f202ab33c6b", "value": "T1A953D6A15BD164F0F3375A703CFDE9B294A67E1A1B23181D1986F70F88363819AB0E1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319516, "uuid": "14634c85-d38c-4d83-b42a-6a4667175a38", "value": "0857c95156001e46d97f85c864bce974", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319516, "uuid": "ba3ff718-9f15-4faa-902f-8ee90f1c7fdc", "value": "768:aw5C+WKkTP65wIMR+NnREquHcbbbb++Z32h33:aw+tTqNg+NiKbbbbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675319516, "uuid": "80c8b2dd-6d04-48ba-8d38-fe92a9bd0bf5", "value": 66520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675319516, "uuid": "8b4ce0d7-8bd4-42b3-a8c8-3ca2120635e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319516, "uuid": "25fa9fb7-d02e-455f-977d-b2bfac915118", "value": "document.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95ce858-a2c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675321850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321850, "uuid": "13bd32d3-7b8f-40b4-9053-38463a3674be", "comment": "Malware payload (RedLineStealer)", "value": "fcd99c72f574e0319699ee984eb1ce9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321850, "uuid": "7c9debac-c91f-4809-b07b-a2c1c9d87d9e", "comment": "Malware payload (RedLineStealer)", "value": "b5ffc9d72c07171bfb7a6e1d2bd32fe7e396fbcb9b913e1509c081bd9ae9c5ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321850, "uuid": "ee720fa3-1675-4567-a844-36ff5abe0c69", "comment": "Malware payload (RedLineStealer)", "value": "e4704ad1044e23ff6fa5a3099479215f0f87850b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321850, "uuid": "f669c4c6-1d8d-4610-8dd0-eeaa3aad3676", "comment": "Malware payload (RedLineStealer)", "value": "ab2257df49a8a730765a37665ea4372e9132e59d57eb9a5d6f6974f21e75fc53cbe5417f07612a81293b6d622302494a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321850, "uuid": "19e9334c-4cc1-44a8-97f6-33c245a23302", "value": "T153740B887670FD9EC867C47F8A681C24E6636466570BA203B05317ED993D79AFE070B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321850, "uuid": "074290fe-7e39-426f-aa9e-2879cfbc1e1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321850, "uuid": "3b966354-d62f-447e-ba99-de7252eb974a", "value": "6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675321850, "uuid": "14d6110d-ff8e-423c-acc3-dfd57e3e0fc9", "value": 344040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675321850, "uuid": "3fba39d8-6475-46c5-99d7-b7af777377af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321850, "uuid": "f62ea58e-9ea4-4a12-bb8a-a587df2ba78f", "value": "b5ffc9d72c07171bfb7a6e1d2bd32fe7e396fbcb9b913.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c019817-a326-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1675362147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362147, "uuid": "a4ce8842-9224-40b6-9102-1aac3718d159", "comment": "Malware payload (Chaos)", "value": "825ed45d7ece9ce8c2e0222225096a32", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362147, "uuid": "817296b2-400a-4e36-a539-b1f79ffe1ed9", "comment": "Malware payload (Chaos)", "value": "b8a0caadf78b63714aa008164ba51694c2a33830cf1377d1b5a143317016254b", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362147, "uuid": "0d438333-c823-40fd-95b3-12bbabbe827b", "comment": "Malware payload (Chaos)", "value": "e7b69dd73ffc65d81ccc320fe27ee32471d0c1f2", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362147, "uuid": "a9524e23-fc85-4352-b113-092446d33fb2", "comment": "Malware payload (Chaos)", "value": "e9cbe673a414505c2812c079e35b0e2a66d7bb535aadb2c56423a5f4d8fe57a026f0830e090d74761bf24239a46ffab1", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362147, "uuid": "94eef0ce-71e5-4f40-b76b-ce95c6e78a52", "value": "T11DC2D618BBFA4A36F6FF5F7869F251014776B956DC29D74D0C8D10890C23B8C8DA0BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362147, "uuid": "f8405566-6e6c-47fc-b888-cff834a669fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362147, "uuid": "1fe058c6-34ea-4bdc-bbec-0b2d0680cce3", "value": "384:AtWZPzzxAm1v/5ZHk4u+xS74WtRQGdChlsNpG90lVOy5o91BYfu3m82vZ:17zxAm71xS1RQGdnN4mho9h282h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362147, "uuid": "ccb4a163-1a94-4e6b-9e4e-101ab886f6ac", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362147, "uuid": "631971e4-b8c0-4774-a889-247ebd3ca396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362147, "uuid": "8fe80b6f-4cf6-491a-9aec-7f0985e6702b", "value": "2023-02-02_825ed45d7ece9ce8c2e0222225096a32_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c86790d-a2f3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675340109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340109, "uuid": "f890bded-6ab2-42e7-bdcc-45016283646f", "comment": "Malware payload", "value": "b4f79523583309b10379af33a87b5f47", "object_relation": "md5", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340109, "uuid": "4212cc36-2d47-41d9-a291-db0d55041042", "comment": "Malware payload", "value": "b8dd286b3f6fe01b1102581fb82dc9584c7bb5d22473efa069d7eddb313ac7a1", "object_relation": "sha256", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340109, "uuid": "d1c5ab68-a588-4cfc-a704-b4d10efa6e59", "comment": "Malware payload", "value": "d0d3fe66ab986f08ecef6727a9053aa0aaadac0d", "object_relation": "sha1", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340109, "uuid": "275fa1a2-b536-452c-ae0c-5713348b82a6", "comment": "Malware payload", "value": "12f0acc745bf1333e39625f38ff00021ca8223b9e528cc07f902f608f51f1367d6f171fd8b3ab59f942bbfc546f679a1", "object_relation": "sha3-384", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340109, "uuid": "f73f44bb-4663-4493-a2c8-497d885a6b27", "value": "T112E48B10B0A2C0B9E16C00B1767D3F7F697D5D440B746AC373D85EA98FB41D209FAAA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340109, "uuid": "2bb01ae4-94a3-4c3b-beeb-47e0ff8a6a9e", "value": "632b16938b3f8666e6a819d4a0666c8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340109, "uuid": "2124b2f1-3825-479d-bcdc-18453aef86e3", "value": "12288:Hq+4AgSN0+gxO+rRoaE2RePwLFqb18QouTROQ/0Q337:H/PgH+gxO+6oLF018QKQ337", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675340109, "uuid": "9ed3f610-efd3-43fd-aebc-ce2038cd7afd", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675340109, "uuid": "9c8c85b2-7855-41d6-a539-733718c3947c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340109, "uuid": "f08d09f2-4bf9-40ae-9193-3400d15c1279", "value": "Orthodox very simple cheat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62076078-a318-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675356063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675356063, "uuid": "c956f595-4df8-4524-b711-2b68696f4d0d", "comment": "Malware payload (Formbook)", "value": "c5681f0e12aac8a5f3461b636bb03e0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675356063, "uuid": "89b6f4d4-7f19-40bf-a589-da380fa0af80", "comment": "Malware payload (Formbook)", "value": "b96df0c566daa119af3abd0af7c0221689f411678da926608b493e8edd707715", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675356063, "uuid": "daea8489-201c-4beb-bd5a-5e381b49070c", "comment": "Malware payload (Formbook)", "value": "7dccbceaaa2f18357746e7105c2d9a5caa75e8fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675356063, "uuid": "1101908b-506b-4668-8b5b-303db68c120b", "comment": "Malware payload (Formbook)", "value": "b551c4b483529501c188975f4b59f9d5a376e394943e13b3bcbb2f8fd8be7a021222ce79090de92c10160911c444d30e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675356063, "uuid": "91eeb9ce-f9b4-4f30-a3f9-bfa35ab22be3", "value": "T11177339757F3EE20CDCB4571E8C6AA4630ECE88DD54AC7E1A5AB3B994D7D832050321B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675356063, "uuid": "0dcacf81-e5b6-49f3-ae6e-729e133e22cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675356063, "uuid": "9b3d0ea9-c345-4c18-b083-fd532bb7e7e3", "value": "786432:uNNuklYm9MgdaR5qAV72zEWxOUfM30wvvoO2Hum6y/E87eqzDI:u3uklYmMVfqOq46E0+277C6DI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675356063, "uuid": "c3042786-a085-4ce9-acf1-be92bf1f228e", "value": 33945088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675356063, "uuid": "4c547a86-364b-458d-9ec4-edadb30d30b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675356063, "uuid": "d5a39210-c128-4c9b-aa48-15a6a921dad6", "value": "B96DF0C566DAA119AF3ABD0AF7C0221689F411678DA92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ecb4db-a34c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675378484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378484, "uuid": "8e3830ee-0f96-4356-887a-9cd1c4e64d70", "comment": "Malware payload", "value": "25035abb52d2f2fb5d2ccf3970b28d4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378484, "uuid": "c04711a4-689b-43bc-aac7-d09f9a407579", "comment": "Malware payload", "value": "b9b662268799479031a208b0d144559da6fe242a94b3329fc5b31d66f77900bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378484, "uuid": "8f0b4a2d-ea02-4590-8605-83f8a168f189", "comment": "Malware payload", "value": "1755cd24d3a627032c996a5187058d800bafe9c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378484, "uuid": "f05623c0-2f28-4e09-ab90-d334d2fa22ad", "comment": "Malware payload", "value": "0b13fe016c85bf38009ca8a53c36c0c94d69d21c7d4b8ea88f03f1ca5ecb70fb33a3fef20283c6e3a26f93c7566fb966", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378484, "uuid": "b5031f9c-47b2-4f0c-b08c-dcc7398f5c57", "value": "T17414C053A7E88033D9B51BB058FA07D30B36BCA15E78836B2795994E1D73680E53273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378484, "uuid": "457a7f21-572b-44d9-b78d-d4fa9f205f77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378484, "uuid": "79afd8c5-ed97-48a8-bb9e-a28045af3477", "value": "3072:gOhX0N7+f1y5GWp1icKAArDZz4N9GhbkrNEk1ssR84+aX5DD0Wv7VdcX07/:lhEN7+Op0yN90QEDs+9y7L/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675378484, "uuid": "4d428465-6d88-41ac-96c5-a2e28361d1dd", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675378484, "uuid": "2b5e3ea8-45c7-4d1d-8712-5ba8fa8fe40b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378484, "uuid": "a18eb7e2-e590-4d44-af1e-38c0a10c5436", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3a21e4-a347-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675376163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675376163, "uuid": "ee6b1cc5-8b50-4772-b670-bfb95270ff91", "comment": "Malware payload", "value": "79861b06964d2eee236ae16c9329f6df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675376163, "uuid": "f5f3fe44-9062-40f9-b8f7-114736f62857", "comment": "Malware payload", "value": "b9be22b5b98ed96eda1bbecaf116aa1a38500db02ef904397a762f48f20f60e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675376163, "uuid": "4d7f2e91-83b8-46f4-963e-841d96157b44", "comment": "Malware payload", "value": "6f4999054114f11595913dba6489db1c8546339a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675376163, "uuid": "d11377e5-47ec-4854-9f2d-0f5661717254", "comment": "Malware payload", "value": "87c3686fb2766079b4724f30585cb0253e5af8608e2b77ca3cc02eaee2b3deb6c6336d99c36feb779e2c5324ca061756", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675376163, "uuid": "c52bf166-bd15-48bc-8b7d-159b32e306cd", "value": "T12BF4B239197617E6D338F63182E14020B6EEAC837723E959ACE636C54F319817ECE61D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675376163, "uuid": "50a6fe3e-18ee-4c34-b085-5d6c2ab53c26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675376163, "uuid": "0dafe614-95ef-4683-adcc-85ea2b04d8d3", "value": "12288:MUY4jr+C+2SlLVseHKNTn7tunA+/kSL+70XKp2l5/35TTfyvCkmcsJO2ueinx0NV:MwejseHKNTn7tunA+/kS9Gak1SiSNZI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675376163, "uuid": "8412a415-5133-4c3c-8774-906f3a8e29c9", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675376163, "uuid": "3ff2c79f-0a80-412c-8536-a37cd69fbd05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675376163, "uuid": "c401ad7e-1af2-428f-9464-d659649547ec", "value": "ft6hjhk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95d2bd9-a2b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675315059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675315059, "uuid": "a6bcf7a2-acba-47bf-8e80-ec7414bcf623", "comment": "Malware payload (AgentTesla)", "value": "6cb19652cca7715b5bfdbab9dd37b5c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675315059, "uuid": "eb07ef2d-87c8-488f-b83e-9b68d91a9b99", "comment": "Malware payload (AgentTesla)", "value": "b9ce22d86ba1fd0268708a85e302d079f4aea92d36334b385aac28465cf67e9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675315059, "uuid": "53beb951-0edf-47e7-bedb-c107409c85fa", "comment": "Malware payload (AgentTesla)", "value": "974ddadb8e316cb800cf8cfde95f22a17ea1fd52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675315059, "uuid": "f7596bf3-131b-4a07-86bc-2edc713cec3a", "comment": "Malware payload (AgentTesla)", "value": "b554e1ca3dbf4dbd5063f7860001109dac26a079dd74804f9267e23027c5d9681ba7ab4c18271d2669ef9f1653c1008f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675315059, "uuid": "e1669b57-cc00-463c-a5d4-f4337e56c074", "value": "T147A31018A3EE5E23D96AD7781953F3721735CCA245A1C7071EC4ADA73B1BB822E100F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675315059, "uuid": "6fcffb5c-1310-4100-8e54-26dac621ccca", "value": "768:O++rN0JFuOPIkzhNM75NbcVfup+btYAJHa4H:OBN04kzjUcVfupotYyTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675315059, "uuid": "f7c2f95a-5666-43e6-8a69-cb8eb31647f2", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675315059, "uuid": "fa47b898-3fd4-483a-9448-2394ea28d57d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675315059, "uuid": "87d62c1c-b909-43ee-9a17-a165e6cef6aa", "value": "INVOICE AZ340098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad66ec3-a340-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675373499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675373499, "uuid": "7999e774-c4d0-4bce-9bc2-63b4242c873b", "comment": "Malware payload", "value": "a64192758f007855605a937e59c34f5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675373499, "uuid": "da4f5c39-ead5-4e86-8b9e-122010c9e3a6", "comment": "Malware payload", "value": "ba504fe81eba382ceb7bf5ab201a0c171cd12d3df8aba5a89d6fd2625e704a25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675373499, "uuid": "4e8e93ed-8f6b-4b7a-9c2f-9bf2a9e165f4", "comment": "Malware payload", "value": "9146136b8edfaf33a417be2d0d29b9fa4e9fd814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675373499, "uuid": "2878beaf-39a4-4441-9c24-ed704153dcaf", "comment": "Malware payload", "value": "6009566ae6c828585d9f3f13ed3d639f720f72ddce9d00992bcc14f0e4ae2f57827d792714d8b915ae2a360b67ba6ba8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675373499, "uuid": "9ae5f2ba-8f69-4835-b29e-0e1d2bc44fa4", "value": "T14A94BE42A2D1FC41D625C6729E2FDBF47A1EB9514F297F6A12189F3F1972032C6A3B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675373499, "uuid": "f7ecac3e-1d5a-4d00-a3f7-d049e1c7a635", "value": "2ff60b2f756b6533c2643b340c02a5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675373499, "uuid": "3c468560-8982-4be9-8200-c4ab05813c71", "value": "6144:Gxw91LVMiWE5aSd5YRJmKSwwRvONGHU8p7sH5Ac3lwKwpxfjV6ptCbNKN:Gxw915M9yaSQbFSwa2N+U8pYZAglej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675373499, "uuid": "29038417-cda4-4550-8d36-21be5d8204da", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675373499, "uuid": "e0185f7b-c157-4b1a-8d49-b56dca3185e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675373499, "uuid": "9a7609a7-3863-43ad-850f-5aa88a4a8a40", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a57a345-a350-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675380102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675380102, "uuid": "b98c3a0d-447f-4ba1-8809-0be01c4c1bb9", "comment": "Malware payload", "value": "fecae9a2204a0164aa4c99eced659c6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675380102, "uuid": "a85166aa-b997-45c8-8009-a232a2710417", "comment": "Malware payload", "value": "ba6d2bdf2a48e5b1528cb4ba17facba777ea39af5e844f6109e31fc88956a599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675380102, "uuid": "1f589500-d842-405c-8244-2a20a44b14d0", "comment": "Malware payload", "value": "bb895d5c5408c0e9fb71804db40df84d6aae4dc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675380102, "uuid": "80e16e4a-b6f5-4d53-b91b-2788bfce42af", "comment": "Malware payload", "value": "b32a40834dc88da68e92af34ae88324d008ec204691b50072293c4dcdd6cf407066f28f0f293c5daac70f32f2063a8c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675380102, "uuid": "6d083ef1-53b3-40ec-a00b-de69aaccab4e", "value": "T19B7633207BD65CFBC9E90E360D50EF8FADD705290922CC97A74B4527CE2E991C81EE18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675380102, "uuid": "8316b3ab-fd18-428b-9729-1f6bf09df0e6", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675380102, "uuid": "303803f1-87f7-4d01-99a4-080359edada7", "value": "196608:91ONvcR7Q4kCFp4SNigzEU8jHPwfXtbtqjvoXT:3Oo7/7Nh37vl4jwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675380102, "uuid": "99b2dac0-54f2-4a62-978e-48ffe61de34a", "value": 7641747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675380102, "uuid": "5fd79fde-170d-419c-a1e8-675967b6ceb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675380102, "uuid": "5d668133-cefa-49fa-9dd4-f3bdf8825435", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06462674-a31d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1675358057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675358057, "uuid": "df69593b-9848-48a8-b1d6-c703fa9c9fef", "comment": "Malware payload (Adware.Generic)", "value": "5cf6ee9334d0e7502b4b244e0e9b04b6", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675358057, "uuid": "ba1a549c-6221-44ae-8f57-f1d0c03b6cfa", "comment": "Malware payload (Adware.Generic)", "value": "ba8b43a7ea0b3c9ce2d930b496ca267d38f6d4360885459a098b6889f82c342f", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675358057, "uuid": "124d7b25-5cbd-49e2-9e03-89798a6ddc53", "comment": "Malware payload (Adware.Generic)", "value": "9f70a35dc691200369f2d6df5cd828e52b10b849", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675358057, "uuid": "6c795486-ae3c-4003-b242-20715738bca9", "comment": "Malware payload (Adware.Generic)", "value": "ff1ffecc29e86ba810fbe49665288497d2a76c188db1176c31409dc86f4fec035e916e5a12c0b8a5e7f3f63bcafc2e9b", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675358057, "uuid": "a4479d12-dcc6-46c8-bd3f-2152d2382f95", "value": "T16216335115DE9C39D0BF087612E186D8E83C18C360B4A064BFADF39A2FBC7D8855F999", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675358057, "uuid": "5543b6ec-236a-4c9c-b485-62d18895d643", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675358057, "uuid": "ceb2bb65-2e97-4ccf-b530-2126b9630cb8", "value": "98304:+v6W8zntQwyUgOlHpKjcCAYSmOppy3OlaQ:06ftKKlHpUChgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675358057, "uuid": "51c51120-de36-4773-af89-39d217e4058d", "value": 4111824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675358057, "uuid": "79975e73-b89c-4f38-ab24-5be63c40181f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675358057, "uuid": "6d19a66e-18fb-490e-814e-fa94d1400128", "value": "Monopoly_ Here .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdbbae03-a2a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675306852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675306852, "uuid": "d5afdbf9-6c8f-44a2-9380-742922441b0e", "comment": "Malware payload (RedLineStealer)", "value": "cf56cb698fea8c52f132c21599b97242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675306852, "uuid": "3c49d79c-0be3-4466-8237-202242eab2ee", "comment": "Malware payload (RedLineStealer)", "value": "bae614f80a8ee231b894a74a67a390115aa61d9141426ac4699ba07fcd125498", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675306852, "uuid": "44b7fa5c-4987-4542-9a58-ec367137421f", "comment": "Malware payload (RedLineStealer)", "value": "694d0aa6dd688cdeb8be67ea6311c8ac591b6bff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675306852, "uuid": "75cef745-c090-4f63-a00d-ba8a8a3893cc", "comment": "Malware payload (RedLineStealer)", "value": "3f6e075c3b49b7664e517d573d7556fbdee8625967f5f9b06da9feca657da022f9fe6ec61859eab23c7a752932d06ee0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675306852, "uuid": "b9bfc297-6a61-4961-a674-7a2a60cec629", "value": "T16B7402327191D072E5E300305D20EA94ABBFB5325A79991777981ABD9F702D0B33A37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675306852, "uuid": "9b260e0c-10be-483c-b14d-b17d4cca895a", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675306852, "uuid": "95a181e0-3e40-4435-9223-e9caf1b49519", "value": "6144:4tu9lpRLcOCYh1snPgt/dVUDf+Q3F9jweoot+Sgi:4tCdoOCU1+P01eDft3FBAbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675306852, "uuid": "68d93189-7028-431f-803c-2bc4325be62f", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675306852, "uuid": "b83147d0-fc19-43e4-b8cc-d8af5e8f1a69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675306852, "uuid": "c03843b6-82d7-4cbd-a4df-7297309365c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f72303-a2b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1675312263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312263, "uuid": "ddef7045-aba1-4257-9094-0f19b2934ef4", "comment": "Malware payload (TeamBot)", "value": "a70ef63eb6fea37c88df2ccdb4b29bb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312263, "uuid": "00f2fc1f-030e-4880-9aa3-43dd07f57cb4", "comment": "Malware payload (TeamBot)", "value": "bb26b67a2505ef5ad71c19556404eb5011d3b376ab3c52fe6a91a1545c65b8f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312263, "uuid": "5ede3112-6210-4082-b070-93be333bdbcb", "comment": "Malware payload (TeamBot)", "value": "7fc99891b7675dc4b2f288a866a3008ff8543312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312263, "uuid": "704bc564-c68f-4c7a-b6f7-96b005bf171e", "comment": "Malware payload (TeamBot)", "value": "bf7d1a46ec987cfde2a14ada164c64dafbdbb268e192088e3546ebdeb38c40f4085c2d17eb3ef04c7f2ae29a3c6905d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312263, "uuid": "48ca652d-7fa7-45c5-bd8d-d5a32deebbb6", "value": "T19234DF227990C0B3C5AFD4704C60EA906BBEA5311976581B7BB817BE5F703D0677A38E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312263, "uuid": "dd484c6f-0a85-4167-9da2-4a1ddc7bceb5", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312263, "uuid": "9796ee4a-e6b5-40a2-88a9-19512539b1eb", "value": "3072:Mtm8fyjpeK+7L7rWkB5sdFQWDzRJHFGnP9VoUZqib9K+dL7eg:MtK3mL7rxgB/FiPDhb9F/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675312263, "uuid": "75f5453c-c7f8-4d66-9882-3298ebd3b33f", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675312263, "uuid": "63e4f4aa-df1b-4bec-ab56-93c31f0c4d53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312263, "uuid": "76c67dfc-dae7-41f8-bf0e-a1e349015710", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea8e33d-a2d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675326422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326422, "uuid": "d834229f-88c6-4875-adb9-2805d2678e6a", "comment": "Malware payload (AgentTesla)", "value": "3b7b59917536997d4929921cca58850c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326422, "uuid": "0cdaddc9-294c-4c1e-ad2f-7656eb029b21", "comment": "Malware payload (AgentTesla)", "value": "bc6376ada7da41e46d4fd7b69303d9f08a89217e1e6ae4077afbf1fc65689118", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326422, "uuid": "6f2972c2-c601-4eb2-8685-f9b0a1c379f7", "comment": "Malware payload (AgentTesla)", "value": "420adc000e70e420f0f6f7d862c23d51623edda1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675326422, "uuid": "8e4ef421-45b1-4cb6-a092-73e343da800f", "comment": "Malware payload (AgentTesla)", "value": "f79d1c81d8e369920e40c5610eeaba8f08b4b85019452ea51b19dc810065ab34ad871f58af4b66766e8a70671237f91b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326422, "uuid": "771bdf85-dfa5-4ba0-8a16-e439abc7a6be", "value": "T197F4F1BD8A38EA63CED810B891E604EC4FB0457FB299EF1944D5B8EDC1CA3119E1354B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326422, "uuid": "bd1f698b-092b-4ecb-b6a5-9ce27a394e67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326422, "uuid": "f1e8625e-6ad6-4791-a1d8-dd7ee6b1900f", "value": "12288:xAPKAvNFVW9iIA3inEXfjr6ghBCTiBqhnvoUmZSQHUWeh3ih9HOAjEzjF:aSAvNXWgIznMbr4O+nFmwkUBYTvIzjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675326422, "uuid": "d3e037bf-0cf1-4104-ac3b-3a75f374ce11", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675326422, "uuid": "83d179f9-acec-4b51-93fd-a803d9b82f56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675326422, "uuid": "4de4cd95-2cdc-40e3-9592-9f5a8f08fb2e", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d0e91b-a2fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675344284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344284, "uuid": "17eccec3-54e9-4031-8bf9-3eb494971f50", "comment": "Malware payload (DCRat)", "value": "abedf09a962a9489dba07ff3b6a93e41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344284, "uuid": "a61b68c0-5e25-4540-9d2b-7ba1c78f1af7", "comment": "Malware payload (DCRat)", "value": "bc657cb8e72afeb4f4d2a2f056162f0c3b8486fdfe80bc33a41d7871b35f8f4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344284, "uuid": "9ae84f7c-7841-4bfb-ab63-de77d17608ea", "comment": "Malware payload (DCRat)", "value": "25098fb30ee8b79bdeeee1e93eb9506b6f93832a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344284, "uuid": "ac4bbb4c-1f03-46b7-9da5-063ad39071fd", "comment": "Malware payload (DCRat)", "value": "c4838a8f888b26e0f714c42a8901befebb1f671658a45c30de363e12d3eff253c0a7cb1593946765666306bac9355d50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344284, "uuid": "703e7d33-36ff-40f3-9a10-5db5a776a078", "value": "T142557C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344284, "uuid": "1d93740a-4b9d-4496-b9a1-7af9b568865e", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344284, "uuid": "955f8f47-3e67-40d4-a9bb-826dc96bb8fb", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675344284, "uuid": "59cf2b7e-c9ea-4a43-92cb-d584feb4ecb9", "value": 1407266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675344284, "uuid": "bd3d4d2f-9d72-4962-a28b-4c155ab98cef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344284, "uuid": "0dcad573-e77d-419b-be19-830bb427b9a6", "value": "abedf09a962a9489dba07ff3b6a93e41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9c9a63-a2a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675306340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675306340, "uuid": "748ce4df-34b7-4c91-b866-84679de686a4", "comment": "Malware payload (Rhadamanthys)", "value": "37188463cfa0c56e5648d24b08a9af3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675306340, "uuid": "4987bc9e-fa9e-4887-98d9-a5f00332a72a", "comment": "Malware payload (Rhadamanthys)", "value": "bcd64315e8542fe1e90c0f83b7fec86e32073f80c449f61743283bfbc65191ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675306340, "uuid": "40a042e6-eff2-4914-966c-4dc2fe1e0a6a", "comment": "Malware payload (Rhadamanthys)", "value": "02d1670e182d94f31aaccb55c9629d8319926434", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675306340, "uuid": "8d8b953a-5223-4a6a-b5ec-bbec4843c9a0", "comment": "Malware payload (Rhadamanthys)", "value": "4fad60929fcb01d0f3a3ed8c5be2f7ae8a7021e83e27134e68c2e66239b0db0e5ecb946e70944235cd85c307dc49861b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675306340, "uuid": "776baac4-6a12-4037-819a-ffdab043b397", "value": "T14134CF327990D072C4AA5C706C20DB91BBBFB5310A35598BFBA8177E5F312D0673939A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675306340, "uuid": "c38eb9bf-5dcc-4aae-9d70-69fdcc03edfb", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675306340, "uuid": "e424c652-cb86-4efe-9ad4-58e3b4934ba2", "value": "3072:TpkMmyUXRkB2zxLzcWQV58ZWFwth8yiW1PJpas3+ocaSavAQcf:TpGKBsLzc1EWFw/8FW1jYISavAQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675306340, "uuid": "6f75dbc0-929f-4602-97c2-f02766810058", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675306340, "uuid": "153acf10-0853-4894-b14a-eac2b58863da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675306340, "uuid": "9f059dea-c69a-4aa5-9608-a4eb6f825cad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b30a64-a2a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675307914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307914, "uuid": "a66361a3-70ff-4044-b855-07dd7209bfe6", "comment": "Malware payload (AgentTesla)", "value": "1dbb086a837646dfcb4d44611b727226", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307914, "uuid": "27da4b06-d3c7-4a08-b1e4-051aa86ced6a", "comment": "Malware payload (AgentTesla)", "value": "bd0c9e976c855ac799940806d40aaf41a214241bd303a9d3f35fe410544eb447", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307914, "uuid": "b0793a71-74b0-4997-a758-859c7ef2bc7a", "comment": "Malware payload (AgentTesla)", "value": "d0e01e52517907084b5479d041a57f813af3d064", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675307914, "uuid": "f3a86d09-1a95-4700-a02e-59b9aafe682d", "comment": "Malware payload (AgentTesla)", "value": "226568933e71d4d7335d8dba7db810e294f01d03ace938a96ba249488fa40fe650e71c83ec512460a52160b61bc39270", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307914, "uuid": "87bfe6b5-bc13-4d5a-a53e-877e7297c57c", "value": "T1E36412A86790C457D8610B304D7E077F7BD3B52D4168634707A4AFAD7E372829A1F326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307914, "uuid": "a95dd8e8-ef21-498c-a826-1aeeb11fb461", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307914, "uuid": "3f827020-ec1e-4b44-af5f-55c8ceeeb05b", "value": "6144:/Ya66UCil+2q5ORsq4A89k3jlJQk/dqgo6JMy0KQtXQaOjj2FC04KWGCExSQiArq:/YUUCiYORz8SZJXZCy0KQCaOjSYe9Tip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675307914, "uuid": "a1d7e6e8-ccce-485e-9895-021e105c7b71", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675307914, "uuid": "22939417-adc4-464b-a950-dcaa38f5327c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675307914, "uuid": "9064b326-3b46-4f11-89bd-355d19035c49", "value": "TT Swift ($ 23,506.50) 19.01.23_jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22107131-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675337058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337058, "uuid": "8c8c0d2f-a9dd-4129-8599-e9c9da10f809", "comment": "Malware payload (SnakeKeylogger)", "value": "332edbf346049872ec93a827637131db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337058, "uuid": "de6a549e-752b-473b-8efb-b07e5e9b372f", "comment": "Malware payload (SnakeKeylogger)", "value": "bd1d719ea8750f6e218afee6b0d6bae7459a1ab9d2dcad931a380e68482712f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337058, "uuid": "921a2b7d-b66c-4cf8-b78c-20e6f07d9bbe", "comment": "Malware payload (SnakeKeylogger)", "value": "2b2526198c01b1b48662088d36b65b308739d3af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337058, "uuid": "d79237fd-13f0-4c2a-ac0a-057ee094f10b", "comment": "Malware payload (SnakeKeylogger)", "value": "ac8d9f10536b7e54fc96ffa226589bcc4059299f2c93c5e15365b82a3280e619f71b32677ff180c03335cd3223e72bb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337058, "uuid": "4028f0ad-0082-454e-be28-e499af818694", "value": "T194255CC2B6B098A7FD8702F11C2A76441AB16D0F79D4910E76773E93B7722B7309D90A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337058, "uuid": "071135c6-865b-4cfd-a74c-a45868d69401", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337058, "uuid": "95fa03e0-c29c-4515-bbf6-c07ea8d145ec", "value": "12288:6tz8L6gu+xMRSR5ScF2gVhth+/yAsVlwXLZFj+ZWHqG4yPakyI8SSOszV3XliHsp:rLzyRU5bF2gbVuX/j+AHqG4yPak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337058, "uuid": "78ba3008-5753-4439-99a0-9a35844f9ff4", "value": 976384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337058, "uuid": "9f3c9051-4708-4828-be97-fc6f05900b6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337058, "uuid": "dcd168ca-31dc-454c-a261-c59dad375856", "value": "8882920.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c85b96e-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675337102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337102, "uuid": "ee4287ee-7c26-4763-8203-6268361db222", "comment": "Malware payload", "value": "05bfe417ee4f03f5b676bc18178c7bd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337102, "uuid": "1525efc5-1520-48f0-8fdd-c1ce59edb933", "comment": "Malware payload", "value": "bd2ac3b25a348dc3c3d06c0278d4d0668f5b9c526ecf571b45ab0a2ae4c33b0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337102, "uuid": "649d327e-06bc-4455-ba0e-75867fe6d8e7", "comment": "Malware payload", "value": "af90adcc4cfb084ede69230085ee9921d6349c88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337102, "uuid": "e2f0a73b-f920-4f0f-bac5-41e34d5c5bd1", "comment": "Malware payload", "value": "93d7bceac6c929ee01dba49e7750457c427ff581e908313b94a57119644b5c198814a473aa334aec155f8e03b42a9ab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337102, "uuid": "714f4ca3-f74a-426b-a3ed-01f9d42c8a17", "value": "T1FD6412C97994E87FCC17D03A49598D948BA67677226FE293404362DA5C4FF1B8E1C0B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337102, "uuid": "4b2330e4-fcaa-4674-9e8c-ab40deb1c629", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337102, "uuid": "fec5a3c8-25b8-41f0-a560-4f27a703cfe6", "value": "6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337102, "uuid": "1f509d86-6975-4b69-b290-7813c172c865", "value": 332805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337102, "uuid": "f965c309-58af-4a76-99e0-1d81fb9f9fd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337102, "uuid": "dd36297c-04f9-40a2-b914-77da5ad427d6", "value": "05bfe417ee4f03f5b676bc18178c7bd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a83491e-a2b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675312296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312296, "uuid": "91970395-9113-4232-b242-c7bc09067aaa", "comment": "Malware payload (Smoke Loader)", "value": "d54208827a9a327be719273b21dfdb77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312296, "uuid": "bbdd0953-8b34-4b81-9b68-ab14ff76b77c", "comment": "Malware payload (Smoke Loader)", "value": "be45a95748e8003d7b7248a5124164baa65270c0576838be23fd9ce8145fb454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312296, "uuid": "e5bcd2a5-1f6a-443a-aa23-5e9d78f6bb3c", "comment": "Malware payload (Smoke Loader)", "value": "b16676f9120b5031de12eee457e7c613d63b7f90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675312296, "uuid": "d05169ac-1b61-4d5b-a8f0-e7263f685f78", "comment": "Malware payload (Smoke Loader)", "value": "9f97e66981563a9879524a4c248ab5628b1aa36627e704df4e767ccaad5d36c71cded9d1ceb71af14bfcc7d07c1c2c25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312296, "uuid": "53ddc076-fd5c-4790-823a-9d3aafc1eef8", "value": "T16634DF3136D0C072F46A50305C20D6957BBEB8310979A55B7BA81ABE5F707D0673A3BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312296, "uuid": "fc1c3f87-df18-4f06-833f-25373848156d", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312296, "uuid": "ca781762-499e-4d50-8cfa-9f132f6a49df", "value": "3072:9ltcF5yo8BO35PL1/WaI588db3mnMVA1ULIeordm/8RDnEUP:9lqUEpL1/LV812nMVA1UnY1EU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675312296, "uuid": "b56e4d4f-b327-4c6d-a49c-24750e845cc1", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675312296, "uuid": "311863b3-7c04-48b2-af4b-13cccf67145f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675312296, "uuid": "0a9fb49a-122d-4e11-b0d9-2a61380d7f1a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48de69f4-a31b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675357310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675357310, "uuid": "ac59eb41-b922-4ad2-9d33-b2ff18a9ab92", "comment": "Malware payload (Rhadamanthys)", "value": "2fa727d978e839389651894319f4dcd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675357310, "uuid": "55e9c438-1b22-4575-a3ef-2861acb254b7", "comment": "Malware payload (Rhadamanthys)", "value": "bea09a4614ed62e1de5e0b809cc9af8e70823548ee7420559fd492d02df3e102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675357310, "uuid": "81fa29d9-09a2-494c-a4c1-fe8282f10eae", "comment": "Malware payload (Rhadamanthys)", "value": "8cb29894a15708b1cb02f72c4bc4a397e69f7c31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675357310, "uuid": "5f9a7088-6d78-4a80-999c-050050f9b4b1", "comment": "Malware payload (Rhadamanthys)", "value": "d681eb02887a049ca39a44cb63edb966a304d335e629944aa7bb6a172e76d8ea4f021163dd1e70ab511f7badeff8631a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675357310, "uuid": "a01372ab-2a0e-4e0f-8697-4d721f7dc6c7", "value": "T150648E02B2E0BC4DE9318B729F1FF7E4791FBD518E1977B62224AA1F24711A1CD62325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675357310, "uuid": "7139d2ea-01b7-43e2-8f29-9ab5524fef53", "value": "d12bc67e05b268a2576f8b46d3381c86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675357310, "uuid": "8c3d7fb9-bd6f-4c29-aebe-e45f74c13735", "value": "6144:UULFIq/43W82QeBCgn/9/CJTk637eQfnd5RWB:pRrz9CJb7d5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675357310, "uuid": "9c20c097-2f28-4fb8-a350-538b618985c9", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675357310, "uuid": "ca2cb43d-283c-4caf-8ad4-f2eb935b1f1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675357310, "uuid": "4bab5b01-eb97-405b-b9ae-e098091a2153", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae74994-a32d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675365339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675365339, "uuid": "ca259de9-dede-43ab-a29c-5459584b8fe7", "comment": "Malware payload", "value": "089299c68133a02272f7a05a66688c17", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "toxicnetarmy", "colour": "#2DF4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675365339, "uuid": "c5d12468-a802-4849-9edd-70fa8dc660e8", "comment": "Malware payload", "value": "bf8c7c35cb5b8f47ad7fe7e89322960e105efa754360953ca854925a6b914092", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "toxicnetarmy", "colour": "#2DF4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675365339, "uuid": "1603215f-3052-444c-8700-71f1d068e0d7", "comment": "Malware payload", "value": "3f458042e06bb5c9422d5950478003d058d3facc", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "toxicnetarmy", "colour": "#2DF4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675365339, "uuid": "b4e4bd37-bcb5-4228-8c57-0228778b4d03", "comment": "Malware payload", "value": "e202cfbbb063fbd79bf337bcb7835044572bb03481e33caa0661f546f769408734003787f5d8e5785ffde365f5a7760a", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "toxicnetarmy", "colour": "#2DF4FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675365339, "uuid": "b9e422d2-172a-4b21-9987-30693101155b", "value": "T1D2D481152AE1075BEBBF873BD7F66C52A271AA42A522CB1F9246014D4DD0380D7F683F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675365339, "uuid": "f9aa5511-bf5c-4926-91aa-6ef8e2d1219d", "value": "6144:BN1HPGSx/IRbNPYCVa/68JDjUFQ5uB3c0U9lQcUgAyap70nGWOFX0YdXb9pYzjHc:4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675365339, "uuid": "15dc4f1e-5da4-461b-94f9-2efcb7ace98a", "value": 654832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675365339, "uuid": "934d90cd-2ded-4064-a1bc-d5597b5020f7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675365339, "uuid": "7ac18dbc-7d8e-424c-8b02-f583a8c55a3e", "value": "Legal Notice.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9884523e-a33d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675372046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675372046, "uuid": "f55beb7a-aa05-46c0-b86d-516fa1cbacd3", "comment": "Malware payload", "value": "da80697cf5ec5bddace14f8fdca01125", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675372046, "uuid": "543e3865-34a2-4966-a189-620ba4751df1", "comment": "Malware payload", "value": "c02ca5e7993d8d5069dc602481807c5830c99a32429e70c60a2dffe4935c3ad6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675372046, "uuid": "4b9bd301-1c3c-4caf-a39a-3fc9aa3c7b13", "comment": "Malware payload", "value": "dbec35bcf7a89318354106250e95deafb0007d37", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675372046, "uuid": "65b9dd63-f73e-41cc-8dd2-6ac2a8756bf1", "comment": "Malware payload", "value": "bd71cfc8a83687b32bb9c77a4294605f29e358ff2ba9ed516bed0bc25abd17d53045be016a0fdc424c500783d767fe25", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675372046, "uuid": "d1d23482-06ba-42fc-a7f7-8609254aef7c", "value": "T108236D4037D88136F2BD8BB5ADF2E1458675E2672903CA4D6CC814EA1F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675372046, "uuid": "722fea7b-63e2-4dfe-b132-0d285b280a6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675372046, "uuid": "ccc2949e-84ea-4178-a3dd-1e672ca7cc64", "value": "768:p96mxUTILWCaS+DiMtelDSN+iV08Ybyge6dVvEgK/JnZVc6KN:p96AKWMtKDs4zb1p/nkJnZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675372046, "uuid": "c078f50c-a303-47c5-a9df-54975a676e67", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675372046, "uuid": "00e11a34-29e1-4576-a535-ba2f303d74b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675372046, "uuid": "fb635669-923b-41a1-9807-7a06d9268027", "value": "bJwM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c034c382-a2f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675339471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339471, "uuid": "94224d86-093e-4e59-be78-eaae21c6c6d5", "comment": "Malware payload (SnakeKeylogger)", "value": "550c4f054dc004e0f00d81ad8f8cc496", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339471, "uuid": "85a67c6d-a9ae-46cd-a00c-0422d7dfcd32", "comment": "Malware payload (SnakeKeylogger)", "value": "c0abc071c31039697cb8f13d2769118e4068e78ad5d40fcc900462f709ab62ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339471, "uuid": "6a3fa7c1-de90-4c6a-8a0b-8ebccc01f3d3", "comment": "Malware payload (SnakeKeylogger)", "value": "847f8568dd1d2e637c709f3227de4e65d9bf689e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675339471, "uuid": "c76c00bd-7659-448e-a365-431559844278", "comment": "Malware payload (SnakeKeylogger)", "value": "ce4fdd132ab33a71cb91aba24b374f32e991a9d36f7f34c3f93f33d8d3c33464579be48d7614159ecd709f101c02938a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339471, "uuid": "82e2aa77-4852-44d0-b695-3b56c3db1dec", "value": "T163158E8737B1A8BFF68B407544283F896FA07413BE46E25397373AC49B098FBB694151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339471, "uuid": "d35c0290-29e2-4d0d-bf9c-4e8d27d67523", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339471, "uuid": "642cd936-0e15-493e-ad03-36d251a92ca2", "value": "12288:RaZvp6EwPgwvYoOFsWGpHsNEnk4aV8mYON2R6Fy2Mxzo3pqG4yParPr6Z2L:RovbwjvYpK/6NEyx2R6F0xMpqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675339471, "uuid": "434b8e2b-3bc8-47b9-9c21-753273bd35d4", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675339471, "uuid": "615bc65e-c0f9-4117-9c5a-03f631181fd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675339471, "uuid": "73c27095-dc4a-49bc-9064-f318e8c6652e", "value": "550c4f054dc004e0f00d81ad8f8cc496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b038285b-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675337297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337297, "uuid": "4aee7208-70c6-4d76-9675-ae30ffd3cef8", "comment": "Malware payload (GuLoader)", "value": "880b795347b76a1660b3dfcae7bc28f7", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337297, "uuid": "834884d5-3dfc-461a-99f7-e8b40ffe7224", "comment": "Malware payload (GuLoader)", "value": "c1435f8fc9a6ffb253811a74d4016f73248b7226d6d5b458c3bf960ee3a38005", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337297, "uuid": "3bca6d50-0874-4d1e-8d28-401b71aff27b", "comment": "Malware payload (GuLoader)", "value": "dd398c1781ddd4f3e69036f4dadde6c643cacd44", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337297, "uuid": "170be3e4-fdd8-4660-89c6-e906086e0e54", "comment": "Malware payload (GuLoader)", "value": "53eadca39798b0132ed1a50b8f2e1c54fcb17d700baa0573ece6c3bb9162168fb7f7907f237c8e8458acb3f19d5ad30f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337297, "uuid": "b97c4458-ef77-466e-9124-08b4156feb7e", "value": "T15E536B2CBF57D254CD3B0E6DAC421D87F4F94C375123643EBC65468A26022B89BABD36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337297, "uuid": "d042dc42-8a84-426a-a9a5-0fc43cd7afbd", "value": "768:FlRe1yyO99pKzl2VT1Gxxy4tH/dD/ASEGZU2L7Y+yk10iGfzi945EriK:F3GyvLpylJxdfawKQNVMErd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337297, "uuid": "71ef5128-44cc-4204-99e2-728ebcc1636a", "value": 61632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337297, "uuid": "c154b068-8a2a-4dbb-9eba-ab00755abd84", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337297, "uuid": "c27e8581-1185-4d5a-8934-ffc888de4817", "value": "transferencia.....vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf264d9-a2c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675321640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321640, "uuid": "16230c7b-87dd-4004-a9ac-f9b9877a59dd", "comment": "Malware payload (GuLoader)", "value": "15ae90fffd2f5fd0d3c28fdb6a1ed0b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321640, "uuid": "d76dec7c-07e5-4720-b1d8-cdc945efab5b", "comment": "Malware payload (GuLoader)", "value": "c2882a42e9ad87ef5260d3299307dae39af71853c75b44441c0dec497bc5c175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321640, "uuid": "4a2b67c0-6bda-4907-bff3-0ff3d848f4f0", "comment": "Malware payload (GuLoader)", "value": "4fd3d2470cd1c1e83bdac50ba103b1550fd5c1b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321640, "uuid": "7e3c81b2-dbde-4b0f-b643-bc1ceaeeb540", "comment": "Malware payload (GuLoader)", "value": "51016d8b055d467e637a1a918abffc1175b8aa62d6aa08615b0890704555ec930aa61ea74663feccbec1c0fb89883dcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321640, "uuid": "04b5910d-9fd5-41db-b08c-40f827240490", "value": "T113E4E0813350D393CD6FE6B05D42C5DA667FBC74E9A9654A23A07E4B2FB90A0CD1ED20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321640, "uuid": "b0b7f8d9-1c7e-49f9-94a0-6194bc472fc3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321640, "uuid": "f07e82cf-35ee-4e41-9330-d049ec35bca6", "value": "12288:b7EWNDJccwIWYh7jQofzmAuPMrkQUmGjbPhYYHNZcVbOcNjRtBnMAr87:MUlyYtjQG7uPMrkqnYt6OsNfC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675321640, "uuid": "8396f98e-7d39-48a1-b62b-f3e67576fd23", "value": 673554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675321640, "uuid": "1b4bbba2-dc83-4168-8017-1fc8f32c5300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321640, "uuid": "dff3d8c6-b12b-468a-93cb-f579e063961e", "value": "Document#749450pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1427087-a329-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675363524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363524, "uuid": "23e0760e-90df-4294-a8ab-b3a39815a175", "comment": "Malware payload (RedLineStealer)", "value": "f912d133d6132ea163bff72ab484f11c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363524, "uuid": "402ec8c4-97ee-4972-80af-c0fc92ff6432", "comment": "Malware payload (RedLineStealer)", "value": "c3bc3e8b2938e6df87e0793a9c89f72edbdf41a4c39bcc1646fb29aa716c5c61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363524, "uuid": "dd290f23-c0e6-4a9f-a691-a7b2f578dcf6", "comment": "Malware payload (RedLineStealer)", "value": "e1326fd027eb920e93253cc1c682af00df092a1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363524, "uuid": "36543a0f-90dc-48bf-9d3b-620c4848dedf", "comment": "Malware payload (RedLineStealer)", "value": "cb6cab4731b22f5eccbc1d6341ae87bed683aad19bd72bf792d97bea9626a9181aadb858f784075bf4c75a5f18b483f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363524, "uuid": "3e0cb77b-316e-4807-857e-b7b5758205e7", "value": "T19894B002B3A0BC99E9318F728F1EE6E47A2FF9514E1877761314BA1F15711B2CD62728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363524, "uuid": "d1cd1a38-cfc2-4531-a785-d1e976b43786", "value": "979c588e74c8acd477d60f59f755fbec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363524, "uuid": "404a59d6-bc07-4565-8c81-45431b2878bf", "value": "6144:fIFULM4lS9t8u9+HAndTOcFii5sHPvrZm69/CJTk637eQfnd5gWB:fIFUI4s9GQKSfyrs69CJb7d5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675363524, "uuid": "f1a25930-3795-41b0-9314-caf52bb71ad1", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675363524, "uuid": "f3df2937-b82e-48e9-b4dd-66e89dd2eb8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363524, "uuid": "2ee9f6a9-b76d-4ec0-827a-d490f790cbca", "value": "f912d133d6132ea163bff72ab484f11c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2caf455-a2e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1675334268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334268, "uuid": "156e574a-5ec6-458d-9d5d-a73761a92872", "comment": "Malware payload (QuasarRAT)", "value": "02d021938bf129bbc6fdec64150b94c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334268, "uuid": "fe318804-0296-4d9b-8759-a284bc5f5967", "comment": "Malware payload (QuasarRAT)", "value": "c46b98f91cef4d1726b07df84f62036a56c394b10f4bf6f5ee0c6794e2fd9885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334268, "uuid": "327e99b8-ebb1-4c14-ab91-ea5ab65800a2", "comment": "Malware payload (QuasarRAT)", "value": "aa3d128039ba86274a46babae741f9bf1f81a58e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334268, "uuid": "2e710ce9-4a92-4302-926a-bf928d147bb4", "comment": "Malware payload (QuasarRAT)", "value": "4614714b70c45ebffff79f2fe5745ce040cd33e54edcde6ca34774eb6e6d1977e060cb352bb6e8e8bb3fd62baa55f79b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334268, "uuid": "3c417514-b33d-4c0a-a907-fd2d549833de", "value": "T1EE3423C63322FF27C07F2F38CA29E5A0D636D8373826871F6D4D9E661C9B1865478524", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334268, "uuid": "5eb9bcba-1c26-4450-83d9-15fce6d6ddd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334268, "uuid": "69dab3c9-0241-4f29-9bcd-55bfab24d6e5", "value": "6144:+l+5rzZ+NPT6uVy+8yAP5nGuQKcMCJFl6CeTzh/c2K9:+l+JYPBqyAP5hQKcPhenJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675334268, "uuid": "63522761-5369-4613-92e4-87b060cb7be2", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675334268, "uuid": "e27d757f-6549-49a1-ae24-15071d49c484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334268, "uuid": "ba2be6f0-c948-4cf2-befd-d65d120503f0", "value": "js9f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57017af-a2c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675320609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320609, "uuid": "52b02617-78c2-4d5d-87d2-fc47b23ff80a", "comment": "Malware payload (Amadey)", "value": "af2af3438253366cfdd0457636e0dc83", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320609, "uuid": "7c3443f4-74ff-4783-bfd8-837bc4138f79", "comment": "Malware payload (Amadey)", "value": "c57ba99f520a67028fa6b949bf174d46681ade2eb8c69bfa7b37944ca0738e09", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320609, "uuid": "a3320a3a-33f7-403d-b795-eb627f6c46a5", "comment": "Malware payload (Amadey)", "value": "4c0d8c3c672e4c06a3fea96d4de6353180b0ec70", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320609, "uuid": "9bce93a9-08d9-4c61-b085-9118ac219a75", "comment": "Malware payload (Amadey)", "value": "131fe092901d3a75dc31a48f5d59a8d84c7886baff4088ccbef028cca5ce816952666cc394f19b4f40280e44cf7132dc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320609, "uuid": "9e06d1fc-854b-42f7-b2c3-f1bf4586d89c", "value": "T1E954E02239A0C072C5AB51715C10FBA97BBDB9310675A907BB680BAB9F707D0773634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320609, "uuid": "8bbf100e-1eac-4688-b227-ae3ff47575b7", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320609, "uuid": "2b6b124c-3493-431e-a3ab-46ffd0862ead", "value": "3072:nl2tuy46q9toLPiWcI5Tq7R1pgmuAJnPOMk29MKuZR9kaYLnH82qqElddJpxNlk1:nlcsCLPi9d17BuCTIdvkaYH8xNRwZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675320609, "uuid": "95d0c78a-0d92-480b-b515-e15890490a1a", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675320609, "uuid": "afc04ee3-44de-4670-b18a-21951bb477a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320609, "uuid": "b5ba0b5e-24a8-48b1-90e3-cdafaadda22d", "value": "af2af3438253366cfdd0457636e0dc83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471ae3c1-a330-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675366326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366326, "uuid": "3989902c-5b8e-4b69-974e-fd301146f768", "comment": "Malware payload (SnakeKeylogger)", "value": "aa4942da9a41c2c7ce12bc3855eb2350", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366326, "uuid": "f6ff331b-63bb-4e48-a308-4b15074fda6e", "comment": "Malware payload (SnakeKeylogger)", "value": "c5fcb78f3d8f37ad58277089aa4ad3f4e6f0388ad8ee3c8e19065bab1b7f38e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366326, "uuid": "f9f5b550-7e3b-45fc-b895-0659744bbeba", "comment": "Malware payload (SnakeKeylogger)", "value": "07ddcf865989c7f5a07a9835f59d222e5a438edd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366326, "uuid": "59cdd933-1162-41bf-bf06-e8bbe78a837f", "comment": "Malware payload (SnakeKeylogger)", "value": "a7c766921ec23a7042c36642a4b042f15e18a6f87977b2f79a60d53ebb32bce6dcd923b667df49ff0e4f6036ba0e43e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366326, "uuid": "41d144b1-e7e3-4583-a73d-1c3c590c7c58", "value": "T106B402808D9021A6C57E4F71D2F085BD7B417112AAB1B0BB010DFDAADE919C1FC6ED9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366326, "uuid": "a3e171ec-a220-4af9-8056-01510bcccdb2", "value": "7dc8a7abc496d99feefc72c0a0d7748c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366326, "uuid": "e9b2edee-b6ab-451d-978f-e9d681aaadd1", "value": "12288:2CcmFM0luMoL4Ip5iYVCZWOERUB3HDrOtW:27m20M4IpAqCZZE6B3POc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675366326, "uuid": "7d4411d4-e4e6-4b81-b505-ad37974b5ec2", "value": 495203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675366326, "uuid": "0182d12c-0280-4558-aa5c-584ae93380e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366326, "uuid": "0bd5a67f-358f-4ad6-a920-0429ef1d3e20", "value": "aa4942da9a41c2c7ce12bc3855eb2350.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393d513a-a2bd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675316911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675316911, "uuid": "6d3440d4-7eef-400a-abec-152f2167fb42", "comment": "Malware payload", "value": "716dc3ccfb29764da73091d103661d31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675316911, "uuid": "474495b2-aa3c-47e7-971a-edc531669c42", "comment": "Malware payload", "value": "c68b835d8e1f4716c8ec2e287232db2467dd46c55176b1dc2aae2d605b4759c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675316911, "uuid": "12f09789-60f4-4746-9637-21a1a5f5a9d7", "comment": "Malware payload", "value": "20251a377f104ebd091eb1b0c7a4c10a2e3257df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675316911, "uuid": "26b0f2eb-ca19-48dd-9e9a-ee373d3187d0", "comment": "Malware payload", "value": "bc5708fcdc7caac40fa099f9b2bef31a9df7a7119ef7ce7448ebd2fffdf285dff202192c9aedbd5eba539dea05aa479c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675316911, "uuid": "65de011f-f681-4871-abc3-055ced3ed9af", "value": "T170763310BAD5C87CD9870A305CA967FF86FDD225DC51417322CD2F2D2A7F8C49A49A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675316911, "uuid": "09d81600-3a6f-4205-bb0e-d40d9eaa2f87", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675316911, "uuid": "ce09e18b-6217-4d5f-bd8e-274230dcd900", "value": "196608:91OQrG9P+8Gig/VQHW6NcrB/GqymcUVQJiKEjlwuF59tRPu:3OzG//iHpCrB/GFPDEjlwYVpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675316911, "uuid": "cadfc91d-3567-4a8c-813e-ff03bc05245c", "value": 7637239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675316911, "uuid": "95ad725c-09c6-4cfe-a4d2-9348283b8a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675316911, "uuid": "cecca5c4-f3c7-4e87-8580-2c0a07ad5dc0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2197a264-a328-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675362827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362827, "uuid": "033e17ad-0fe0-4bd4-b62c-4a772398b5e1", "comment": "Malware payload", "value": "55aa7f43643909b5f201c8b96a712f5d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362827, "uuid": "045552e9-0226-4e56-9f03-da17570e1fe2", "comment": "Malware payload", "value": "c6e79473526e0c70389c7cf6c31987ef23cd59b4012b614dcb545d085118ef80", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362827, "uuid": "733fc751-6cf8-47b9-aea4-bc65a0cb9a5a", "comment": "Malware payload", "value": "f07c6e1bd921047f8225d63aa783ed69fb8563b4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362827, "uuid": "e4b4347f-3a7a-4310-95f0-591f801b7add", "comment": "Malware payload", "value": "31f55002e59721c75845b091ba0bd232f93fbf091db87d531d5a253f0f9ccb4a433484375a833fc114cfacb63179fd1a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362827, "uuid": "55f2cc5e-64cd-4061-b7f0-a00a38f626f6", "value": "T101C59D2275C5C633EA7F4330652ADB7B61F96AE0377380DB63C8962D0E719C05276E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362827, "uuid": "dacb5c79-c507-4533-8355-a5cc539775e0", "value": "49152:59eYUMV3eVougT8AFPsJ6ma8zotlmfwrgxMy+y29IAan6DrC4vLNgmUESIEjPMNd:uYUMV39eAlAfwrtyB4veHjPMNav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362827, "uuid": "05bd4908-5dce-4a25-9947-9fbc7a81707a", "value": 2517504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362827, "uuid": "b7511c59-3193-4486-a409-efc12ffc649d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362827, "uuid": "2b2b99c3-9da3-41be-8438-954ee61bde14", "value": "SecuriteInfo.com.Other.Malware-gen.1742.20318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ffaf76-a294-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675299613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675299613, "uuid": "3b774668-ea86-457a-b010-4ecf19bcb35b", "comment": "Malware payload (RedLineStealer)", "value": "c74360250b5fecc23c9b9c0dee3808a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675299613, "uuid": "99fb6dd5-2f78-4bd0-b322-6b6a7d074cb0", "comment": "Malware payload (RedLineStealer)", "value": "c8bb63f9b204c0d598dfd19155dddc05814e39b6f9c590d2bb46bdc0d859b32d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675299613, "uuid": "90018786-2200-4a9a-88de-dab11cfeb37a", "comment": "Malware payload (RedLineStealer)", "value": "654704db1573919b8ec47cd147442aaa87c69be7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675299613, "uuid": "60b1290f-a45c-45db-92d1-6918105a7f1d", "comment": "Malware payload (RedLineStealer)", "value": "ccc58aa3056d9ea47e1adffbaba7c296ae0322dfd0a3cf2c3e061cee6479e67b437ed01bd0b426e73d07899e46a28756", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675299613, "uuid": "0c73f2fc-bad8-477f-9dc5-1844e5646f95", "value": "T1B574013375E0D033C9AB10B11934E6516B7FB4320975AC177B98DAAE9F306D0A63935B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675299613, "uuid": "d6a258b1-32ae-4c4c-8617-c1fd03f09705", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675299613, "uuid": "9e1663a7-19d8-42d3-82d2-badb4274ebc0", "value": "6144:BlDcFLV3bIWtNyZAui/Zo9KOOiEkJLyOclc18:BlDcprIWbyyui+4KJJL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675299613, "uuid": "76778c15-f057-4459-bf53-70c31210787e", "value": 340480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675299613, "uuid": "47a4f9da-99ce-4851-ba08-cb10648272b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675299613, "uuid": "f0052a19-9e02-44ec-95a0-799238e9e7a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a0501a-a328-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675362810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362810, "uuid": "c20c938b-eb51-4411-b6b8-ad75377b76fc", "comment": "Malware payload", "value": "2fa1c3c3fbc961de2b894ae5a3f5275d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362810, "uuid": "7556dae8-0ad0-444e-81c4-4683d5e1afb6", "comment": "Malware payload", "value": "caa880e7820c1605ae509cb9f5e564037fdbda6da9b9b29f65fbc9bd8b3802d8", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362810, "uuid": "ceefb679-c274-4f85-ab93-a1fbd36f4b53", "comment": "Malware payload", "value": "a5859c55101782aac5fdd9433a551a1158c63e71", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362810, "uuid": "720ffe38-e7b0-44aa-9c32-54cf183e4c31", "comment": "Malware payload", "value": "1021ce4a2171a04d04c0521f82af51bbe7484a7635da9794892342134b78328b2660b40270f3676220e3a153cefd4121", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362810, "uuid": "a3c12dbe-cb37-42e4-899b-81d441960382", "value": "T18E37233278C9C232EA6F4334166ADB7B51F96EE0377340DB53D8996D0E754C082B6A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362810, "uuid": "212b1f38-c1b6-413f-9c47-9fd73d7ac9bc", "value": "393216:lFwcn04ph6pVrsGJB1Mv42sgoYlC9nclm5wX11Q6xLbDUtAcDHqCyox1+:lFwYc5sm1g4f7YlsnclVQ6xLbjayox1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362810, "uuid": "ea908043-f413-40da-9a48-4fab0a4b2843", "value": 23662080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362810, "uuid": "4fb45466-c33c-4be8-8f19-0dcbec02a795", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362810, "uuid": "02f4f7ad-697c-404a-acad-91c66255f85a", "value": "SecuriteInfo.com.HEUR.Trojan-Downloader.OLE2.Powedon.gen.54.17166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93720be7-a2f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675341114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341114, "uuid": "61f4e9ae-daff-46bc-a702-de324cbd4e07", "comment": "Malware payload (GCleaner)", "value": "be9c240a62481e5011483147f9f15ea6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341114, "uuid": "dfe67771-26ca-4806-9c45-8e4969997f36", "comment": "Malware payload (GCleaner)", "value": "cbc75b2effe13da95ec1e30e63b81df840e77110ee359450499735f97304ec33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341114, "uuid": "337fb0e2-29f3-4c6c-96f2-604486f38773", "comment": "Malware payload (GCleaner)", "value": "815e6333530d48b09b5255324c3cd70caf0c34ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341114, "uuid": "0edae4c3-59f8-48d9-9740-c3086f1d7ee7", "comment": "Malware payload (GCleaner)", "value": "e319cdee11b2ef781263e6bffb226e8a2fc55f0c18828fd04e9c5ba042bf9a8296efc9fae72b0fbe233344778b201635", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341114, "uuid": "0e34f409-54e0-4976-ac35-885ced2e4ae7", "value": "T18CA5331B8667C136DC48A3321D38D992B57B7BEF6CB45308342D461F3F2BAC0694A796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341114, "uuid": "f1b9ca9c-5cc3-40ec-b2c8-cdcfb8621461", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341114, "uuid": "9d9fffda-aa8b-485e-b43e-42e889470d13", "value": "49152:bg02pqJ6Z0vwdFv/C2jrv6r33UQ3hDbdIO7nh62mux8/5ivgoLCgv2MR:clpqJ6Z0vwdlc3UUIOiuSxhgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675341114, "uuid": "4d351053-f8ed-4ebb-a605-36c1220b28c8", "value": 2099521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675341114, "uuid": "2fab9d86-8bd6-49c0-9081-b12b8cfee9b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341114, "uuid": "abeb9ce6-cd4a-43f8-852b-a20eb9f14f56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf31be8-a2f3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675340054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340054, "uuid": "1210c52a-04a8-4747-8efb-6ebd07c00613", "comment": "Malware payload", "value": "ebf765dddb49404dbf3465523fdfcb90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340054, "uuid": "b677d968-f2d5-489d-b771-e34c0f2239aa", "comment": "Malware payload", "value": "cc6b900b08ecaa3c969e2e01f0f8da66b3199527d8e863f7556859a3dfacaaaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340054, "uuid": "630bf714-865e-4f84-9114-3e6f7e1cd443", "comment": "Malware payload", "value": "db454f2fcf50c17bb14e1606f3aa27d9c2a521fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340054, "uuid": "4dfa3478-1c8c-46a6-bd25-2ce027065c4f", "comment": "Malware payload", "value": "c354ec6b357feff1d07876e8efe6037b4fa5a2d16813af4d7b6460b118cb289b4de4c9813930ace50a86d2743b752978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340054, "uuid": "64cdf827-2af1-460f-8d2b-b80f66d8f66a", "value": "T126E3236E73F35A66DC88427717A81662F2A3D899F3CDB321339D5006CF6DD344E9610A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340054, "uuid": "5638847e-bee7-4d5d-9454-d6c0640dc4ed", "value": "3072:/Au6gdiijoyMddAlRAnwgORAnGIwjU1pUa0zDu+yLzS7Bf0://6gdJjYdAlRvRRYGIzHSW7S7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675340054, "uuid": "34cd23bd-64da-4456-9e5b-3ab5a8c02fa3", "value": 149896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675340054, "uuid": "0e3ffcf5-bfbd-4164-834c-eae92a4e81c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340054, "uuid": "0898ddd3-cabb-4cc0-b070-81646de64876", "value": "ebf765dddb49404dbf3465523fdfcb90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88739311-a2da-11ed-88f6-42010a9c006e", "comment": "Malware payload (Farmbook)", "timestamp": 1675329499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329499, "uuid": "d14529ac-8c7e-4d69-aa1c-143df2fd6cbf", "comment": "Malware payload (Farmbook)", "value": "7fded3ebe3c2a1f808addd725cff4f70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farmbook", "colour": "#085DFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329499, "uuid": "8941167c-c982-4afd-9422-ffac08e415a8", "comment": "Malware payload (Farmbook)", "value": "cd0b5c48b03120d9dacbcf239c77fbe979b18341152c870085cc210865bac471", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farmbook", "colour": "#085DFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329499, "uuid": "654da8cb-c799-4c72-9cb5-de6c94640abf", "comment": "Malware payload (Farmbook)", "value": "91722f5c780743c8394ffbef28b7a1068d486945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farmbook", "colour": "#085DFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329499, "uuid": "a4a9b340-5ef2-4a36-aa3c-b12fdac09974", "comment": "Malware payload (Farmbook)", "value": "5011bd4f25934d3afc99eab14753f2a360ad6072c9298b14e72a852e3e8e8ff8718ea13825cbdd0cc8d1bef97694e962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farmbook", "colour": "#085DFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329499, "uuid": "b3bce246-77fb-419e-ba05-3f50d5724909", "value": "T142A31008A3EE5E23D96AD7781953F3722735CC6245A1D7071EC4ADA73B1BB821E500F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329499, "uuid": "1a03e592-bbd5-4d79-88d6-94d4487b40a0", "value": "768:kGeOddNCX5FgFjWwvCoPy1SJZQNUGR5NbcVfup+btYAJHa4H:kadNwyWwE1SSvcVfupotYyTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675329499, "uuid": "1946b35d-6dde-45fd-9255-5d129545b65b", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675329499, "uuid": "82bca7a7-1ec5-4610-852a-fe0355173c0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329499, "uuid": "bd659d26-c593-4e25-9e72-33e4b700d1a7", "value": "Nowe_zamowienie.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35967459-a349-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675377034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377034, "uuid": "c852cb44-3130-400c-a456-e92457db5bfb", "comment": "Malware payload", "value": "1be4602fd7e34ca98f83c45aec7e9abf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377034, "uuid": "d48ebc25-c6ca-481e-b5cc-dfc83a8e772d", "comment": "Malware payload", "value": "cf8afb4e05420d9bcbaf5fe0a9d4f207d55cfad05b240b6737e01ffecd7a9da3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377034, "uuid": "1781fd37-5b7b-404f-8ce4-07013e4e3a66", "comment": "Malware payload", "value": "39883252e4051353d49a445fa733ca4170fe1e3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675377034, "uuid": "667fa6af-b472-49c0-ab6e-1c3fca6956b4", "comment": "Malware payload", "value": "ad33ec50165272130e1144918060f8f5d2de33fb4b392561ec380d0a0ac4a1c36b49faac615062ceec964fae648d9f80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377034, "uuid": "a729310e-b687-479c-93a2-1895e4e5ad50", "value": "T1E19533F5E0E0CC37E35086307C6591C5BAB3BDDEA4B9235031DD6B6B5F2B121424DAAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377034, "uuid": "60e0847e-b782-4bdc-aa7a-3f2ce5972240", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377034, "uuid": "7cd0f720-ff25-472d-a543-738fd56131cc", "value": "49152:bgu1TCj0IwSINxnc0pgMrB9t0YTlUM4WaJhMfLCgv2MR:c4T60IZGncsrrtd4Wamv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675377034, "uuid": "de5f82e1-54e8-46f7-8113-2f94b0269eaa", "value": 2028111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675377034, "uuid": "2af955ad-1f8d-4c8a-9620-d638ff8950a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675377034, "uuid": "91cc6494-c608-413c-a7d8-337954451e01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22e81a2-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675337300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337300, "uuid": "dae8e14f-d1a0-4e24-9bf3-9268ee3c8f9f", "comment": "Malware payload (GuLoader)", "value": "d4de69bc6952a5eac2b4fed37a586546", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337300, "uuid": "eb699061-95b2-494b-9c71-571242b082f7", "comment": "Malware payload (GuLoader)", "value": "d0310ed71a8ca1cba5be60d1d4350efc975caa8763eb7985ae0d9c734dce7469", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337300, "uuid": "84dc88a7-c01a-4394-b9e5-c45f3cda45bb", "comment": "Malware payload (GuLoader)", "value": "98337241c6c5eaab7e0f12106caecf0cd0847d1b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337300, "uuid": "3a029b92-3a40-4bbd-b33b-f528302c8c6a", "comment": "Malware payload (GuLoader)", "value": "4894460a892774d8b06abc8ad7604aafb51e99f1011849ed8eb5adb5eff2fb1936c3e94fc75fdbcc5b03634fb9890796", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337300, "uuid": "efd09a53-9792-467b-9cd5-31acc719452b", "value": "T1418417ED1A282D508F186EF7F34735BBC94509931D0723EA29380DA529A635C9E3D9F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337300, "uuid": "0f81e723-1f78-415e-9d39-aea9b1cd6d7a", "value": "6144:b8D7TBEY7dDgmk9WY16LydLA62p+9a2mRd5BmH5fw8BMK3IC0gUvEQgZIqLT:b8D7T50mksWVA2S1m54wIJsiWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337300, "uuid": "d6ce961b-4738-41a5-babd-e2fd3f32439e", "value": 396092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337300, "uuid": "f1631b38-aa6d-4f68-baaf-8a7512fd3d22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337300, "uuid": "fc53d7fb-b1d1-4bc6-9202-dbf79310c65a", "value": "doc00746320230130110943.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18756ad1-a2ac-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675309554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675309554, "uuid": "8e751d15-1b64-4374-a35f-d82c4e94e618", "comment": "Malware payload", "value": "1d3fb1753b2cdda19e7e8369e6ef5338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675309554, "uuid": "093d2bf5-ae3c-4e11-a691-711211ab6bdd", "comment": "Malware payload", "value": "d1041e73bd627bf144827db8a6c2002b3187c73258803cdbbf8313b0b6a49627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675309554, "uuid": "24f2b73a-296c-4934-bc69-bfccfd03fd56", "comment": "Malware payload", "value": "5cc79793ea8351cf14aded7b8bd3cb23f2c0210e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675309554, "uuid": "d25e6e5d-200a-49d4-a480-539246f2a5da", "comment": "Malware payload", "value": "bc1897df7a1f9dbbd9b0a6ff5d980cfc7731ec96f437114f383352757b2f376bcb4ad819bc619984d96215d0f1c25fe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675309554, "uuid": "72337f90-050a-416c-9de4-9ec58aa66364", "value": "T17FB4F125B584C432E59202314BE6EBA15A3ABC719B2564C73BD0B77E2FB12D2E774307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675309554, "uuid": "5fff9a2b-70b5-4e16-acdc-fd46c53141a8", "value": "6dca3e9fb3928bbdb54dbce669943ec8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675309554, "uuid": "debf83f9-b4b7-4c80-95fd-d430a68b7949", "value": "12288:oU5rCOTeiDXg2UD321RSVHW9AAI99BIQINZ:oUQOJDa2zSVHLd99BIQIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675309554, "uuid": "46c8e986-99c1-4d43-b86c-647889e6926e", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675309554, "uuid": "93679939-987c-438e-8f50-04a6584a86e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675309554, "uuid": "7f796574-3e34-47ea-94a2-1d5bc4bd8e80", "value": "winword.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05a4772-a2cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675324895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324895, "uuid": "d3a63b7a-9f9e-4d27-8d4b-7abcbe7b5889", "comment": "Malware payload (GCleaner)", "value": "93ce20875be434417e6edca7b67fc00d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324895, "uuid": "244f63a7-9783-4b74-8ee8-f075ea0369aa", "comment": "Malware payload (GCleaner)", "value": "d26b2cea528b7ed63c89ad6ecd99c7fafcf15cf1c1ef2062ff74441fc18a8eda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324895, "uuid": "df422634-e7d6-4b83-94dc-36e718523367", "comment": "Malware payload (GCleaner)", "value": "1133d9514b081d778c18e73b847beb95594e081c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675324895, "uuid": "3421d095-551f-4919-9eb2-91c25f852c46", "comment": "Malware payload (GCleaner)", "value": "7d2a0950a732f23108620de09d30f879ffd1f63723029477b0b84df379f634a4daeeef6685380feb3a6f267df33a85ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324895, "uuid": "1acd62a9-5c23-499e-a631-3d35ccc2f9af", "value": "T125A533D99261DD36C1A71B750C325082F2359EAAB2FB912430ED374C2F53BA13A36B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324895, "uuid": "94aed8b0-ccb0-4370-845c-1ac9e9778ea1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324895, "uuid": "1e22b4e1-9971-4f34-bf71-4adb9394631c", "value": "49152:bg/R/DJzSlrmd4huV/FgKL4gMitKP2oxsp+vu5RppLCgv2MR:c/9NzSphuV/Fp4gdtS2qS0w3v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675324895, "uuid": "83c0fc3f-ed04-4470-9db6-054a4ca5d7db", "value": 2114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675324895, "uuid": "56c7764e-b5c2-4795-8745-60eee070f91c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675324895, "uuid": "950b6b4b-a213-4fd0-8897-0acc1ef77b50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8ed326-a308-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675349159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349159, "uuid": "af6ff0e1-800f-4420-94f4-d249bbdea606", "comment": "Malware payload (RedLineStealer)", "value": "2afcf6cd8dc311e0204eb49719c29f8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349159, "uuid": "b8543775-4f2c-4213-a501-30f99f48d0e1", "comment": "Malware payload (RedLineStealer)", "value": "d34be5ffbf85b3c0f88c192b7fb61d4b5ec3f8fb826d77673b6de26cdbdd4187", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349159, "uuid": "19d4a6ee-efc1-4c45-8f64-4ba66f74fa43", "comment": "Malware payload (RedLineStealer)", "value": "c68b99f2fa156cbb7ea565ea729085046402abc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349159, "uuid": "d7cdfe2e-077f-43ab-812a-a79f6efa32df", "comment": "Malware payload (RedLineStealer)", "value": "bfdf49a810f8204b2632ed649da84e5c77a7822794feab6466580926e016c7c7c75420f0845d1651ef93a11edd84741f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349159, "uuid": "a016ec91-ee98-4dd5-bacb-ca2d86eaf34c", "value": "T11EA35D20679C9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC164E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349159, "uuid": "d1f55435-bf03-4a1f-859f-d4609031bb52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349159, "uuid": "b42a1c49-c5a9-472c-81d6-f82278a961ba", "value": "1536:xqsIjlqzWlbG6jejoigIr43Ywzi0Zb78ivombfexv0ujXyyed2/teulgS6pk:f0UeYr+zi0ZbYe1g0ujyzdTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675349159, "uuid": "8aeec1e0-5ef4-462c-a061-d2bb43deb2da", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675349159, "uuid": "f97337d0-00f4-4dcf-9384-909cc8ee68fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349159, "uuid": "0a5b6c63-d2b1-49f5-bdb1-73d91652a0db", "value": "2afcf6cd8dc311e0204eb49719c29f8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd4ec7a-a2c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675318554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675318554, "uuid": "54bc2f9d-5c9a-4e87-a1ca-5cee52418c85", "comment": "Malware payload (GCleaner)", "value": "80734487a16eb10fc02adb320e22e286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675318554, "uuid": "64270e9f-aeb9-486b-836e-aa82e7cf9180", "comment": "Malware payload (GCleaner)", "value": "d3a5a9ab8c3d694d40ece39de3d957a48762033ed0fcca46676a0f6bf25da299", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675318554, "uuid": "1a618aa5-31ed-4a2d-9388-f261dce1bbc6", "comment": "Malware payload (GCleaner)", "value": "71a9ba1b311afdba3eb27e711a8108d7d374ca58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675318554, "uuid": "87b2d0c1-7378-414d-bdab-55a339831755", "comment": "Malware payload (GCleaner)", "value": "b1a077c000804a23fae897913a1415e1a222d812f925844b05b6ed70c0c89c2ba433f7b870c0497d95bf720bc4707932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675318554, "uuid": "6fe2bf50-8a4d-4d6b-a01a-f3919b549abc", "value": "T1EDA5339BECB47035D105A7722D36D6A1B273ED946494A32833AC404D1F332FA3D9AFA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675318554, "uuid": "7291c6cd-25ce-48f7-895c-95318378e23c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675318554, "uuid": "5c8eeb8b-23d2-4d25-ab34-d0b437d8ff92", "value": "49152:bgrbSy6djOaBRnSGvrEtTTHXl8jKOdPmIsOYLCgv2MR:cHSybandDcD21UIsOQv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675318554, "uuid": "62308258-19d2-4029-af28-3d72d2781f25", "value": 2103128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675318554, "uuid": "139b0016-9d2e-4803-9f83-f239702f5595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675318554, "uuid": "c1dc10c0-929a-4815-a5ec-41809563b665", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e2c904-a2bf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675317769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317769, "uuid": "09365fca-1de1-4a6b-9242-9caac8ec3685", "comment": "Malware payload (Amadey)", "value": "855713f115e152c9795d6d10fcabf2fe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317769, "uuid": "a3c9c74a-8135-4d8a-aa4b-d91876fc3ce9", "comment": "Malware payload (Amadey)", "value": "d3bcffcddedf12532042ce4bb3afb760b51180189e2c26694ef6f99daaf6160e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317769, "uuid": "c9ace345-73eb-4069-ab5f-7b72c127f61f", "comment": "Malware payload (Amadey)", "value": "caec265b850c6eb4497a1ab339b96bb1364b6028", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317769, "uuid": "35fb14bf-a78c-4796-b9db-53180b268455", "comment": "Malware payload (Amadey)", "value": "49e0de73a211684bde6637883fea36d9e74f94d4c8568f8c9e37dd1b40bf36339b966d257046f2cc43680fb741946fbb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317769, "uuid": "547728dc-bde2-4ae5-8255-138eb835a546", "value": "T156648E0272E0BC49E5378B729F1EE7E4FB1FF9518E1877761228BA1F14701A2C962725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317769, "uuid": "48fc37a1-226c-4c18-b322-69dd00158b03", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317769, "uuid": "182245db-cd83-4e83-a2e7-2f4f7a26f4e3", "value": "6144:DrL0dy6j9xY8zAxVOGE7VQhR6gWG19/CJTk637eQfnd5dIiB:Xw7jfzAx5E7c6gJ9CJb7d5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675317769, "uuid": "38e2d186-193f-4aa9-9937-dbb7045f5ef9", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675317769, "uuid": "57e3abd6-4724-4def-97ac-975eb73d9645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317769, "uuid": "82f2bdfe-b95f-4a5b-ae39-8f20ef56039c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008796d0-a302-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675346451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346451, "uuid": "eff53c4d-2f5c-4669-81db-597860068664", "comment": "Malware payload (RedLineStealer)", "value": "3e3fd9a5d1491021d0458bbfe076304a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346451, "uuid": "6736fb79-9f7c-4843-a5b1-005769669e82", "comment": "Malware payload (RedLineStealer)", "value": "d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346451, "uuid": "3d2c2783-6135-4a18-a727-1cffd2893e6f", "comment": "Malware payload (RedLineStealer)", "value": "880af1b339ed093f20652de3e71c5c06f4bb8843", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346451, "uuid": "453c4d2a-5141-463c-b856-5683ad00b5d7", "comment": "Malware payload (RedLineStealer)", "value": "53093b51e99439329fabbf7c0a63f2ff78072db95bcc6dfdc6ec3771f12ea27485c01f32989e3183b0c61059b2048c36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346451, "uuid": "3f38fd0e-df9a-485f-b92e-61210b46e2d8", "value": "T14B94AF42B2E1BC49E9318B728F1EE6E4791FB9518F5837B61314AA1F18711E1CBB3325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346451, "uuid": "4807a1db-c29f-4fa9-b40a-0d57017670f4", "value": "d9bb3534629ee1e0adad5f89cd30d412", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346451, "uuid": "b5611f14-6c10-414e-8254-41a9a3a46032", "value": "6144:vz3L76bhCDyUXwISmej8dhV6jqq7guo32TSEj9/CJTk637eQfnd58ABD:bHBDZXQmrT6u3uWqnj9CJb7d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675346451, "uuid": "0dc7774b-60f2-4bee-9091-eab6c250b4f8", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675346451, "uuid": "d51a3b1e-d821-4851-883e-fe60c8bc36d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346451, "uuid": "d870d235-258e-47d8-8829-412550d2229e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d14760-a304-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675347557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347557, "uuid": "2474f256-debf-44cc-90ab-ed874e43b85e", "comment": "Malware payload", "value": "435fc9b33de841f4de6074b8477909b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347557, "uuid": "517a15c2-bc1e-4065-95d5-547cb0db95d5", "comment": "Malware payload", "value": "d5677e48fe9f6e8a86f7d07b0e0eb5fac2eba9f05642ee39398b9bdb6fbf72ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347557, "uuid": "6c478c09-8bf2-42de-acba-79584e6df960", "comment": "Malware payload", "value": "26e819d8761e7fa07e3e714e22c133fe133d46c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347557, "uuid": "3d5e6a14-e28f-495e-b68b-9a299b44eac0", "comment": "Malware payload", "value": "0d7a5cec44e4688a6102ba27a7dd0fcd284b2c9cd8b690e03e0fdc322705733191ffb589873e6428b2ba39883392da36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347557, "uuid": "3746f607-780d-4c4d-abb0-ac8e8ec295e8", "value": "T190C5330CC129E78AC20EDB761431F5CF813AC281687FFDEA85D99596C92FE12C758D4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347557, "uuid": "cc72926b-bbad-4c80-817a-d544b5f090ed", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347557, "uuid": "5ce2b9bd-de31-4a7b-b437-501f67f30bf3", "value": "49152:MyEgJlCwxfyMwP/JwzmyOEcNlYioCBjTYPolyrkcf4ChVojONmAcf:MyEgy4fjwP/+cl9BHOFAChVojON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675347557, "uuid": "a32ac62a-5e60-458b-9521-5b00c83b39cb", "value": 2537984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675347557, "uuid": "6ac6107d-8f51-44ac-9c75-f8f2717b773b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347557, "uuid": "93bb21e8-f634-4edc-aea3-d82ffb5105ed", "value": "435fc9b33de841f4de6074b8477909b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1feb670f-a326-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sality)", "timestamp": 1675361965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361965, "uuid": "d2f499d3-12a3-4acc-8bd0-44121cceb681", "comment": "Malware payload (Sality)", "value": "6d434c91bec5ecb0e2241a4713fdf7b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361965, "uuid": "1ab7cb17-e634-4444-a3df-ce74adcddf4f", "comment": "Malware payload (Sality)", "value": "d57be1bc074b11441ffc9b5c9f3cc9a6d58f11b8af7474ed1c257727ef286f85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361965, "uuid": "517df439-dc66-4d61-afec-1b393b320444", "comment": "Malware payload (Sality)", "value": "a629d32f8ce856b989dc6b3e059be38487b3e9ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361965, "uuid": "612768c5-f0a2-4f36-b389-759580c72fdc", "comment": "Malware payload (Sality)", "value": "f638c99f3d985ebe68382c029b037f394e85c40a10ff0e896ecfff6e2d499131917e9e5082a2ee903a6e5abd67caeda5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361965, "uuid": "a3aae15b-cbed-4f7a-b95e-3060ab3c7927", "value": "T17C948E107BD18036E1B324724A7E87695A7DB9711F2181CFB3C0276E5E71AD1EA31B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361965, "uuid": "4cbb76d1-aeb0-461a-aa45-382440479191", "value": "39ea153c0a19e80464f0a1fda15772cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361965, "uuid": "081b0ac0-dd2c-481a-ac12-bf75fd972f79", "value": "6144:SsYQXsnUVx4ZXvQShd8XvbGLcqBG65tufv1Qp9A2+94juR1y93ktBTRRzI+7r55:SjndvQSr8XvbGIqBGr1m+91zTL97r55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675361965, "uuid": "ff1907b7-d8f2-46b3-be06-01454e70f438", "value": 447704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675361965, "uuid": "1d028bf0-2a0c-43f6-87d3-2041b1e36270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361965, "uuid": "d5b688f8-a5cd-4321-9044-dcd692b9157b", "value": "acrobat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5516c086-a330-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675366349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366349, "uuid": "713ae799-449a-4bb9-8042-c248c04f4437", "comment": "Malware payload", "value": "aa4ee37208c82f6e996fce2d7cfb34e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366349, "uuid": "15bd6985-6dfb-45af-8838-5500fea32435", "comment": "Malware payload", "value": "d5b17ff473b347cbd7bd7d7a6ff8f5109bfb90d73bb9ab9856a019e8896fa4d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366349, "uuid": "679c803b-6df4-4406-8b28-822e90bccb7f", "comment": "Malware payload", "value": "4d872e1cae159b3dbe169444848404414df3ef67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366349, "uuid": "75565c42-40a0-4326-84dd-81bb01211b6e", "comment": "Malware payload", "value": "11f47cda19bed5b1adca822017252b89e79853c08d8acff34f7befc82d8dcbce60ae53de1da3f6ee192332eba1c5b55f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366349, "uuid": "e694199e-df88-49f0-a16c-77de4c321531", "value": "T13385337078D1DAB4C462C539986CC7017F39AD423131660B6BACB7D7AE31690227F7AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366349, "uuid": "54846bc2-ca73-4002-b834-076f28517320", "value": "e479a558a3a55c2bde918dd7ce07e020", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366349, "uuid": "2de0fbba-02e4-48ce-a827-0b0ab6b56c46", "value": "24576:MlIvl5X4G7PKqy8RVTz2J58KNuNPMxnfT/3MuFEHHS4/HHOnKll/0QT4CDWOlNhf:M2vHjBT853ztbdEHS4/XPBSOly3FoV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675366349, "uuid": "00b8ca49-8ab7-45c6-80bf-dd55375fe6a0", "value": 1826816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675366349, "uuid": "2ad87158-7954-4c8c-87d9-f784fc10243b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366349, "uuid": "2d4e6d37-cb3b-4b18-8720-a966a932a547", "value": "aa4ee37208c82f6e996fce2d7cfb34e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d0beac-a32b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675364473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675364473, "uuid": "a28cd7c0-627c-45de-8d82-3971742a11ed", "comment": "Malware payload", "value": "787e2c1c85f8b4621ab7cc51f11b8672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675364473, "uuid": "f35ebb6d-cc46-4bfb-9438-50b7a87c30ab", "comment": "Malware payload", "value": "d6abaf23cc1840a0907550f7ff1ecd3ff0ea6c4c00598a97245f1262110132d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675364473, "uuid": "4bb5e9fc-904d-41dd-a7d4-b9190932c91f", "comment": "Malware payload", "value": "b1d94fc0304b372beb5042d2ff62bb4c6df888e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675364473, "uuid": "f7b5f368-7a10-4f32-abbb-e4b018e8fb52", "comment": "Malware payload", "value": "012fd1a7143b065351389bffa41547df249defa45224816f5a8c0d5a905b715d08e3c89d4f62c9ab46e769b7806d5d1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675364473, "uuid": "737ca748-9d29-49ab-9a38-3779990f2f1a", "value": "T1DC9533DE34C6B83AD5B2D7387939312AE5727F1106383349242D1A1E0FB6556BC9BF88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675364473, "uuid": "2270d7d5-e0db-4898-b4ce-9fb995a3c880", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675364473, "uuid": "72075096-c302-4764-9aa6-a0b0ac79b204", "value": "49152:bgsvoGOifzMs//TX7dHEET/F3YaqEkhLCgv2MR:csvzLfzzXTXhZOaqvv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675364473, "uuid": "5a383e52-1408-4c29-8510-9dc90520e3e5", "value": 2057278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675364473, "uuid": "cbf0f1e1-bbcb-4f1d-8b04-08b7f2a42b4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675364473, "uuid": "3173ed2f-b435-4116-a7f6-7d158b01d835", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533f5c76-a303-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675347019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347019, "uuid": "1eab0861-5f75-4334-81ce-2e9fa5ddea8d", "comment": "Malware payload (AgentTesla)", "value": "fd52925a91ee506abee5382effaf3e9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347019, "uuid": "591b6c73-92eb-4e7f-82a3-b2595267b3ea", "comment": "Malware payload (AgentTesla)", "value": "d6b05135289196a19053609b8a4ce2fc13f82b128c0e8a6ddef57d1fc35c8ff2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347019, "uuid": "23b80698-d032-4cba-baee-dafda848723c", "comment": "Malware payload (AgentTesla)", "value": "4114ff8a03f14aa0c482023eeb5409553f77f46c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347019, "uuid": "a896215f-1853-4bc4-b168-9c6c5d84cf1e", "comment": "Malware payload (AgentTesla)", "value": "2f6b7365aca2f0b2ea3973ff9bef2160e034b1c42d89ac89d237b203c5adb4451c0937dcfaf0190ec98ad56a724e4f88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347019, "uuid": "5984e8a0-d196-4abb-a90d-3e8dcf103953", "value": "T185158D8737B1A8BFF68B407544283F8C6BA07113BE46E253973779C49B098FBBA94151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347019, "uuid": "ee458821-f5a2-4e13-ac3f-b1cb30daa6de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347019, "uuid": "8b5ae684-ed29-4623-966c-b2b943f6e6a5", "value": "24576:H4BE6F0xMK2kLHEzN+qk1IC9/EkKGTqG4yPaI:2WiKLRnaC9/ELGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675347019, "uuid": "1ff63f1a-a6fa-4e85-bdbe-c5e55c6c613e", "value": 896000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675347019, "uuid": "fa2fba69-a12a-43d9-8a2a-55f8e36c2738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347019, "uuid": "656bd970-847a-467b-9e6e-6a44822b4979", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecd3077-a2c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (WSHRAT)", "timestamp": 1675322154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675322154, "uuid": "7a048cf4-3559-4476-a22f-907afa91fc94", "comment": "Malware payload (WSHRAT)", "value": "d2d74972732d9af034ec0fb7bdf6b639", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675322154, "uuid": "c0c37ab8-9f4c-49b2-88ef-f0ee35872d08", "comment": "Malware payload (WSHRAT)", "value": "d835e918736fdcbe6a4b952f59059d9d1df2956f5c63758ed626cb2571a3e7ea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675322154, "uuid": "d23cf072-a6cb-43de-8491-e53d35ebfae7", "comment": "Malware payload (WSHRAT)", "value": "467f3fdff8f759d184794558a64c8207c6951f03", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675322154, "uuid": "8ac7894a-00f5-443e-9d57-721f60951581", "comment": "Malware payload (WSHRAT)", "value": "cb8f5e8411ed578d161be94925501efd0a7ea643ec40943b956163724b2f240548330fb8e73a29ae4bee415c4af1b618", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675322154, "uuid": "74f376f4-524b-4424-889d-c6b298d9c33d", "value": "T14755F64B04B90F0906AFE1654BC39BA3DC2CD10B3FAFA8E2B4597B4F943754D9479A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675322154, "uuid": "7c7fa3ca-dcc9-418d-9d2d-216fad796fdd", "value": "6144:h1GlgoQx3ZUiezJ54oUViONwG/IkXpVUyrw7+Hjr5UFko+/clqoJ89laGHZ7RtAO:mHQxFukHUvtbpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675322154, "uuid": "e3243b2f-14f7-4850-aaf4-bbadc2cac720", "value": 1333212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675322154, "uuid": "38aef1cc-83ed-4dc2-b6c9-5366c95c1dd8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675322154, "uuid": "c8cf4739-8ca7-4c2d-bffc-4cdf6152710d", "value": "Spe00002.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef4a950-a2e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675335791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335791, "uuid": "acda08a2-4caf-4da8-8196-8341e928c7f5", "comment": "Malware payload (Formbook)", "value": "7ed80e2f37b2e12b922e31851f41f1ed", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335791, "uuid": "f19926a3-9f08-4320-8a47-614bace1d246", "comment": "Malware payload (Formbook)", "value": "d89509155d34dc8896fbf452372913ba12d9cc2cd3ca683e1fb64ede9f8fa532", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335791, "uuid": "493dfa05-020e-49ba-8eae-ab3bfed676f0", "comment": "Malware payload (Formbook)", "value": "1d3e442d3fe740f6d006eff4bb7b3abaa4c21e7e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675335791, "uuid": "a9097cc8-9cec-49b8-b1bc-d92dbd68c975", "comment": "Malware payload (Formbook)", "value": "4fe95b64a25107239729ae09f82a0fcc337128882ebfba85b4fac13a7c5dbfb618668b7b9b5fcfae390abd417c05145e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335791, "uuid": "407c7ef0-c081-4cd8-a44b-f7747b408957", "value": "T12CF4234D2E3BA5ABF119B84A347858F0150A34D0FFA59DF0641A4D3CAE5BAE536F3813", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335791, "uuid": "e7223b74-bb5e-4581-acf2-292dc632a8cb", "value": "12288:bj1is9tkXQytmXfBAhpgInQAUj39TiAIUAB4ULvWS3uviI7wUzzYoKGGsFCOxK4J:Q02XAKMI7Ydi0ovWVv5k/0FC8K4bB5pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675335791, "uuid": "05ccd45b-5085-479c-a7f2-71b79817384d", "value": 749687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675335791, "uuid": "838605ae-b794-4688-816f-0904d6da67b2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675335791, "uuid": "96c5f474-f848-4c86-993e-4c84a6443b01", "value": "Order specification.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3bfb82e-a2ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675315908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675315908, "uuid": "f328e8f2-231e-4900-aaaf-2142ec3b91bd", "comment": "Malware payload (Amadey)", "value": "64fae0af972964bf7ed50250c28dd958", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675315908, "uuid": "99764bf5-ad66-4042-9d0f-63cc8a3c71e1", "comment": "Malware payload (Amadey)", "value": "d89da2a368c14165f58c88af16f3f1b0381c676652cab59e8fece4ca540df0f7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675315908, "uuid": "1f56140e-ffdb-4bcc-bcf2-e5177f65d9e6", "comment": "Malware payload (Amadey)", "value": "1641d8f37d2e0d2b3d36cd0c6f061bf36afa16b7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675315908, "uuid": "8b7e9d8d-f218-44ff-b72f-8ab7ac271353", "comment": "Malware payload (Amadey)", "value": "c1b1ef5e4a93f22e095cc043ab4fbea5d1000f2ea072fdc83f01b754b972648a435d34eb4ba2aea9c1e0a4e805a6a43a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675315908, "uuid": "718ececc-a517-4e3a-be43-295a06cc0a7d", "value": "T16B34DF323990C0B2C5A710305CE4DA94BBBEB9314A79A95B779817BD5FB02E0273E357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675315908, "uuid": "34464975-f22a-4063-9690-d9569ad6f636", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675315908, "uuid": "35799b54-338e-4d2b-8ced-f4b6e3a0847b", "value": "3072:Rpho/yxMFAiTfzL/WLWaC5QvGhSUDiqLirS0afFmsBbJ3r15Z:RpSiiTrLOLjfULL8af7BN3R5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675315908, "uuid": "28ad7c54-7b4c-44f4-8fab-63bd2bef1959", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675315908, "uuid": "8d5171ac-56c0-4391-a760-78540245aabd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675315908, "uuid": "faebcb5e-ff0f-4436-b029-0733132ed229", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f8e10d-a2c4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675319945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319945, "uuid": "fc679d39-40c4-4f10-913c-83bf29044d3a", "comment": "Malware payload", "value": "662c76b76b23344a769a1b817e359d47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319945, "uuid": "621ebc54-e933-4f8b-94e5-59c27e510fad", "comment": "Malware payload", "value": "d8dcd37c5c6b42a86d47c79bd0bb00bf1adeffb48a84fcf0a1efdc234eca977e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319945, "uuid": "918381bb-ec58-4c47-bb46-17897dff0172", "comment": "Malware payload", "value": "876079d3cc53e5c22db6536ba2f6813d6f4c6a03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675319945, "uuid": "f76ed089-8e88-42d6-bd7d-604ef339554e", "comment": "Malware payload", "value": "d0b5358c5624b38b463b611c18484e374e366945250325aa1419fb03f53a1b8094036a3a8a8f00f089005d7a226df2b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319945, "uuid": "079b3b2b-fbc9-4027-8529-ee82a31c5a3a", "value": "T1B6A2D55276B86B3BCABD83F31B5215011BF0A0AE7CA2E9194DDB94C72962F051081F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319945, "uuid": "9c73803b-2780-4068-9acc-9290632c8077", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319945, "uuid": "8e820a1a-fc9e-4faa-9a51-e95279407dd2", "value": "384:Xwb3F/LXV4QOxHUYL9L0wTMIihXCBZ0Lk6Z6JWSYDmya4hdf+rlyP4hfL:Xwb74tk+WSYDOHrlz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675319945, "uuid": "77744213-0e6a-4f1f-ba89-5c094c780963", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675319945, "uuid": "9136f110-e1ac-4cc6-b859-c9adde654336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675319945, "uuid": "7d0f519f-bcf0-47fe-af58-50d3201f186d", "value": "sleep.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3fc8da-a2c4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675320004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320004, "uuid": "00f2ba98-63a4-4c8e-8a71-64c80a2a64d6", "comment": "Malware payload", "value": "c4902edd754b9c51d4ee1ee4df6a9d5a", "object_relation": "md5", "Tag": [ { "name": "Bunitu", "colour": "#967762", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320004, "uuid": "d5c610d9-8bb5-4211-a09d-003af1d35f43", "comment": "Malware payload", "value": "d93e7ac46397f1d6fa895fe081cc7c85ce460e4a4ce741d56d88bab60c42836f", "object_relation": "sha256", "Tag": [ { "name": "Bunitu", "colour": "#967762", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320004, "uuid": "fdf2d0b0-27fa-45ac-831e-8f4b5185f6e3", "comment": "Malware payload", "value": "c9ef6324069f3f336a066a15225c02abb1ff93ba", "object_relation": "sha1", "Tag": [ { "name": "Bunitu", "colour": "#967762", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675320004, "uuid": "3fba2f18-450a-47d0-9e1f-2f1c555b65dc", "comment": "Malware payload", "value": "85f0663bf4227bc040726910c6fc67c929248f4a391a73183bf088d38b9eae4cbca7741c92f991823839bd9ae74c3f67", "object_relation": "sha3-384", "Tag": [ { "name": "Bunitu", "colour": "#967762", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320004, "uuid": "6ea7a1e5-36ce-45fb-aab3-3fe6957ef11f", "value": "T127A4BF65F9909F13F00329368D246B719298DCEB0658B633A188FDCAFF372F155A61C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320004, "uuid": "a3e3593f-08be-4bc5-bd9c-65bb51b8a201", "value": "64f8411142db260dbaa6bdab918f4623", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320004, "uuid": "a9dea398-4f99-426f-b005-6b30df89fc36", "value": "6144:Nayi8U4MooP5Sc1LU6xMsW0jiQ/RUu+1cX97XQA1FwxDAbUvBV8hCTTN53Wy:0yPP7oP66xT+Q/RvIq2A4DAbU5VtTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675320004, "uuid": "179ba1b1-2590-4314-b615-f28cacba338c", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675320004, "uuid": "0acf0669-56f7-415f-8b3b-f6ba60ee4a73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675320004, "uuid": "b95e0668-a548-4159-abda-f935457acf4a", "value": "sysprep.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c222bc4-a304-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nitol)", "timestamp": 1675347544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347544, "uuid": "6dea529d-71ef-4d9d-9b81-7373d909ff9a", "comment": "Malware payload (Nitol)", "value": "1d9e769d4a0552c03051c925b0606e70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347544, "uuid": "84ca52cf-1cca-4633-8e43-13f13537a1ca", "comment": "Malware payload (Nitol)", "value": "da34a7db6c239925e4733c910c2ac184249a73b2d21371f3c9c8d2db098c49a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347544, "uuid": "dd657499-1cc5-4e5e-a82f-842e4b898d0d", "comment": "Malware payload (Nitol)", "value": "120168e9d8e71e883ba9df5aedc998bb04920766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347544, "uuid": "515745d7-efc2-4eda-88b4-741fc13ab44a", "comment": "Malware payload (Nitol)", "value": "3cb44e86572e2c7709c02042ec278b44c916f55367603ee50518b47c33d6f721fe318cf9ac6221dcdc3654a7abc03ce7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347544, "uuid": "84c33a36-abae-493c-aee6-c62f5f430530", "value": "T14CF423D420FB6C50DFB827F096BBC09ED7091EB86C35D1A875A57A782E1647278BB090", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347544, "uuid": "0ac6486a-4fd6-42a0-b02c-dfcec0742021", "value": "26d890388ed18a573c78c9c2698f7372", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347544, "uuid": "824b41e9-5dee-4f65-91ef-75738a47eb87", "value": "12288:kc6HPv7A+bwLRyh/WY4HMhpB4EfoRbWSu5smrt+UocSc1GMJJL9s39hs5+:k7Pv7A+bntWXMhpB4EARbUrrYUocSc1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675347544, "uuid": "a7bdb61d-3cd0-47d1-bb2e-04019aa6db91", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675347544, "uuid": "97e6f940-bb3b-4601-bec3-af2896df2ca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347544, "uuid": "eb3696b9-e828-4b26-af10-18a82b14eac0", "value": "1d9e769d4a0552c03051c925b0606e70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b562af58-a296-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675300369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300369, "uuid": "20505077-050e-4e0d-903b-6c51fa658c7c", "comment": "Malware payload", "value": "efd2d5b90ab5978437e07cb07e185965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300369, "uuid": "43c88b78-3f51-4d7e-bea0-422a03557552", "comment": "Malware payload", "value": "da88a509e49968927417457930a6e1624fc677c9f8677aab323074a5be5aa89d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300369, "uuid": "de4ecdb5-b291-4981-b9cd-de1f2c9554b0", "comment": "Malware payload", "value": "5b2cd87911a03be22692ad101c8e37c24d3252f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300369, "uuid": "c8e66b98-5d0c-41ed-8f38-f34982cf6594", "comment": "Malware payload", "value": "0552a40eb01bf5aeea369040213e2f3cfb16dee11872a9b587ab9a9b85a747f23683f49828aedcd821615e8bc0e454ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300369, "uuid": "99146064-6bd4-4939-8ad2-2bdb4c3cf3c7", "value": "T14C763331795ACD7AD1497D32D9842FCF827CF22809466D7F7368088EBD7EA580D0A729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300369, "uuid": "1c7926cb-ed4c-4749-a59c-da2746f8af6e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300369, "uuid": "ddf9bb09-2885-4fdc-b26d-d9c8337abc34", "value": "196608:91OoSuhaVt0xSK3NB0HRsKtKEdUnxhiS+P3T:3OWKt0t3NSXtKEUxhTkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675300369, "uuid": "b296c0bb-9b59-4f9d-87ee-dbc6efbf31f9", "value": 7644476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675300369, "uuid": "c8887be0-72cc-40d5-904f-283b6af645b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300369, "uuid": "a397b4d8-b49e-45c3-94a8-af1a0aeb0d6f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1961a7fb-a328-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675362813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362813, "uuid": "6a14c3f5-9d8e-4e2f-83aa-fc6aa85a4c31", "comment": "Malware payload", "value": "8caa7f8b1f0c0afd9d6221c2e427491f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362813, "uuid": "852216f2-b606-43e9-ab6f-bc7485f88874", "comment": "Malware payload", "value": "da903c53248d357ac6b6cb8ccc5f7b7319446be1dce6e2cbb83f67bf65ea5128", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362813, "uuid": "2ae6186c-487d-44bf-9b88-b91257074f43", "comment": "Malware payload", "value": "0fc4f72962a80036ab5a8dd2929fd98089eb11e7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362813, "uuid": "a962a9fe-ca60-41ac-8504-6fef84b6de07", "comment": "Malware payload", "value": "c5c6104c3303493cb18f9d387410a44accd56c11a4fb024c3f7d49d4b57af23b1c7662dfe06c8b4c8d4fa9771a109b35", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362813, "uuid": "d297e1c8-1e48-4b02-b021-e4bba0ab9298", "value": "T14CD6222275C5C233EA6F8330656ADB7B51F97AE0377380DB53D8992D0E719C08276E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362813, "uuid": "2ef3b181-2ab5-4a64-8ab9-33f442670ce3", "value": "393216:CPqxf6wAMQ8MLCCBtBOy2suKLRyfWVC8:CPqrh3wBtBXruKLgWVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362813, "uuid": "9441c61f-2e4f-451a-8c70-899196c22dbb", "value": 13090304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362813, "uuid": "dfefdee6-5f1f-4261-9903-5a0bfa6aa00c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362813, "uuid": "68c61b1e-4210-40de-bf9f-af8d7531a58f", "value": "SecuriteInfo.com.HEUR.Trojan-Downloader.OLE2.Powedon.gen.8478.9093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30403ba-a34c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675378560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378560, "uuid": "f92e9aa6-6d6f-43c1-8b8b-a63e58656056", "comment": "Malware payload", "value": "433c8bfec438e962bcf0220947e6d677", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378560, "uuid": "4aec5aa6-9e02-4577-a4b3-e2b3226935c7", "comment": "Malware payload", "value": "daae55e6fe5fc898a9f035641df40bec187bcdd5c766549d570e2de07bff0a06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378560, "uuid": "f9400f29-240c-4dc3-9b63-a04210c5d837", "comment": "Malware payload", "value": "82182b3cd30fad4189685ef6cab1420d41df95a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378560, "uuid": "503f7491-98e5-4a63-b69e-5d6b6db9af26", "comment": "Malware payload", "value": "2639ac035012d0120855b013f1a38fe00baaaa422ad4970a8cb65eef40e564a7952c0b45fa2591b7a59386dd9604c203", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378560, "uuid": "ce26b91c-b288-4b95-9d17-53d89d3da298", "value": "T10EB21A41B3F88326E6FF5B78B875425547B2B92A5C22D69D3C8C118D1F637808B53BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378560, "uuid": "d6ff8eea-f85e-40e8-a15a-d39705f79330", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378560, "uuid": "9583df20-44a8-4645-9cdf-4bc107dc21f0", "value": "768:+FNjuAGnfHk2opAd9OyGRtxvZkqgc5tuYsxYhY:+FNjMfHk+LDGRtVZkq6YsxmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675378560, "uuid": "5fdebb5e-ee0a-4657-9262-439923c19c8a", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675378560, "uuid": "249bbefe-4603-4fcf-8b45-8bab7a1a30f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378560, "uuid": "fdd37221-834f-4c13-b2c3-ff553f64110e", "value": "NorthstarStager.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747b6d57-a290-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675297683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675297683, "uuid": "0c4d4fc9-0213-437b-8a50-528e7b8e4adc", "comment": "Malware payload (Rhadamanthys)", "value": "469e3dc00ed2783912da7850897ac0ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675297683, "uuid": "e22c7cd9-a69b-47b5-885d-6de271907ea2", "comment": "Malware payload (Rhadamanthys)", "value": "db7015191ebefdd6ac1e7358c1f1a4e18240fb8a1082764a21d29340508f6b62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675297683, "uuid": "2b4be8f7-b6e1-4924-853d-5a2770e77a1b", "comment": "Malware payload (Rhadamanthys)", "value": "f5dfeaa96b761391e8457319f0cae1e319b55ef8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675297683, "uuid": "add115d8-73c9-4771-aa23-8938f9e75f2a", "comment": "Malware payload (Rhadamanthys)", "value": "d3000fa26ad658538113bb8064af8b3bc538f36a416a10b9d2077b18903256fe777faae302065acec9dbe56aab776004", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675297683, "uuid": "fcaee0ee-66c7-4cfa-a710-c11e26b7e02b", "value": "T1C734CF323A80C072C56754309C64FA917A7EB8320A75D45B7B9C1BBE9FB06D167363CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675297683, "uuid": "6226e5ab-fd7f-41af-ae10-dc4191eef354", "value": "5b3e1365fd24e4232cba105b88665e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675297683, "uuid": "6cfe9375-1d8f-4c89-b512-7859df1e1234", "value": "6144:GTdjRwLbUbAN6Vv1XEiffiXeoJq9Wnyq:GTBa3UbAuN9WeeJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675297683, "uuid": "24d7207c-4573-4097-9db0-b9a70d9a2f10", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675297683, "uuid": "deac82c1-ca77-4aad-a8bf-bef6e7a622ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675297683, "uuid": "23fe14b8-29b6-43f5-99f3-6d9a2cb39eba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df809bd8-a292-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675298721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675298721, "uuid": "fc7479d4-3559-4d29-9162-aface7539ac7", "comment": "Malware payload (GCleaner)", "value": "fa21e3e5667eec4de301f18c346878f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675298721, "uuid": "9a644a86-7e61-42b5-8647-a09828de15d4", "comment": "Malware payload (GCleaner)", "value": "dd2b262eb9b04c72acd54c6a9d9e0afadef513c816fa1f227de16b49b3d6f8c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675298721, "uuid": "c186e1de-9d43-453b-9050-c294385720e7", "comment": "Malware payload (GCleaner)", "value": "27a5c504e7bdb8b00275cd72201e6335a58542c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675298721, "uuid": "927046d4-7e4f-4682-9a20-b7caeef912b0", "comment": "Malware payload (GCleaner)", "value": "9c34861b3236249bb0999dc6c7cb8f1d1d760695e9530fa4f27090fade12e5140b60fa0fe6578d8ee8584cda561f95d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675298721, "uuid": "6d6d3154-c618-498c-82d7-ff8cf35416ce", "value": "T1FEB533056A3C9D32E393ADBC4A16DA21A773AF11383D926129F93D4F31BE6D35C09391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675298721, "uuid": "90388ee4-e72f-4986-80c6-d4d93e098cca", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675298721, "uuid": "7ce76630-ef4a-4b6f-af6c-b6d5f03de70b", "value": "49152:icPLnQSqBP5HWW724j6wXUSAR80TPVQGDxNLCgv2MR:XPLnQSYF240PxTdBHv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675298721, "uuid": "1d699773-56f8-4db6-a607-0c5443ba4895", "value": 2281825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675298721, "uuid": "38bcd42c-3d30-4c67-a8d5-f555d0012e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675298721, "uuid": "c4eca04b-f47e-41b9-9224-3810ef469fff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5212d0f6-a2f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675341434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341434, "uuid": "1d5f9672-c811-4a40-8edd-5add091196b3", "comment": "Malware payload (RedLineStealer)", "value": "fd73e45ff1b26a628ee449ac19786b1c", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341434, "uuid": "e023922b-a025-45f7-a64d-d3bab731fc10", "comment": "Malware payload (RedLineStealer)", "value": "dd8435d777b6537bb70f3a1b67641c26b7361828a4a1cd57e51279a0554aa00b", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341434, "uuid": "74803f07-e49c-4e7d-98f6-e789cf0b70e4", "comment": "Malware payload (RedLineStealer)", "value": "cffeb0557b7acf8b3f434042afcc5b5310bc426e", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341434, "uuid": "5b07701d-86fa-4ae3-8725-0cea31242ed2", "comment": "Malware payload (RedLineStealer)", "value": "61a889ac37248204df18d2c4c6dbac12139bff8cf3f32e2a4fc847827226ff86e2cb40e399251e624ba83d9e351ade41", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341434, "uuid": "09a593ce-b3bd-4d6a-b013-bdb31414a687", "value": "T12916232876D5701B806DB799EB17F13E7EE1B8FA536064D1F3E0B687CC485988D36A20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341434, "uuid": "f4ac7e93-5c82-4959-b46b-74236250895a", "value": "98304:p1o69lrL2S9VFenY5vXChSFnU2c/EiVhmMUQWpjt2ayAyu:pJ9lriAV0nGvIqU13CQW5YPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675341434, "uuid": "18b7bdbf-877b-4d1b-8bc5-e4f35bf6b017", "value": 4307192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675341434, "uuid": "59df4a3d-2af9-4b57-b40c-7d272166c4e7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341434, "uuid": "d569b10d-8c8d-4e49-b2af-37c40eb55e62", "value": "NcCrack.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9923de-a2cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675323067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675323067, "uuid": "599b2f85-eb08-4d1a-a1a8-5663748ca173", "comment": "Malware payload (RedLineStealer)", "value": "cb9ef9e32501d68151c3ffbfae42bf1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675323067, "uuid": "7323c547-08f3-41d8-b35b-273b61ed28f2", "comment": "Malware payload (RedLineStealer)", "value": "de1c0019ba6049f083253597fa8b05028fd13c99c604896ab52a80d8fc436a1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675323067, "uuid": "f1dd98ca-2bb9-43a5-bb55-9a6241e9f8c6", "comment": "Malware payload (RedLineStealer)", "value": "6569e68b6488f48c5335cb39b8baed685cfedc79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675323067, "uuid": "62640c2a-517d-46ea-b290-3a2687b30e4e", "comment": "Malware payload (RedLineStealer)", "value": "8ff49f5ab54aac76b8d34ccc6ff5fd4425335ad5ef25b650140ad44f5701c35d0df4f667717d3729376dce4eb283d688", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675323067, "uuid": "af4beb66-907c-47b7-b8e5-c6ca5fb74d54", "value": "T1E594BF037291BC49EA328B718F1FEAE4792FF9F08F5877B61214AA1F14711B1C962725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675323067, "uuid": "3ce739c9-dc1a-4715-b5f4-de479b112c06", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675323067, "uuid": "f523de36-6f7a-474f-b452-db1b0f5716ad", "value": "6144:EILTgT/969YXqW4zc0KZwPBljcpBI/VN6UTsKRBTsrl/4zwk9/CJTk637eQfnd57:he/5XqWQbKZwZluB8+KrT+a9CJb7d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675323067, "uuid": "46fe9459-2323-4b8f-8584-02a12c375979", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675323067, "uuid": "3662e944-a331-445c-83b1-d5e91cc54fdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675323067, "uuid": "4746aa0c-5a03-4a1e-b399-538ca59501d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73b55bb-a296-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675300345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300345, "uuid": "fd76730f-b542-45c1-8811-944846f4ea73", "comment": "Malware payload (Smoke Loader)", "value": "2bfc2f8a8071046a8dfda60652779daf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300345, "uuid": "b2360eaf-bd42-4304-be20-725f2b0f943e", "comment": "Malware payload (Smoke Loader)", "value": "df1ee5f19c4e85ed130a24ac06f9b7e9da4e39b18381b232fac8c4731ed015df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300345, "uuid": "e131b21f-3b8f-426b-b85e-70da184382b5", "comment": "Malware payload (Smoke Loader)", "value": "74f0d87c2a6e032d0ff28649b5d6225716a1e8db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675300345, "uuid": "ac3aacaf-1071-4a11-987a-4c5f06c6de53", "comment": "Malware payload (Smoke Loader)", "value": "7ea62e92e773db81343b8bc3ba91433edbc172d109ca7e635c3781dfa805a815fa1fc73af6077518b1f7a3926a30cb4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300345, "uuid": "58e523af-0087-4fc0-8866-4ff8c31f005d", "value": "T10534D0327990D032C96B0070586CEAD47FAEB53195799D4B77AC1ABD9F702E0273A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300345, "uuid": "e5e44250-fc1f-4133-8765-a9539127e177", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300345, "uuid": "aa336b4a-4f44-49f7-98bb-168f97385ae0", "value": "3072:2pRC7ybFySXKLYPWMx5Gb0QMaYVJQ/RsDsiYg8G85KE6N:2pDr6LYPhKb/CQZsDsiYg8Ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675300345, "uuid": "be64d361-0b41-49d8-a22d-5b26ecc31eb4", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675300345, "uuid": "a7096ca6-17f6-45f8-bbc7-504b1dfa3667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675300345, "uuid": "84951bed-57fc-4e88-83d3-496465eeed37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddf5780-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675337266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337266, "uuid": "63d597e0-c167-46c9-9581-219e42d9603c", "comment": "Malware payload (AgentTesla)", "value": "c4021c99ef2ed7023070b2b77d9e380b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337266, "uuid": "be37c307-2d21-43ba-bd93-32a5a5b8dc1a", "comment": "Malware payload (AgentTesla)", "value": "df27478f5505e307d62c19d0e3bd1ff419b891a4a1b97d19006006dbee6b8d3e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337266, "uuid": "815a42c0-148b-464f-8ec1-0c837c1448f5", "comment": "Malware payload (AgentTesla)", "value": "87391d929021c22f559424a1173eb761696b75db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337266, "uuid": "667a50f0-f1d9-4a7b-bfc2-52cce4951a79", "comment": "Malware payload (AgentTesla)", "value": "20d68c16c08677390889e84598fced51346bcb8717c186deb6f573b8cb53bdf66f42549f4ac9a2575962905de3ea19d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337266, "uuid": "e86bddfc-57e4-4827-8638-5fdfece4c250", "value": "T1BC259E8737B1A8BEF68B407154283F886FA07113BE46A253973739D4DB098FBBB94151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337266, "uuid": "528a3d80-f1e0-4ad9-8d5c-63e7b9ea5721", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337266, "uuid": "cf119053-6597-46d4-8bac-58540898deef", "value": "12288:CoSBuGuDz/PEh4R//688nYpCEl+sqvFri+B78+HdQNkr81O6Fy2Mxzo3pqG4yPa+:C9B+co3mnG+sIp8zLO6F0xMpqG4yPa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337266, "uuid": "0eb787b0-4430-40cf-8e56-2359722651a8", "value": 964096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337266, "uuid": "e94b6002-22c4-4699-bfa4-c200c6bfdd42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337266, "uuid": "5b56ed0c-dea3-4458-8d3d-fc955e0b3ce8", "value": "FedEx Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2532c378-a329-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675363263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363263, "uuid": "d221c70d-8f4c-4d7b-9c08-48224a46d7c0", "comment": "Malware payload (Rhadamanthys)", "value": "7c3cd52dc6e36c21774678b43fa8d159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363263, "uuid": "6d331e52-01dc-4d21-874f-3d344f7b4d6e", "comment": "Malware payload (Rhadamanthys)", "value": "df2f9227f0eecbdd00162dd0a7422e7e0b5f2cd83f691312294a04d3c57cfec1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363263, "uuid": "9f02208d-3a08-4293-ad58-de3d0d2d9f51", "comment": "Malware payload (Rhadamanthys)", "value": "4529e8ce8faec431286c76fe554e03d086673ef4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363263, "uuid": "d854f196-0e88-49b8-ab2a-269b5ef5c60d", "comment": "Malware payload (Rhadamanthys)", "value": "c4661423689d90b08c625fcaead9b49615b17c898ece679d0089481c2086fc110abb1cb3f3855ae8e660ebe8d5a1eeda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363263, "uuid": "78d65bd8-ad1d-4d30-84cf-aac4e544f60c", "value": "T1CD24E109B2D18878FA9402325D748E7315FE3B2B4B30CB97776C0986AE712F5652A3D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363263, "uuid": "4978e540-2cf6-4c1e-b489-f3e9d0117f42", "value": "ab41656c48706f1fda9fa72f84547ff3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363263, "uuid": "3aaf62ed-fc9c-4ec5-80ba-6ca4c7164306", "value": "3072:jkfcpRIUgz18+G8m+6Sx0WJ0u0/5URvtz7BokhtyhN2YNj9UXezE5yVRhpuI5:jkfcNslrEPyT/BvyhN2YWh5kr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675363263, "uuid": "be6c7e11-22a7-439f-99fd-aeaa0493d784", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675363263, "uuid": "2565192c-219a-4533-920d-87efd02da01c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363263, "uuid": "6b211103-587e-42ea-94e7-28787c9c9430", "value": "Audaclty lnstaller x64_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63e63cd-a324-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675361439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361439, "uuid": "b3a1ae8c-8bc4-4837-b06a-6d94cce450f3", "comment": "Malware payload (Formbook)", "value": "a3d13abc14518a7e4893b93b3068d730", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361439, "uuid": "7a510245-6ccd-4a6c-a1b6-fb02a9e4ee2d", "comment": "Malware payload (Formbook)", "value": "df6b6e0bb2608090041418454eeb4966932d5c34ec50ab3d44e5b57a4e44c3a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361439, "uuid": "6f6d044f-93d6-42b1-9a5c-e33a44c4b74b", "comment": "Malware payload (Formbook)", "value": "e5b3aa8f967f1a2dd578c190b1a413be1c5856f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361439, "uuid": "901b22b2-d9c8-486f-beab-f2dcfccceeb7", "comment": "Malware payload (Formbook)", "value": "35338cf7c8204cd94c91fa5dc477ed0b166f77af98c3d56884d16fde48516fb88df3abdab3534c47f1880b1acf21e8a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361439, "uuid": "0999b641-44c3-4300-abc7-88d047c235c6", "value": "T1B9E412D9826CCA7BD66543FF64F4A4056BB20A7BF061E70C0EAEA4D4C48F7001955BEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361439, "uuid": "e61f2095-2428-4899-b6e4-1bcbd0e0edb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361439, "uuid": "23db62f4-5af7-4a06-bb61-b03d8d66ab9e", "value": "12288:hOOcQSyntDRcud3l3oCVwd62RM0Txzx9KqWeh3ih9HXA:IJSmuF3//oxFBYTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675361439, "uuid": "c891f4c0-3414-4db8-bec6-96e0cdfc0225", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675361439, "uuid": "49cd9c3d-04f4-4ad3-ab43-49d6c180942a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361439, "uuid": "c4c51a40-7e82-445e-a081-403b48801cf1", "value": "czzA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ccf0490-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675337049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337049, "uuid": "7cdb9f23-5114-46cb-a501-6a904f4a9931", "comment": "Malware payload (SnakeKeylogger)", "value": "37ec9b191e31c1ea9a8347e91b5e09a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337049, "uuid": "5fe14c5e-0e97-400d-bf59-b3b1542e2d39", "comment": "Malware payload (SnakeKeylogger)", "value": "df990526583ae85b0713396e2f9fb5963d1de2bd1f0b85b038fd7f241ce1f1bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337049, "uuid": "93823eb9-4989-4e22-88eb-52bac6ac81f9", "comment": "Malware payload (SnakeKeylogger)", "value": "4b07b9a4bb8e248b035d45b52c064d129a8efa22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337049, "uuid": "a80ce428-1e06-48f9-b871-62f31f15234f", "comment": "Malware payload (SnakeKeylogger)", "value": "cfeff19257db184db15c510c6499c185a1060dc5acfaca0a34c73d61c9412680e79818b62b48c2f221b64c59347ba89e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337049, "uuid": "8541d8dd-880c-42c8-9213-5365b182a179", "value": "T166057D9737B1A8AFF687407144283F8C6FA07113BE46A25397373AD49B098FBBB94151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337049, "uuid": "00132356-97c6-4110-944f-a5f84bf4dd53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337049, "uuid": "9c0c538b-78c6-4f24-9cbe-ecdb3aae318f", "value": "24576:f/VvV+5haPkTzsMiiwVTjlO96F0xMpqG4yPa:lc5wtiwVTjgoWiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337049, "uuid": "f0c6b386-6bcd-4c4a-87d5-1536b1f42df0", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337049, "uuid": "2fc9cad3-5b08-41da-93d4-274794f13c27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337049, "uuid": "f88c4239-9776-4783-a523-f351ed1e8331", "value": "37ec9b191e31c1ea9a8347e91b5e09a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e64a98-a2f3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675340256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340256, "uuid": "95372975-0b20-4341-a819-d98ac5398b6b", "comment": "Malware payload", "value": "72e9bdd442be11a35d8ea4d30d5e3ec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340256, "uuid": "b22ad73d-3474-4f1c-93d0-9dc5846cdb22", "comment": "Malware payload", "value": "e12301ed387fb2e09fa7e1840e2df6a861dcd61df21b66efa3f8b5037c522cca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340256, "uuid": "fd1fa71a-789b-4e25-998f-42847647acb0", "comment": "Malware payload", "value": "d415aaa68189b60ab241beaafc9807febea27b5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340256, "uuid": "9283e013-d06b-4881-ae43-2d9e4bfa8413", "comment": "Malware payload", "value": "7b03ac838e35f732041c1e65ae09161250e5707ed801d28a1c70763d13565b901cbc348463eac265b07a54ff8e1bc15b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340256, "uuid": "d7308d51-a625-48b5-a21b-c9ca805c444b", "value": "T10876331639C4C8F5CACA8831C1993915E7AF80540F229C23F725CF7E6AAE8C591E7F95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340256, "uuid": "1fb7edbc-8c22-417b-90d1-1a22e66d5774", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340256, "uuid": "daab8dc6-0683-4371-8b21-e2695f2c1432", "value": "196608:91OVJWM7RPbqLwF5VKTF9OzrSeSoHWiPJzrQ1B/A7bx:3Oh7RPbBuTTOHS8H/UzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675340256, "uuid": "2e04314b-5c65-4419-b3eb-8e955c989360", "value": 7650860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675340256, "uuid": "389a8b6f-c42f-4c75-ae41-9e51706744a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340256, "uuid": "4df21fef-bc8d-4f9a-99eb-393249b471df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf0978b-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675337157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337157, "uuid": "2fef9a7a-6611-4e0c-b216-8cf58afa7979", "comment": "Malware payload (DCRat)", "value": "1b42f3c8a832b8130b60169553c013b0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337157, "uuid": "7eeffe3e-ee3f-4c4b-a039-2d013492f446", "comment": "Malware payload (DCRat)", "value": "e19bb77e380f8dad4bc97f3d0577ff60297e3b6f4d4de9d00c149da1ce820045", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337157, "uuid": "e1eccc47-b346-4cda-aaef-64201eaca2cf", "comment": "Malware payload (DCRat)", "value": "de90d2a3cf23c243b24ec31c51e5599ff9094da0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337157, "uuid": "ce03be41-4571-449c-87c3-2b07db687ce2", "comment": "Malware payload (DCRat)", "value": "ace87e7fac7cbe00ceb159c55ddcf8ac96bf38383724cc7bee637b60ff8d8d4cfdf311334714b798ee9ec22ec6d8675f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337157, "uuid": "76bea433-86b2-40e6-9c58-b7e79b07e5a5", "value": "T1FF557C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337157, "uuid": "b880c2c5-d186-4bc2-980e-039400ea4209", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337157, "uuid": "1664d225-450c-49f7-bbfd-a031157482fc", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337157, "uuid": "4abbb84c-be56-4eea-8186-e276d9675f21", "value": 1406501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337157, "uuid": "35549d01-fa73-4cf3-925d-25417384e83e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337157, "uuid": "bde1c52f-7fd5-4e56-8c03-3ecfb36ee08e", "value": "1b42f3c8a832b8130b60169553c013b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99204326-a33b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675371188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675371188, "uuid": "8433b845-5d16-43e8-8ef2-7cd4c0ff1289", "comment": "Malware payload", "value": "b2b8aad8ce248318b988e9b7250f1076", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675371188, "uuid": "9c9a06ba-15ee-4ff3-9a75-51b3387c2dad", "comment": "Malware payload", "value": "e259a8b6cada52b3fe28ec5f2902917518e5831a375dafb7793da66d6f28e33b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675371188, "uuid": "1114e185-e381-4ae9-ac91-bc8b00bfc534", "comment": "Malware payload", "value": "379b59ba7c780ad3625dd7e0c5bd3d535c50b549", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675371188, "uuid": "5fd30e23-d9a2-4c93-9bfb-26e40d774a4c", "comment": "Malware payload", "value": "57efa5e74d2b500c38d3a371ab35c6d17655c7e8978051971e8d5c0f3e4184221810392def5cac75109a5ca29cd61ac4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675371188, "uuid": "b17dd244-b260-4355-af0d-f9217e84038f", "value": "T13805D43919761BE6C338F63142E14020B6EEAC936723E959EDE636C14F319817ECE61D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675371188, "uuid": "a66574d3-9157-4ff1-9010-8fefba73b44a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675371188, "uuid": "a31cf83f-1331-4693-8a9f-01cd02876f99", "value": "24576:w3FjseHKNTn7tunA+/kSXIMfmBmC1wLEZkfl4:wFO2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675371188, "uuid": "ec9e5d84-c2f6-4736-9a28-7b32571ed371", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675371188, "uuid": "a3a79384-abdb-4173-8b3c-9ed9ea90da8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675371188, "uuid": "bbf1eb10-30b4-409b-ac87-b9ecece4682a", "value": "PO#198945.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451e7787-a2e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675334110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334110, "uuid": "9c87715e-6d0f-4fdb-88a2-e6db4849c21f", "comment": "Malware payload (Amadey)", "value": "47b0982ff1bb895219a40833c62ae2ed", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334110, "uuid": "5870d2f6-91ec-4e9b-ab80-6f30d358fc07", "comment": "Malware payload (Amadey)", "value": "e29edf9a9be9f66797439ca8e7aba4d97218d1bd2f9eab9c5fa5465ddc754c8e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334110, "uuid": "b8735dc9-a154-443e-a807-35f91b6e9cb1", "comment": "Malware payload (Amadey)", "value": "e52fda3d00690f1b7f2694274acb3d3b37b1ac4b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334110, "uuid": "1d00be30-6a7b-4447-8fcf-3cac32935df3", "comment": "Malware payload (Amadey)", "value": "1bd9fd787cde7a17352ac619a147bfdd9701d44599a8deea5eba4b1baad00be29de9677a379a7fada7ab3dc286e29bf8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334110, "uuid": "9e98874a-f113-44fc-ba22-046fa5d814c9", "value": "T1EF74AF12B2E0BC48E5398B728F1FEFE4791FF9518E1937761224AA1F16701B2C962725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334110, "uuid": "ecd6becc-3081-47f7-bb0e-b993149dd438", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334110, "uuid": "c63e9bd2-2694-406f-9c6e-1c234340ff4f", "value": "6144:sQLlwHv9CS6B0fesk3g5sSyqyO45VtL2nJQ9/CJTk637eQfnd5gieB:dwv36B1QaS0O6R9CJb7d5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675334110, "uuid": "6b67d496-d4fd-4835-9fbc-501ca4c4a9be", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675334110, "uuid": "5783b655-e859-4e2b-96b8-ce8cf3454a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334110, "uuid": "39fe407a-6ec2-479b-9325-ad66244fd3b5", "value": "47b0982ff1bb895219a40833c62ae2ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7fc1de-a2e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675332054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332054, "uuid": "e6cd6061-04b1-4fb8-b3ef-af159dd9802a", "comment": "Malware payload (Smoke Loader)", "value": "fd178725fc7ebd4257d17a823158bec5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332054, "uuid": "678edbe4-0238-4cfc-bf67-ec3903b53220", "comment": "Malware payload (Smoke Loader)", "value": "e2be105f3ad9f7012bb1f4a84b2e2c82aace94d5a50bfcac8d71674556bf4fdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332054, "uuid": "d85bcb04-1b6e-4f68-b723-74d9f120b8bd", "comment": "Malware payload (Smoke Loader)", "value": "81c0dcd1dc7a5936ace3c7036b00c499b54afd04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332054, "uuid": "4435a9bd-d992-40de-a8ad-27657afacd53", "comment": "Malware payload (Smoke Loader)", "value": "138f0cb5c7d50a57aec9c74334d74a73ec1b8c86743eb4451e4664b5c49e92e9a06e98093a7c6993fcbda5e2ecf1cc76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332054, "uuid": "18ac5450-b24c-4879-a58d-80c600d18f33", "value": "T123648E0272E0BC49E5368B729F1FE7E4791FF9508E1837BA1214AA9F18711B2C972735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332054, "uuid": "0661054f-8781-4943-8561-62b25481fec6", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332054, "uuid": "b18d3c8b-29bd-4a4e-aa03-02a7464d5cae", "value": "6144:4xLeK8N9Fwk9We3d7WOHssV9/CJTk637eQfnd5k3B:siNvwk9sOHp9CJb7d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675332054, "uuid": "af6b1082-8005-4086-9f4f-3e0f0a33b321", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675332054, "uuid": "7f0da87b-74ee-4241-ae51-7aaf05879089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332054, "uuid": "0fbb54b7-af8d-4e97-bf48-40c5df79c296", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58ccaa2-a308-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675349439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349439, "uuid": "015a151a-dd62-49d6-be7a-6e90ea384210", "comment": "Malware payload (RedLineStealer)", "value": "382199d48e00e37dc06211fdaebf51c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349439, "uuid": "1c1376c3-abaa-4e7f-b139-94d6e0183f0a", "comment": "Malware payload (RedLineStealer)", "value": "e312f668730c0b43f4c1d8f1c829d1b21cd6c658644a090f49a371da2e87cfab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349439, "uuid": "bfdbd35d-b21e-47f4-af56-2e5c8c075ee2", "comment": "Malware payload (RedLineStealer)", "value": "12c95288bf6b812f9df026fcaa3aa4796cd381ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675349439, "uuid": "51c16e8c-fe90-4b68-872b-e3c43a295630", "comment": "Malware payload (RedLineStealer)", "value": "c7c6c23127a633f8517786ded92c41a419962310de0b7fc7343de0fad7ba5f44c35d54f2e51ee1d20b503ca86f5642cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349439, "uuid": "00bae180-dc7c-4a1e-adc2-eef307dd6988", "value": "T1C0740B887670FD9EC867C47F8A681C24E6636466570BA203B05317ED993D79AFE070B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349439, "uuid": "4d408409-58a3-4f38-8ec6-1847ee9f4eed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349439, "uuid": "f16e14b3-3299-4456-9e72-b8c1839627d1", "value": "6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675349439, "uuid": "5d652ca7-633f-413f-bcde-c3eed8065367", "value": 344978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675349439, "uuid": "bdf67f28-3d85-406a-ac54-ad8427c82f2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675349439, "uuid": "927435f8-04dc-442b-8a68-7bf18c49be62", "value": "382199d48e00e37dc06211fdaebf51c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a84668-a2f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675338950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338950, "uuid": "d29066bc-6998-43de-b39b-e1a5fc05b8ab", "comment": "Malware payload (RedLineStealer)", "value": "a3dcaf54e0494a16b0dd68e469708ffc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338950, "uuid": "b6d3d1c4-958f-4a0d-a086-610f8a7b746f", "comment": "Malware payload (RedLineStealer)", "value": "e3836001f595df6d57192957196962bbfba7ef7b13fad0637b4d6ad3b3f6d243", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338950, "uuid": "0c76d73e-483b-45b3-a34c-b706d0dcf59c", "comment": "Malware payload (RedLineStealer)", "value": "77d1dd2c1c62477867b42ddab727e5e2c8f9eaea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675338950, "uuid": "ce49bdae-59b7-44b2-8e5b-08a2f6cf2025", "comment": "Malware payload (RedLineStealer)", "value": "9fc492b3cbb1034da1be20b30b4616ee3dff0ebf23cc8023703e0f6d3ffa322d23d717498c2fd0d39a7459066a240107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338950, "uuid": "3c97b4b4-43c0-4d94-9e11-197b925bdb23", "value": "T1DC740B887670FD9EC867C47F8A681C24E6636466570BA203B05317ED993D79AFE070B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338950, "uuid": "ab5fd48f-3e30-4043-82e7-962d92e3d54f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338950, "uuid": "7490f5a5-0da0-42fa-af7c-39a49d2f4d31", "value": "6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675338950, "uuid": "293434da-48cf-4f53-86c3-1ee94ce88f1f", "value": 344489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675338950, "uuid": "7a3ba727-ba00-4b17-940f-07ef9bf2efcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675338950, "uuid": "e4553f38-42b2-4708-b1ba-63496b1e8f24", "value": "a3dcaf54e0494a16b0dd68e469708ffc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ad81f4-a2c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (BlackCat)", "timestamp": 1675321092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321092, "uuid": "e901ac74-d0c5-487f-8987-29d4de963d79", "comment": "Malware payload (BlackCat)", "value": "0c4a0c871ebe8a24e8406f351606cd32", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321092, "uuid": "2582fc6c-76dc-4f2f-852d-c4d0cb3144ae", "comment": "Malware payload (BlackCat)", "value": "e3ab77bd18631ec47eeaed44753cd9d55db0db7e5961f486f5963013656dc3df", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321092, "uuid": "7464f320-73f4-411d-8f96-6d12bf36910a", "comment": "Malware payload (BlackCat)", "value": "f73f1cea4f873e9c6c105598f90af40a52a4b613", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675321092, "uuid": "af39324c-d9de-4995-8c95-ffaa699cfe46", "comment": "Malware payload (BlackCat)", "value": "d0efd38aff7ce943ae673fc9d97cc4bdac8492bde84c7280dbd915713cf14bd4132826ed7a80dae09ccacb07925a5e48", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321092, "uuid": "579ab40f-8135-41f3-8870-b6b86f75acdb", "value": "T166C66C96E847E9BDF76E3070B47EB73199E4082850576D7BDE86C8B1A28E7313C4811B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321092, "uuid": "63d04781-261a-42d0-b1de-50c53b6c51d9", "value": "7d614df4d986ee3d7de768c8be4d1b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321092, "uuid": "b9fe2a7a-867f-4e79-b5f7-6a164f37ae4f", "value": "196608:RAzfOpZutBRpns5DV442yHzazu0sGkDEnNffjC:RdpstBSDVIywky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675321092, "uuid": "bc18a005-713c-4aac-96f6-8a344e2efdee", "value": 12280832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675321092, "uuid": "8733a42e-d690-4811-adc0-2918a2a6b7e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675321092, "uuid": "6ee714af-8ea7-4f29-9c66-1622378581d4", "value": "0c4a0c871ebe8a24e8406f351606cd32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575b3504-a2fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675343160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675343160, "uuid": "627c00b0-7220-409e-b5ef-debef3167157", "comment": "Malware payload (RedLineStealer)", "value": "09c390f5acede44cb31b70e8a203329b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675343160, "uuid": "c25458e3-2816-43b5-8d04-dbdcc72c8071", "comment": "Malware payload (RedLineStealer)", "value": "e48aa4847a6413fa389e78a59f80cc86b1e7d38f69a2e2b3290bcbfa5d5bd571", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675343160, "uuid": "c5c01b1b-ec46-4907-8639-93c6b829febd", "comment": "Malware payload (RedLineStealer)", "value": "2d692742608bdc767a29b3527e2b1dc98feb8052", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675343160, "uuid": "2afe411e-845b-4d31-a92b-af606c187b8c", "comment": "Malware payload (RedLineStealer)", "value": "d8a97ba186557f37e24408e882c53588f8bc622d2a359654767529973ebe6c360012ef758c1c5566ace2babfe168fb77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675343160, "uuid": "dfd80048-c952-48d5-81c1-aa2df1f7b0c1", "value": "T14C94BF42B2A1BC49F5319B728F1FE7E4791FFD508E1877B62318AA2F14712A1C972325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675343160, "uuid": "e9577c7d-135a-46dc-b58e-c164d963544b", "value": "20540b45038474bafe70cf1c181e44fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675343160, "uuid": "c08a2451-9020-4f48-b2f5-134c031c5738", "value": "6144:7E4LW1pkkK3plu4EgULE0fiq+pzUvbuOR9/CJTk637eQfnd5DxB:JSOLEgULE0aZpzTOR9CJb7d5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675343160, "uuid": "18d2d632-797c-446c-a2f5-9042983a46e5", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675343160, "uuid": "a1baca72-dd34-49d6-aea5-57e92d5324a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675343160, "uuid": "450dfde5-91f2-4bc8-81d6-63491ecd2442", "value": "09c390f5acede44cb31b70e8a203329b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd51384-a32d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675365341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675365341, "uuid": "679d207d-1987-4f56-b13e-4fec480f6a31", "comment": "Malware payload", "value": "39f3c510f46d605202844e35c07db84b", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "toxicnetarmy", "colour": "#2DF4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675365341, "uuid": "827f580f-5e23-4c8e-9c16-65cb626449b2", "comment": "Malware payload", "value": "e501319e9297fb68c79bdc32bada702d6f38f14ae3cd66e915be0aca98a83c82", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "toxicnetarmy", "colour": "#2DF4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675365341, "uuid": "4fa69c58-1671-4caa-b5e0-af6815ec320c", "comment": "Malware payload", "value": "8fb4f21a601abf2a3bd76a299e57d41086b186cd", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "toxicnetarmy", "colour": "#2DF4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675365341, "uuid": "ada5f7a9-3d4f-4847-995f-ceb89d1f4216", "comment": "Malware payload", "value": "e2a6b11c70d01bca4b5bd04fca745dfc93e7a361ae4e566efcf773f480ddacfa1329f67f2286a8387baa2d86ead55e2e", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "toxicnetarmy", "colour": "#2DF4FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675365341, "uuid": "7ea14ae1-e325-406d-934d-831dac7c894c", "value": "T16CB2C6E74500B58E9D13A8BFB7AC3EE16452EB4FCE869A44001DE82EFBD147A571C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675365341, "uuid": "544128e3-7b7d-4b29-99e6-941e861b5daf", "value": "768:tqFJYJsu1hZTd2pkdpm7N5xz7LEmB4UP+H8:tY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675365341, "uuid": "171691cd-2b56-4efd-856c-e99a98bc1332", "value": 25665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675365341, "uuid": "cf2f0c6b-8348-4fb2-9cb2-2334bf9ca2a0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675365341, "uuid": "9066e86e-ae0c-455d-b304-69aedd111b58", "value": "dump2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5b4bfb-a2e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675334711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334711, "uuid": "b981388c-51d7-4da9-95c9-0e4075a68a78", "comment": "Malware payload (Amadey)", "value": "fe130e255a344c317937989e14f998bf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334711, "uuid": "36f99cd1-f14f-4272-b289-2a21136e55fa", "comment": "Malware payload (Amadey)", "value": "e58abffa4b6d1463c1a9e19dbc44dd1c61dd6b52e1c4f3dae532a51bec2a62db", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334711, "uuid": "e10f95ca-8229-4455-9dd0-1d972ddefc03", "comment": "Malware payload (Amadey)", "value": "35073ddf5b2a83394458e8d646639201f83f2a6c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334711, "uuid": "f2fc8fa0-50c6-43f0-b5ed-1a539667291e", "comment": "Malware payload (Amadey)", "value": "3c784c983cb71a7bad4dcc7b13a0566eb104befc5c6a262990b0eeca6b62a1ae4f6b0de985b138f205459ec55eaa73df", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334711, "uuid": "7189eddb-bece-4609-be3b-555a93f5e50e", "value": "T1EE54E02379D8C373C0E650745C2CFA956BBDB83145759A477B9806ADAF70BC0263A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334711, "uuid": "242c0deb-2419-45f2-aa04-757bfb6e9df9", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334711, "uuid": "7b783903-b770-4845-aaec-d349608edd42", "value": "3072:NpCN6TSbyxCVkAWOLxMbWjq581V91jpvEAKrgxshN2x0GWY+3egp5IUkqaz2ynPi:Np1qPXLxMbq31VH5Edu0Gd+9CaoYQh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675334711, "uuid": "1f737653-ba07-4adc-9409-a201fa69ae2a", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675334711, "uuid": "d87c7a55-804e-4930-b651-f2fc1bf90b86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334711, "uuid": "8898d331-f72b-43ff-9492-d03b89032a81", "value": "fe130e255a344c317937989e14f998bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2f854b-a330-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675366304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366304, "uuid": "97f6122c-b7d3-477e-aaba-db189fe93c8e", "comment": "Malware payload (GCleaner)", "value": "409a4e89a91081bc279837b8c5658bb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366304, "uuid": "53ca77f9-7e22-4028-9b70-3e7eb53dc5bc", "comment": "Malware payload (GCleaner)", "value": "e5aa848d2883ddfe4fcd3f2fe468386f6e7aa8467aed89462ba5e6e067c978ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366304, "uuid": "fef7196d-aea4-43cf-8416-ebde2ebb7afe", "comment": "Malware payload (GCleaner)", "value": "942136a9dcaff5c8e327162a66323a393d990a81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675366304, "uuid": "a13360c8-9c9e-4431-813b-0adc231ec1f0", "comment": "Malware payload (GCleaner)", "value": "6c3d2b5bc59f31868f9f464b708ff921bf8f8dc836cd29da27bcc449a3f8d2ab6d45c0e934a60274417c7528e031d732", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366304, "uuid": "85fbe80a-d029-4c24-bb70-43e8c84d28e9", "value": "T174A53323B5935033C2C7A77E9D38A178B97A792118F8D61434FE931D4A272CA703DB92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366304, "uuid": "f1c19361-85de-4223-b250-a290e1a663c2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366304, "uuid": "0081dcfe-0647-416c-93ec-61660196ee0c", "value": "49152:bgzwt+t68TyemS1thJ4yFoln/7rVCHD0JVBsBdtP8WWAjgh9LCgv2MR:cs8TyUt7V2zrQf3aQjgPv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675366304, "uuid": "dd7aa21b-1a03-4d83-85b1-489c16d0f528", "value": 2126474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675366304, "uuid": "26973f57-1a1a-4215-a558-21f594fb1a3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675366304, "uuid": "7444a161-889a-4c3f-ba04-6c4bef208d67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94c1aed-a2fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1675344721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344721, "uuid": "1c342184-fa52-4840-98dc-c6fd9eec9837", "comment": "Malware payload (TeamBot)", "value": "38b86ee8bf85fb6b8412befdf3434766", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344721, "uuid": "e3062aa7-acd2-42b9-8318-5916a33c969e", "comment": "Malware payload (TeamBot)", "value": "e6ce46a25611f9caac0d982d6fd37c633d628ba61b70fefe314c89c3726b5025", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344721, "uuid": "eb560b06-b496-4b8b-87fd-8fe17356e4c1", "comment": "Malware payload (TeamBot)", "value": "fdb644e7793f5288adf480958e0577c7d990f9bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675344721, "uuid": "d065de5e-2d6a-45ee-b53e-f1094f892848", "comment": "Malware payload (TeamBot)", "value": "16b8895811170ed74a9ae8dc1b74d240b7f063641fdd69e93994e04aba4cf939c2a13782d4d26b879ee01938859396e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344721, "uuid": "117791b5-ef20-4bf4-b228-d79eb8c95c83", "value": "T125548E52B2A1BC48E535CB728F1FE7E47B1FBD508E1877B91318AA2F14F11A1C962325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344721, "uuid": "5114a865-06b2-4e32-9992-03d4832eb5d1", "value": "20540b45038474bafe70cf1c181e44fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344721, "uuid": "8f88c879-9871-47fd-b6cf-6accc680e604", "value": "6144:PTLzIY67FdoC+KWpGHoCroyB809/CJTk637eQfnd5BiB+:73cZdboCrHa09CJb7d5Bj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675344721, "uuid": "aad96299-5b04-495a-840d-320596fecb63", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675344721, "uuid": "6201c0f8-adf2-4a3a-9816-6bb504cfb32c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675344721, "uuid": "ab5c36b5-dfe6-4c4f-a90f-539786428ad0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fdd11bd-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675337242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337242, "uuid": "570984ec-4ab3-4c7c-b61d-087ab0a5b024", "comment": "Malware payload (SnakeKeylogger)", "value": "87fff477c26046802651bc15d96443db", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337242, "uuid": "a8f5f141-0e4e-47d4-a4f2-25fc75fad8e7", "comment": "Malware payload (SnakeKeylogger)", "value": "e74e69598f5855a03d476602cd4de3bb4df94898c3659519c1ad31e70df12f28", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337242, "uuid": "9adca2b3-7871-4de2-8c48-96b623673774", "comment": "Malware payload (SnakeKeylogger)", "value": "68b90604e68e2598fc498ba8bfae0ddc353f4c21", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337242, "uuid": "fcaa965e-fa2c-498c-a1c6-46483e0e3de2", "comment": "Malware payload (SnakeKeylogger)", "value": "b90a04581066a09f8cfdfbacc4f4043fe53699ed474a5b0cedb18e2bdd07735f3ef7efa77cb5d0b0fffd2917cf42b198", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337242, "uuid": "d2abcdac-6e06-4405-9b3c-a1c251dd651d", "value": "T106037F5AE79F02A9CB5512B3271A0E8896BDB33EB3145471346C933433EDC3E46A65BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337242, "uuid": "3a34c866-a898-4185-a6d6-29a818f3b061", "value": "768:TFx0XaIsnPRIa4fwJMbRDdkLckgOKdWQlXOG3pKgVHVbyv:Tf0Xvx3EMbkLck6Is3pK6HlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337242, "uuid": "069e3221-0afe-41c4-8f9a-e1bdf1d7e1c4", "value": 38672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337242, "uuid": "8f129f3e-f0cb-4928-8336-2fa3532ab7fb", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337242, "uuid": "c27161e1-f5c8-4798-9131-47243619309a", "value": "mpom1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99160be5-a2e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675332104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332104, "uuid": "2fb54c22-0f66-4f9b-b7e2-6daa110eb6a8", "comment": "Malware payload (GCleaner)", "value": "7310e7daa7a490f6c3705364b9426ef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332104, "uuid": "9f49aa87-c249-48ef-a589-166891485c36", "comment": "Malware payload (GCleaner)", "value": "e7d440880b3f791f128799e61781d1f8b4d6e534874329084c9876ea9e84fbb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332104, "uuid": "4a73dd12-00c8-4df5-a503-bf0df62fde71", "comment": "Malware payload (GCleaner)", "value": "7319aa219b7dcdcc30b492cc4533f2c162888acd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332104, "uuid": "955ba00f-8d14-4088-acc7-eca60455bfae", "comment": "Malware payload (GCleaner)", "value": "7582dd20810e7e9201f3c690fad3ab08fe8663e6359326b1ecad0f5c14a0be162d3b863d82c8adf304137d05afd9bcb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332104, "uuid": "b141d705-cacc-45eb-9ef6-f269081d5622", "value": "T130A5330AB521D834C4E2C7717E724E96F7A77FB1487C4270706EA08E4F763B9A856B48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332104, "uuid": "312a84b2-b54d-4f84-b7c6-d15cd1ff952b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332104, "uuid": "a796234c-60d9-4a90-a884-420e616eaf7c", "value": "49152:bgPiKWTz4FDNia6fWeCLkICRD6QijDi4SYaGLCgv2MR:cPhYiRuNCfcD6ljuaa2v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675332104, "uuid": "f07e9a11-721a-4e18-a242-190086e67856", "value": 2073545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675332104, "uuid": "6aa989b4-288a-49ce-a07f-0f65d28321d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332104, "uuid": "171350da-8ec1-49fd-90f4-5c10e68ab935", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfdeb80-a33d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675371919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675371919, "uuid": "1306fdee-dd1c-4f17-8601-9c26f7e7ca86", "comment": "Malware payload", "value": "c8e266c5532f592525f77d7751ff94cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675371919, "uuid": "5c359fd5-2c7a-4d37-91b2-cd066fc823a4", "comment": "Malware payload", "value": "e7fd6d23b75d0d2732db9a9e937bb7e7ed595ee3e52240f7b6dc3c03a9314270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675371919, "uuid": "aeb51fcc-129b-461b-83ff-1bcfd3288f07", "comment": "Malware payload", "value": "8a61a823d274be35af5a0ede203b7972c57b77c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675371919, "uuid": "2637ef38-0b63-4b71-ad9d-650ec6fa6d0d", "comment": "Malware payload", "value": "83604db5f88dc2919c1a227f96b0f2440790d04ece2f355daf2b9ee55e96182cebe4d882b1885bf03dc5c1f8f3612aa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675371919, "uuid": "643efbc7-4ce4-4f2b-ab98-17b221aa7491", "value": "T114E4E63D19B617E6C338FA7186E18430B6EE61923703F968DDE65AC14F02582BECE51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675371919, "uuid": "30841d41-7ea5-40e3-94ce-7b775b4a680e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675371919, "uuid": "a82b6933-a6c0-452d-978b-f98a659732aa", "value": "12288:/HP+C+2SlLVseHKNTn7tunA+/kSxyljwXqErzq3d7wonnWYH6vJ1kK5lGx4pS9EJ:/HmjseHKNTn7tunA+/kSxQKqWONVWYaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675371919, "uuid": "21899a98-98aa-4e4a-9069-a156225a8c1c", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675371919, "uuid": "b649c676-7521-44f6-993e-4485129c1194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675371919, "uuid": "e662f429-e41b-4284-99c0-b0b298e75379", "value": "Fwd Reg Performa ks-13701.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c77dd7-a2bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675316454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675316454, "uuid": "bfec2220-1e6d-4c22-8db8-99245a23b108", "comment": "Malware payload (Amadey)", "value": "b9e01b237c8a402cb98edbd4d0a8d61b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675316454, "uuid": "4c48ae0b-81b7-4953-af03-824245e7cd26", "comment": "Malware payload (Amadey)", "value": "e802c5e497c8c13284cb953ada2a48e868dde61d009a4ced2e7c04a255f38b79", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675316454, "uuid": "41ac5a1a-d9f5-42ec-ab70-a9c4fed941cc", "comment": "Malware payload (Amadey)", "value": "7f8b086c36e175eaea56cd72169561454683d011", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675316454, "uuid": "df8d1253-cd8c-4684-8626-432ab7812cd8", "comment": "Malware payload (Amadey)", "value": "d966bfe620ebc9ffd66db8c1d39c15e43400fa2f899a959d78ad7bf9c10b744b6b4d90ac1fdaccea6e7a2f5a94fec8f9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675316454, "uuid": "7752676f-1ecf-491b-a9d3-749d3f69d919", "value": "T13E64BF2196F0B9D1E722C732AE5ADED4753EF444AE15EE173307A60F2875AE2C522313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675316454, "uuid": "6bbf192c-66a0-4bde-8579-c9e16ad2e69f", "value": "2c380dcd822439dca6dd27a0d1073060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675316454, "uuid": "db43ff4b-448b-460d-9046-4ff1cad65568", "value": "6144:PLVO2UnFXLoGkvQDm9RwZVGM/JwIqA7K7Lu55u:PpPc0GkvwmPIKd52/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675316454, "uuid": "c35a0a44-70a4-4014-ac05-3bf473aff252", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675316454, "uuid": "85a4daf4-8461-4cb0-b444-af510157b600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675316454, "uuid": "ebfa3399-7f06-404f-a280-6dbd98bf18d3", "value": "b9e01b237c8a402cb98edbd4d0a8d61b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520db1e1-a2c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675318670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675318670, "uuid": "84f505d8-abb3-49f5-8a70-c4111c01f110", "comment": "Malware payload (AgentTesla)", "value": "a7d5851b9ded14ee6d2d133c5813e3a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675318670, "uuid": "69b34ed5-bab5-476a-adc8-7f0186cab72d", "comment": "Malware payload (AgentTesla)", "value": "e831d5af4ac2bcf00a87f26ee849066a4b0ee82748370f192d2dba50489d15a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675318670, "uuid": "eabd3df1-6793-4586-a694-8febbb3185a7", "comment": "Malware payload (AgentTesla)", "value": "4846ed8113a663147481c1180d6706ce9b954e1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675318670, "uuid": "5f1c2fb1-e1f8-43ad-afa1-15783403f9d5", "comment": "Malware payload (AgentTesla)", "value": "212d3d8e5a8b07b7af9d22e7f926259188e4bcdbd65c94a87ceb205d832f986e491f1d05ac571b5a705afb45207823b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675318670, "uuid": "29eeb854-5688-44b1-8f66-512aeccb4d5c", "value": "T11FA31F1893EE5E23D96AD7781953F2722735CCA245A1C7071EC8ADA73F5BB822E100F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675318670, "uuid": "09f1455c-8634-4793-963a-c86b9e8f05ce", "value": "768:TcvRNB6jExEExJPuMWf7xkQP5NbcVfup+btYAJHa4H:TANB6qEExoMWf7macVfupotYyTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675318670, "uuid": "6efd32f6-2ced-41e8-af20-3731fe827bf5", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675318670, "uuid": "aef3e0b7-c3b0-48df-8a11-a1a592e0ddb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675318670, "uuid": "f4eba651-8c5c-468b-9c14-6ab0a682138d", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c94081-a29a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675301824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675301824, "uuid": "44795584-1016-4918-96ba-e8f446b16440", "comment": "Malware payload", "value": "223599f81ce488e70b81a0b28d1b237d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675301824, "uuid": "4831f212-9473-4122-b7db-038cffc9fe3a", "comment": "Malware payload", "value": "e8aa2d962038b1e876cb55f653fcf200fea91491e60fba676f92c6fdbf9abb38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675301824, "uuid": "756ef8c5-e7fe-451b-97d6-9ec9fbfdb85c", "comment": "Malware payload", "value": "0a0857ea75ba26962e573e3bb265d51a77936abc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675301824, "uuid": "00f752eb-a6e8-4422-bdbb-8103e7f3305d", "comment": "Malware payload", "value": "95ab4a7900bf8c84bb60f7ed49ad2568438788e4ec5d25b92409e0cee667208f6abb3e95c40c3c4414050fd1d13cdf92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675301824, "uuid": "9be1c4dd-05ee-4d12-91d5-9f307eda4faa", "value": "T134D48C12B641C13EF47304B68FBE966D95BCA531072A24D7E3C8594E5F62AD37E31223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675301824, "uuid": "4476388b-fef3-4c32-8e61-8bf03912cdf7", "value": "d307c576d17a804bf7f52c8a306e4640", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675301824, "uuid": "787b7c44-f608-4d4e-a005-18ae36cbb218", "value": "12288:GnK1wHb7ddtD2Uzr+vA94tjJMt+3qWv4RsBskOY21qtHGIWPUyZCwFoXlk:SK1wHldLH+1tjQSqWv44tFrwZzou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675301824, "uuid": "d964384b-b927-4716-80f0-d5f9022630df", "value": 641144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675301824, "uuid": "0b543487-7d84-4a59-bb08-c90a786f7579", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675301824, "uuid": "8985e8f5-6c87-4cca-9767-28a0876a0b72", "value": "e8aa2d962038b1e876cb55f653fcf200fea91491e60fba676f92c6fdbf9abb38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a92188-a2d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675328013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675328013, "uuid": "fbdfc0d5-44db-4dc5-8cb2-a6171d9cabf0", "comment": "Malware payload (AgentTesla)", "value": "26294e2a97e5b9395e210f88207a717a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675328013, "uuid": "de7a18e9-1980-48ff-a98c-fb925c265d6c", "comment": "Malware payload (AgentTesla)", "value": "e9555275296d98ff8955d87ee78bf39cf1f3d54e6ca04c8f453bd915e34c2346", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675328013, "uuid": "5097b856-2c42-4379-81c7-3cad89ce3bbe", "comment": "Malware payload (AgentTesla)", "value": "61dce40719d0d89284f7364db2f51dd72684b41f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675328013, "uuid": "435dff29-7d2d-4e94-a612-ebc27b8c5aae", "comment": "Malware payload (AgentTesla)", "value": "55a9e04cb5847188f9be6393a3141a93f6b3e9737fd19917fc6eabab64f3f38992ec2a8eb94361a77225285e24596c73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675328013, "uuid": "266222c2-0266-49fb-a554-31f7093a3cee", "value": "T1B0158D9737B1A8BFF687407154283F886FA07113BE46A25397373AC49B098FBB798151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675328013, "uuid": "f7f810bb-40e4-4f73-a3b5-55078541b17b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675328013, "uuid": "705996e7-1fa1-45f2-a0b9-4335f0c8494a", "value": "24576:3N106F0/N1OWF7CgfvXZXy6RJDR22+IpnpmMpqG4yPa:dW11jQgfbRJD/nrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675328013, "uuid": "52d14ebd-564a-4a70-9076-157895901f3a", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675328013, "uuid": "f46592a3-c943-47aa-9d57-f842b3b733f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675328013, "uuid": "ac2f6906-d97d-46a4-97f7-a43589eaff71", "value": "FedEx Invoice_2334174712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159e96f2-a329-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675363237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363237, "uuid": "b8e4420a-7bf5-4996-9394-ac4e87258569", "comment": "Malware payload (Loki)", "value": "9e1935a47f0fc0de66b4a98556336d46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363237, "uuid": "3adf33c2-8ea2-4070-a95a-a7b7c0a82a7e", "comment": "Malware payload (Loki)", "value": "e973ddbe5be12de3bb6c48532e99abd8a5e9b44b084a388c89690309c7c38da5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363237, "uuid": "11615c6f-d298-4cd4-8f3d-59fd22df9ca8", "comment": "Malware payload (Loki)", "value": "8cacf3fa719e158213189b0ec89f8813c4d21297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675363237, "uuid": "d444a812-bfa8-4f47-8d41-5565c34aaaaa", "comment": "Malware payload (Loki)", "value": "3fc315b96aa38a05041eb8f3e6a7fef939910a3d2751b0dcb834b8c935ffedf213132fa58d8a46ce86d4579527e5d813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363237, "uuid": "b650fb0b-1172-4f2d-bdde-b9b4e61ab69e", "value": "T1C2F47C9377B19873F68B00B5142877CD2FE07603BE95A253AB7B7AD097118FBB298141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363237, "uuid": "a6e25a70-0167-4725-a407-eaa14da45bd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363237, "uuid": "50efb009-2375-4b21-82a6-0aab27759719", "value": "12288:f2iNZlSE+AB6Fy2Mxz0hAy9yVrNgFW9zktGU83Sg43pqG4yPa:f1dH+AB6F0x10yFFVktGz3tYpqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675363237, "uuid": "9d7bed5a-5111-4073-a437-97365e30d1fb", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675363237, "uuid": "829d8d34-5ff4-4c7d-8da3-c161dffde562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675363237, "uuid": "efc13a74-8ef5-4ab5-ac49-3619e12e38d3", "value": "n\u00famero de pedido 675432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1861137e-a348-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675376556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675376556, "uuid": "241bce28-0dd2-4a96-9b59-1b1515f7097c", "comment": "Malware payload", "value": "7685428e0271f9568bbaf467ddc97f34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675376556, "uuid": "5d7f3164-b2bc-4eb2-bb61-d3e6b9276d5d", "comment": "Malware payload", "value": "e9781fbbb95728a77ea746e0cdce39d9e2975acc021c88d30ae9b7565ccba78a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675376556, "uuid": "0d0acc88-e21d-4172-914e-01dae1dbd587", "comment": "Malware payload", "value": "706ea6bce96e7a232d8f29e804f6379199651601", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675376556, "uuid": "874bb21c-8c05-4b9c-b928-378f42713bf0", "comment": "Malware payload", "value": "bb8c103a477b2c9ae4ac2db18c36fe9b294c29b5966a4ecd3cd0a5c256dab8c9aacd44d06b726fed373b163c749c17fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675376556, "uuid": "ac7ec5ec-a766-4c4c-a5de-3e0fdc25fd75", "value": "T121763385B1D01CF4C1570EB09AAA7FE491B59B115B12187B7FE82F1C093C6AD922BF63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675376556, "uuid": "988664e7-a687-4bc9-a19a-8dd8a70ca823", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675376556, "uuid": "13fe470d-9a8f-497d-bba4-04cae3446d19", "value": "196608:91OdFaGQboT3nbF3ZatZKznacHonqLk83smHCfnRIys:3OdF79xcniHHonqH8mHCJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675376556, "uuid": "26d8f905-5884-433c-bd0f-b543e06ad82b", "value": 7637311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675376556, "uuid": "db594f97-da4c-4e91-b117-2d1432d8971e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675376556, "uuid": "4f43a712-e317-459a-a174-b8d76db9e66d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ce3f8d-a2a1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675304953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675304953, "uuid": "7df81689-527c-4ef1-96b5-b0dbc65c6035", "comment": "Malware payload", "value": "5db9c9ef5d4d5d385a248364d867df17", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675304953, "uuid": "72e60ab3-9762-43ed-9561-22d1952a56c5", "comment": "Malware payload", "value": "eb11e5ee7b81d485f871ea938d1dd7a4882feac6a53c7c69e687e732fde92003", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675304953, "uuid": "22c6eed6-5014-4f25-bd6b-43679838007c", "comment": "Malware payload", "value": "12b255036ed20285c7ed04e46c1a8274ec552a96", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675304953, "uuid": "5f439f82-5a4c-46b8-b0a4-c3322e5607b2", "comment": "Malware payload", "value": "f27b295f602bf744e40e408b260282f3d6a7ee57af65222dba0df1d4520ba59a495858ce971157d18f1bac0fd49a66d4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675304953, "uuid": "007a4ac0-3cb2-4c7e-a754-3064707fd528", "value": "T1B82733A71C0698DAC432A035497F2345B875CA1E3DE36B221044EBB7D5F3965CEDAEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675304953, "uuid": "6e71bfd0-8cf2-484d-9a61-7b1ed5938d53", "value": "393216:sJGssJA35z7A79L+xaJ1mbgafiubciZTbrT9i/zVN2I+TXKtqKpPbNiRSKcsAJ1:yaJA35z7c5B/mbBffc4TBi/zVN2IkaMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675304953, "uuid": "df3bfd97-b643-4f4d-9209-69e8f1ab00fa", "value": 21502803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675304953, "uuid": "9ff65ca0-f350-4a1c-ad4a-3483fb8e6348", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675304953, "uuid": "8e9125a9-e4f8-4f62-bebd-1032c9effdad", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036a45c4-a2dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675330564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675330564, "uuid": "ea6fedc4-a032-466b-b201-d0217f502283", "comment": "Malware payload (AveMariaRAT)", "value": "9b0c7f10c6fef6d28e107610bf7ca89c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675330564, "uuid": "897895d5-0bfd-4166-a65e-f67655366657", "comment": "Malware payload (AveMariaRAT)", "value": "eb1649abd90cf1e6bef505656bf715a3a10549840474b31ea7221ae19e1de55d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675330564, "uuid": "a6152d91-3310-4afd-a6f8-323ad1a5e217", "comment": "Malware payload (AveMariaRAT)", "value": "9dcedbd59ed5d25292bbc2266cca93b408f59e84", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675330564, "uuid": "52eb7d04-5766-4e09-835d-203062f5aee1", "comment": "Malware payload (AveMariaRAT)", "value": "74616cea42e32b8bc890397c5b5741387ed5b22a46b9b5be931c36a55f73cf12b8f3f498c3bf1369d1667cfc50bc19bc", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675330564, "uuid": "9d4629ee-a7a2-4c9a-a1b2-989e56993e54", "value": "T19EF46D8737B1A8BFF68B407554283F8C6BA07113BE46A253973739C49B098FBB798151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675330564, "uuid": "f0ea06f7-871a-4d0f-bca8-3020f818d50e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675330564, "uuid": "6ecd7e75-ae39-42d5-8182-095c399e339b", "value": "24576:viABAsHiLO/ETSfx42dQxCo6F0xMpqG4yPa:H7HiyETSu2iaWiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675330564, "uuid": "8a426717-4b07-4186-b3ca-aa5df128b313", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675330564, "uuid": "1322b5b6-7b29-469d-8932-8e998b316256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675330564, "uuid": "d61344a3-2373-4660-a31e-b1da31379b03", "value": "oqMoQagzP8VKz43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4addd5c8-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675337127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337127, "uuid": "ec21fae2-2038-439d-b66d-4a5ab7b867ea", "comment": "Malware payload", "value": "827c83f08d1c139e4b6698bdcf386da8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337127, "uuid": "96ccc148-22e3-4aeb-a84a-572e9974dbce", "comment": "Malware payload", "value": "ed56943310c6b8cc5120a609ff47e087bf30fdfd65fea08d97454075d0a625af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337127, "uuid": "05ee8b2a-421d-4661-a265-88689d5aad37", "comment": "Malware payload", "value": "21ef72b7a8b221741dcb28eec8b99fc26e8e1513", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337127, "uuid": "3524b625-d3b2-40cf-85dd-9ff276fbddbd", "comment": "Malware payload", "value": "2f001c1dc773ff4c19b56dbb518a821d4025bbc06139e269361db876bc6071017e384de24ef2b44693521a2489945c06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337127, "uuid": "0545078a-8e63-4f7e-baac-220757b8dc88", "value": "T12556331033B004D5FEB7883ED892452AD9957016A729E39F47A8C27A1F2B3D25E7FB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337127, "uuid": "2fd92e1e-7279-4640-956c-b5688643a9ab", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337127, "uuid": "1b4da93a-b2ee-4c05-9b54-61b73bd21491", "value": "98304:Q9VHpNjc2uW5MI0ZeFahftplflf6dUwOEH6d8e6nr2ZF930P0RwTJ8skNLh06q:QnHfzL2VZTNfwZHYYnr2RE0RwT2s0F0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337127, "uuid": "edb9d1f1-40d4-443c-a316-4098cb98e114", "value": 6215353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337127, "uuid": "dd9c9fe7-0048-4b96-a399-a618bf96a3cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337127, "uuid": "a76c391f-21c0-4a98-8af8-63cb3cc204fe", "value": "827c83f08d1c139e4b6698bdcf386da8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030f1bfa-a2d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675325839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675325839, "uuid": "a2ec2ae8-b85a-4a7e-8a0d-20d93ecbd439", "comment": "Malware payload (Formbook)", "value": "c18c92beacd7e92b9881eb2d8a56d2ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675325839, "uuid": "1a88232c-c2e4-4163-9d05-6a4281a4d6ed", "comment": "Malware payload (Formbook)", "value": "ed5c5ef5186a78d9dd02e7dbf36b0bcc9d6c0e733f04a6780f6bcf06dbfc3338", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675325839, "uuid": "f8b5c0c3-3e8b-4a8a-a295-54e7a8348750", "comment": "Malware payload (Formbook)", "value": "ed42c80e56dfb719435cc58919758a195341055b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675325839, "uuid": "26e3f664-dd82-4699-9509-907d295547de", "comment": "Malware payload (Formbook)", "value": "2e4225123fb9fee2188e0992da5dd64c521b2c58f8e1ab85820f76226c628fa25ee9bc52d1e85fdea034c88466d7a03e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675325839, "uuid": "650be003-eca6-486e-9b8a-85261cf6f26b", "value": "T10FF49C8777B19872F6CB00A1142837CD2FE07103BE95E267AB7B79C0A7069FB7698151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675325839, "uuid": "45484d10-7d08-487c-8b64-f7acdcc24315", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675325839, "uuid": "2ae2f2d2-7fab-4638-b5b7-392d416e94bb", "value": "12288:3tz8L6gu+xMRSR5SEtKypyE4s09JtWsJIPg8zLvqsEqG4yPa:CLzyRU5Zp74so3WaCTC1qG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675325839, "uuid": "8ce95c43-617c-4cfc-9521-f3e8163f4756", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675325839, "uuid": "92dc8334-55ea-414f-aff6-3d1d22437ca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675325839, "uuid": "760233fe-08b4-4ee6-bed1-0c8be5d86e71", "value": "REVISED_.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c96d78-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675337274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337274, "uuid": "e3e792bb-58c4-4c5d-9c51-2d686d73c81a", "comment": "Malware payload (RemcosRAT)", "value": "cd72ab019849fafd5520923dbf6eb171", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337274, "uuid": "7cc4c073-05d0-4816-87f5-5529a4090c65", "comment": "Malware payload (RemcosRAT)", "value": "edce5dbfb898a647b0c7065a87a14c62a28f3bb95912ff842a23ba95d488fb47", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337274, "uuid": "862204eb-1453-4be5-a0a3-4c8bb899719b", "comment": "Malware payload (RemcosRAT)", "value": "d43e9b7d3bbc750e88eea97814e2a6bccebffa97", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337274, "uuid": "3fdc5383-8669-4b7f-9ffd-6231a24ee716", "comment": "Malware payload (RemcosRAT)", "value": "dfbdfc1cae7c8ce38e520baa0a0076e5f24caa221ece1fcdb2ea706e8f26ad60ec9a753ca95eca33acc635085b292670", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337274, "uuid": "4191f0e2-dfce-46ea-b3c1-c881193b3e94", "value": "T1D755CF9677F1E8BFE597007404243B885FA07943BF06E353933B3994DB289B7B698161", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337274, "uuid": "91374925-1cbd-46a5-a7a9-31d45d7a49ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337274, "uuid": "1ae0fc3c-0046-40f4-ac04-efa50e56e104", "value": "24576:SyR6F0xW0P48XBWIU/Rc3YrGT7ydRKw8GtGMPlApqG4yPa:8W0648XzUJc3YrzdRKw8Y9PlAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337274, "uuid": "dd9a0079-eaec-4c96-80e2-d6982ae6665e", "value": 1304576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337274, "uuid": "c2d8e20a-fe53-40cb-b5bf-9a0fabea94f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337274, "uuid": "c1b31cee-4ee5-4ff6-bbf6-e80a2db07161", "value": "DHL Shipping Doc PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73bcf66a-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675337195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337195, "uuid": "6d2adce4-3d91-4b16-8fd9-c2eac2397729", "comment": "Malware payload", "value": "b10b82e41cb8a7299dcea2d9ab902d3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337195, "uuid": "d20ff015-2b4f-4f2b-9c2d-ca354b624167", "comment": "Malware payload", "value": "ee5975e74e4d8924cfd7932c1e0d0be686ea0cda005a3596e6f8feb3fd2aefc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337195, "uuid": "c617b36b-34e4-479f-8184-5c3fbc72de1c", "comment": "Malware payload", "value": "eed68f8953d86e6ed1585d331b48438b5990c111", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337195, "uuid": "1b871bc9-15fb-44a6-bd6f-07a1e2bdfb3f", "comment": "Malware payload", "value": "22dde6ad163e8d97d24af8a81c92d06d2667e6fb5d3348de492f645daa35e4177dc8344c0026fd14f2e95739b354fa58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337195, "uuid": "5bf05584-2bb5-4207-918b-504f83debe6f", "value": "T1EA86E117ADB9CC2CC9A384335092C397D20AE14DAE09DB9F13B11945CEF496B5B12BED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337195, "uuid": "22b71e14-02d3-476f-95ff-2b57039ec078", "value": "c6e51dda1622035b42b177c9afe67c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337195, "uuid": "954f8212-a59e-44b7-97cf-1df97a7d810d", "value": "196608:WKDNr5q8bhV8dkwDsaoOxXJOsmR2KV8owfRffhhvizcjcrh:WKDNFdbhV8d9ZzJLmRHV8oOZOUcrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337195, "uuid": "0d2f7f1b-d5e5-474c-9929-feca7ec953e1", "value": 8283018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337195, "uuid": "dd45e1b6-3e03-4c4e-997a-fcd9fa879d49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337195, "uuid": "a0d5d18b-83d3-459a-baa4-97b551cba698", "value": "b10b82e41cb8a7299dcea2d9ab902d3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746689ed-a30a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675350081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350081, "uuid": "c6df6510-f95e-4a86-994c-864e42bc58c3", "comment": "Malware payload (RedLineStealer)", "value": "5e800ea090d56c70688e8dd28c20e873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350081, "uuid": "7855e689-f7eb-4373-842f-ea872a2d1bd2", "comment": "Malware payload (RedLineStealer)", "value": "ee833fc2248cb93a2b6b2090808c2c9dfc63ba3b7742c4f8269635411030f7b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350081, "uuid": "517a16de-6f0f-468a-b51d-f7978cb51400", "comment": "Malware payload (RedLineStealer)", "value": "1c485c7b957131e52e0a487489c0f2f6a25de370", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675350081, "uuid": "cf567628-ebbe-43bf-9e43-1947633b1fc2", "comment": "Malware payload (RedLineStealer)", "value": "eff3b756f9e112eb86adce39507bbffa3c7495767c548c4ab198c917a32b86be026636c9b1062435a144c21194d84b1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350081, "uuid": "3abc15fb-e8ce-43d2-b077-ed9dfc715432", "value": "T1CB94C042B2E0BC48E5358B739F1FE6E87A1FBF558E0833762214BB9F14711A5C962325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350081, "uuid": "ad76b714-d4ea-4d61-a5d5-b1ba7e09ec7e", "value": "e479a558a3a55c2bde918dd7ce07e020", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350081, "uuid": "f485988f-519f-4519-b3ed-14edb91b5c26", "value": "6144:xhLNwrfyMnqT65BSZhYaiEOV18eLy+CeEEr09/CJTk637eQfnd5bkxWBD:L5eUbOV1/Ly+xBA9CJb7d5b4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675350081, "uuid": "512f4834-79a6-4f1a-9d52-2a6e10c1f08a", "value": 418304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675350081, "uuid": "9a460848-186f-4456-ac6c-12d1e21da191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675350081, "uuid": "c199caa0-f49e-43c0-8671-c879d7b81a94", "value": "ee833fc2248cb93a2b6b2090808c2c9dfc63ba3b7742c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348c975f-a2e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675332365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332365, "uuid": "6226fafd-4bcb-4acc-bf30-84e3e28e1f4e", "comment": "Malware payload (RedLineStealer)", "value": "c95d602a3148b01226ecb66c0cf833ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332365, "uuid": "5fa0f328-6025-4878-8f41-16670051ae28", "comment": "Malware payload (RedLineStealer)", "value": "ef3fa7ccbf35dec0f93f5b2605227192e68bf486d5a646faafbca6cb33286bad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332365, "uuid": "4ee6b01e-46a0-42e9-ad18-3ce3f7d7bfd2", "comment": "Malware payload (RedLineStealer)", "value": "90a10179ad53aa501f12d20054adb31ecf6d82ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675332365, "uuid": "44c488e6-597d-4a43-805c-163f06e8d11f", "comment": "Malware payload (RedLineStealer)", "value": "7dbedab30c48d203bf996f43f21126cb460645d0919874f2abb72b1b4403bd8ffe0a0656cff9689c07a914fd2ff5d45d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332365, "uuid": "86217a08-ac3c-40d4-88c5-e64bd3922885", "value": "T1E374F1337990D0B3C06A59305930EB85B7BEB9311675A50BBB982B6D9F712C0B336397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332365, "uuid": "69f9bb7e-d865-4a87-95dc-a8d202edf5d4", "value": "5b3e1365fd24e4232cba105b88665e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332365, "uuid": "b71d3a94-859c-41f4-85a6-4b3fda92b49c", "value": "6144:5TWm34hL2R7rG9jOa3YCnrA2LwOCjAceJpulXZucAA:5TXAaR/GM0YeLDQeJpmoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675332365, "uuid": "e254db95-0aa6-4703-8b88-8898b9efc2e2", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675332365, "uuid": "5a3913f9-1c68-4be5-ba6b-96032c3a001e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675332365, "uuid": "4edf2410-cb61-4a98-9014-87c85b7990b5", "value": "c95d602a3148b01226ecb66c0cf833ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334cb4cf-a31d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675358132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675358132, "uuid": "c5e3ffde-4ac5-44c0-bb4b-a34a7d82a5e3", "comment": "Malware payload (GCleaner)", "value": "a6ab04cca14aece0c6368c194baf661c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675358132, "uuid": "07aa1069-1350-4f9a-9620-dd3a6cbb5989", "comment": "Malware payload (GCleaner)", "value": "ef53963afa99e4a61f7978e66cd6343895bb6c4a5368a94b7d9fe6ad67e4eb96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675358132, "uuid": "ddf2297d-d6dd-46a3-a532-b7d126576ee8", "comment": "Malware payload (GCleaner)", "value": "d8acca325c59bab0eb26373611723d32d91c2485", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675358132, "uuid": "6505c53f-40c5-4035-91aa-e389fd5fecb3", "comment": "Malware payload (GCleaner)", "value": "cd9e9443dda5758b9f28db62e86bb35a401013c7e7c6a4efc4621e0fd2f606cfafb81ca7ba380e6ba5d338fbdd77a7ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675358132, "uuid": "142c45be-08cc-4265-a557-fb52ad8a5260", "value": "T1DDA53315A1B0A9B7C6918A3A9C319C089F2BFD9931FCD104F40C6A0F4F77285995BFA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675358132, "uuid": "5cfe26b0-5126-4972-a5f8-2d91a5de23c9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675358132, "uuid": "43bcefdb-d15d-47ee-ba53-0220102217b3", "value": "49152:bgw2aVxkJpmcT7a59MJ1SSuwDnxeN+wKcGodhp3r/8AlRNELCgv2MR:cr7JpmcT51SiSK+3r8gQv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675358132, "uuid": "2f876ed3-5941-4a87-83c5-b8344468bf9c", "value": 2103554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675358132, "uuid": "b7eba82b-fd73-4255-94e0-87037c720261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675358132, "uuid": "cdf9af76-800a-4d8c-a06c-482e82dfabb6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a69ecf3-a303-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675346897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346897, "uuid": "5be70e14-4ec0-4427-a06e-3a10d67656ba", "comment": "Malware payload (RemcosRAT)", "value": "52b1f058ad5b07d1cac6a7a2f4203b4b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346897, "uuid": "593051b6-6699-4bea-b587-b55ef949a3fe", "comment": "Malware payload (RemcosRAT)", "value": "effbb317ce8899536564043358e00a0703f06f5948edce75b81369223e1e64c3", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346897, "uuid": "95f6006c-cd02-47b4-ae5f-f507336a8a37", "comment": "Malware payload (RemcosRAT)", "value": "8122a6069195fbc3df88d4159560fc1f33685688", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675346897, "uuid": "0264ba16-b24a-45ac-a73a-39d655322494", "comment": "Malware payload (RemcosRAT)", "value": "52171a16a06e3a26009226ea89c1ace9df41db46a4b893a5119d99c0fcad9f4696eff99d3589209a0822f7b0afbdc39f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346897, "uuid": "6cf76bbc-05f1-474a-bd0c-614f9aedcf5c", "value": "T1C575234310F68F84DE6C137E98E20F4766497B26513E939B07B9E15B3FE2AF65E40806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346897, "uuid": "c6b48494-f1ac-4da0-8d43-73df653af500", "value": "24576:0B8fzw3HTQ3WfdMczHMepP5bYDVcbMWB55GtC0+l+OZC6K7WbWDQTKI:U8fEDrfT5UJQFnl+Og6KiCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675346897, "uuid": "e9668726-abfc-4ea5-bf2a-a11aad0b8dbd", "value": 1647320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675346897, "uuid": "6ad5add8-977e-429a-ae00-4b2a871b806a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675346897, "uuid": "f87fc51d-cafc-429b-a1db-7402701846b8", "value": "SZ59020_GENERAL_Makina _Sales_Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b5d3b6-a2f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675341067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341067, "uuid": "8b2cfb98-5c8c-4eef-ba5b-10d8e6baf4e5", "comment": "Malware payload (Smoke Loader)", "value": "261943600b1c39acb5bf2013e70409b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341067, "uuid": "a1fc2e6d-f549-479f-a454-d9d479e5b270", "comment": "Malware payload (Smoke Loader)", "value": "f03268c568ee920d3cfe5f2150cc0e99c3415338c0aee86d2f53c1d1d9671728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341067, "uuid": "4d9d6877-20b7-47c7-91b5-3f2b58079cc2", "comment": "Malware payload (Smoke Loader)", "value": "7064299b4588c4bb13dd005450c38ab213af686c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341067, "uuid": "1f049c94-2afe-4e45-bc49-493c3f6eae1d", "comment": "Malware payload (Smoke Loader)", "value": "dd1bd2f0933ceb31dda71e91df5e8bb04e44bd839d43833241c19095d75e93f210935d5fc67183923a037d87e4ab509e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341067, "uuid": "bf961e26-56ed-4dba-8b93-bb7a804c39f5", "value": "T167548E42B2A3BC48ED368B728F1EF7E4791FBD508E1977BA1214AB1F14701A1C963725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341067, "uuid": "2dacac61-9c2c-4737-9c1c-1a2569663583", "value": "20540b45038474bafe70cf1c181e44fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341067, "uuid": "92dcbb99-6d7c-4d06-9265-b8ce798c80d9", "value": "6144:9spL3Ep8/7QMD4Grz6aOjx9/CJTk637eQfnd5VhuB:arr7L5rz6aox9CJb7d5Vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675341067, "uuid": "819f2fed-c4a3-4cf4-937a-21d2a5bdabbd", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675341067, "uuid": "97d1a6eb-e1de-4d76-aed2-654c181a49ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341067, "uuid": "b5f4092f-65c0-41b8-9c8c-318b775afce6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f816422a-a325-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675361898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361898, "uuid": "a64de910-0c3c-4a49-85c6-a62c2909359c", "comment": "Malware payload", "value": "00ac991d4285e2482a770fdfb8cc9b00", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361898, "uuid": "6a1f541c-02e3-4ac6-b357-1d60614b571f", "comment": "Malware payload", "value": "f0727c09aed146a3bb0c0457f6ebfeae5e9d2ea97bba235cd6b1ca68e3f222d1", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361898, "uuid": "642caa73-b1b8-442d-a488-03a1f8f1fcd3", "comment": "Malware payload", "value": "3b16b0481647df14da56f6b56632fc2cbc19fb5a", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675361898, "uuid": "c5214ec4-47cc-4e1a-bd85-39b0a9155c34", "comment": "Malware payload", "value": "d648f9dc36fe6f34853df883c9d61dd026eb81f8405549ac6131561602d803c07e85171bfbb21dcf0088614700fffa88", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361898, "uuid": "26dc0257-8fde-4bd8-81f8-e4a791660117", "value": "T1A493C5C0388168BD63B3D89A2B8B6505D569015F11019CD47C9DB6E8AFB8D2C93BDBFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361898, "uuid": "30e8b0b0-fa40-40bc-bcc3-d8ae5d710afa", "value": "1536:gMKmMmBwNuXKLSZPR5YTcy9MQKw3rpI4pSkAl49L9P7gK:gGMCR69Kw324pzJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675361898, "uuid": "80bcb0fc-fc62-489a-a092-7089432e213f", "value": 93923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675361898, "uuid": "dae1dd2e-bdeb-4d5e-9f77-4039bdfedbfa", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675361898, "uuid": "8039f6d8-4ab4-4182-8bf9-8814c2bcc445", "value": "tinxep2g.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1735ee45-a319-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675356367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675356367, "uuid": "48798b60-11d4-49a1-b551-8610e4128b31", "comment": "Malware payload (GCleaner)", "value": "186c5b0a0f1e10d0d83bc48e0a156f7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675356367, "uuid": "c039f916-6793-4776-bcb7-800921ce18b1", "comment": "Malware payload (GCleaner)", "value": "f0e811c6a4e43b4a0d76a51111e09038a51bf4951322961cb9d9c42a2e6f4a70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675356367, "uuid": "ce4c66e1-ff92-4ac9-b67c-23d01b76c902", "comment": "Malware payload (GCleaner)", "value": "0f9f3658d373c8b62b5d86027729f53565ea89fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675356367, "uuid": "8aebf73a-4fb8-4219-bd7d-c782c787e216", "comment": "Malware payload (GCleaner)", "value": "543956369e48a5f371ca8ccbcfa6c053bccd76386e350748bb5c5d78b0860ee915711fc5da3e3e87f3f95bcba9d3eb1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675356367, "uuid": "f0e877c4-ffe4-4ff0-9439-ef62926858c9", "value": "T144A5335ED8734133D99A96B066375104EBE37E6A4A7003E2348F6E4E9F2235B38277C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675356367, "uuid": "c7f5c763-3401-4ada-b1bc-4526bc9361f3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675356367, "uuid": "647f51c8-4b0e-4c5e-a2a6-4adf11c6d42f", "value": "49152:bgDVkBdl/CJGzjyhybPcsxj6WdLF5gbAUpJLCgv2MR:chG7/4GnaULL4MUplv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675356367, "uuid": "bc9355b9-46ec-4656-a77a-0fbcd44f52a0", "value": 2072271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675356367, "uuid": "a3ca4a4c-769c-45ef-8360-031f1d051bdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675356367, "uuid": "45273993-7580-496e-b94f-60fbf77741dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea2e1e5-a2f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675340193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340193, "uuid": "d654b43c-0795-4d12-ac31-a12f10cda386", "comment": "Malware payload (Loki)", "value": "6fca1ec5c5fff1a2d116dfad2dd9dd17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340193, "uuid": "41ebf566-fc92-44a4-9acc-6199af576f7d", "comment": "Malware payload (Loki)", "value": "f151c4d9ea6f201827c1b36d882505af0e6ab2760c961595fcce8bcb4924a24e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340193, "uuid": "8137720e-96c3-489c-bbb9-608a0f0663e4", "comment": "Malware payload (Loki)", "value": "1f54dc9048fba6cb81d0062bd86180c11325c849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675340193, "uuid": "5f467001-2a6b-4545-b223-afc9bce93122", "comment": "Malware payload (Loki)", "value": "b695fb16a75ea86e77fefec0d10dd6967c68386c109bb545f6c82ac5781455499a4b79bf2be9a5fc1edc814e12d4c365", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340193, "uuid": "23a15b1d-fc65-49d5-9887-992925efb264", "value": "T12B057D8737B1A4BEF68B407544283F886FA07113BF46E25397373AD49B098FBB698151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340193, "uuid": "f5dd7a22-f8fd-4642-928c-4c5c7d7da86b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340193, "uuid": "795a9a68-f738-48a8-a46c-3db994144d69", "value": "24576:Sx9p9Hl6pqW9gE+lLHv46F0xMpqG4yPafD:I9HOLOE+dHvdWiqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675340193, "uuid": "054e7f92-7284-4968-884e-9247898a287b", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675340193, "uuid": "c1cbd81a-ac21-4b84-b839-7086f4916d9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675340193, "uuid": "a59c2b23-506c-4afb-8a7e-118366230b60", "value": "6fca1ec5c5fff1a2d116dfad2dd9dd17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3831d39b-a327-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675362436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362436, "uuid": "e92508b6-5490-4b33-8a4c-83adc74cae70", "comment": "Malware payload (RedLineStealer)", "value": "c8a2ec3b886d7b6c83566c8f0df9685c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362436, "uuid": "f4a828bc-70b8-4faf-b393-b26544871755", "comment": "Malware payload (RedLineStealer)", "value": "f245f0c114f21bf3e08e3eecd9a1db8f6934c8321773bcc326e37458b3d3abbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362436, "uuid": "2fe44541-760a-4147-a2c1-87884b01378a", "comment": "Malware payload (RedLineStealer)", "value": "0c1457a4d05807b07aad5c5bed751ce7115875f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362436, "uuid": "0067eab2-f708-48d7-afbc-b14ceae24aa7", "comment": "Malware payload (RedLineStealer)", "value": "96c5131bcf9273682088aa23f3f50bd582718ae9f961d05c37193b86f29e47d564f7405869bc6e7977dafe20f4324b68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362436, "uuid": "8c13cbe8-ae19-4fab-b846-d6d5658ee663", "value": "T11F940252A7D980A3DCB117B46CFA07D31A3BBDB25CB8422B2381686E5C735D0A57173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362436, "uuid": "2f710a9e-d4dd-4e08-ae79-1181cda2b8a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362436, "uuid": "d7b4550f-1ed0-4c67-a22f-c1637ef7c5bf", "value": "12288:XG77y90oVVWLche/mGymWd6T8MVcwqGFr8s+q9/:qynQwEmgWogMVYGXlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362436, "uuid": "79abb683-d585-412c-a865-f45b94e95392", "value": 433664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362436, "uuid": "1156be35-3f2d-435e-97f0-4a9a18b4de69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362436, "uuid": "0cf6990d-7419-45cb-9e98-5ab8ca5a4c4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c68d0e1-a300-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675345719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345719, "uuid": "6b439c77-96fe-47f0-896c-48a9a92760e4", "comment": "Malware payload (AgentTesla)", "value": "f354cbb44446e71b82e01153f8167d87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345719, "uuid": "f3ffeb65-7600-4a58-a217-1c66a5db9c6e", "comment": "Malware payload (AgentTesla)", "value": "f4aeb9bc700d6415bd3302e5035f9a8052a4a448725af699acfcd69af52a6e6c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345719, "uuid": "dfcd2e8c-dc72-4d3b-9d97-0c660cb4bec4", "comment": "Malware payload (AgentTesla)", "value": "535b602e4932f677119fb8dc71d401fe42b9b478", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345719, "uuid": "46308654-3acf-4bff-a1de-69f7b2fd554b", "comment": "Malware payload (AgentTesla)", "value": "c6be17478764252eadda0eaf3d235c966bd94970062063c47358d759fc51e6e1ba2706b8e2ea0e5301740dd7bd40a8a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345719, "uuid": "76eac74d-808b-46e7-91c9-727a798eb387", "value": "T139A4E028B663DA17CC9137B40DA1E7742B64AFD5F9608A23BB4CFA9E3471E383095354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345719, "uuid": "09af87d8-b0e3-47f3-8e94-bd17b87f9bbb", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345719, "uuid": "f84e5359-df48-468d-a69c-66e6b4cf2102", "value": "6144:oYa6eLPHe0IIqmN4P9XUNLC5XKEFHc9OyvovtEu9eCYPUzE5nCvXq/sFcpM:oY45Q9Ek5nF88yAOu9hYgE5CC/sFc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675345719, "uuid": "b6b56c2a-6fc4-4e1a-8bf1-e2a3a5d04301", "value": 458386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675345719, "uuid": "6936cc83-fa37-4dd2-87a4-4b6bf7f4aa14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345719, "uuid": "fed6a627-de9b-4a05-9803-cd512be67368", "value": "f4aeb9bc700d6415bd3302e5035f9a8052a4a448725af699acfcd69af52a6e6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f72be5f-a328-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675362823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362823, "uuid": "e4975991-8636-41fa-b139-33c1490064d2", "comment": "Malware payload", "value": "00da4e95f955eaae3566d19135ceb8f2", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362823, "uuid": "b73699b3-14b9-4eae-94e6-9ed703e8d36f", "comment": "Malware payload", "value": "f516ee82660137a6d56f460e85a14f041eb56ffbf14c1d54d614fca5cfe5dcd0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362823, "uuid": "e3982eda-876a-4f2f-bf7d-b5663019c850", "comment": "Malware payload", "value": "f7cea25e5ed038fa566b23b288102451c1cab1ce", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362823, "uuid": "c99096f5-2fac-4671-9b0b-520e76ce29ad", "comment": "Malware payload", "value": "b0d099e5f10d31a2ade2cb37aed547df189d6b3ca72228a471174249cf856c3243cb6e01d0a6d1f19037697b2f0e1338", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362823, "uuid": "b0a18647-1bf5-41c3-94df-c4bc8251b630", "value": "T120B58C2275C5C632EA6F4330652ADB7B61F97EE0377340DB63D8962E0E719C04276E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362823, "uuid": "446d0625-5af8-484d-8001-f5ef8bd560d5", "value": "49152:emJYUMV3eVougTzAFPsJ6ma8zotlmfwrgxMy+y29IAan6Dr24vLNgmUESIEjPMNb:RYUMV399AlAfwrtyF4veHjPMNae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362823, "uuid": "9e036564-987c-459d-a88c-c01eabb7a524", "value": 2429440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362823, "uuid": "605fa17f-53d4-4b73-beae-b495f57ba12f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362823, "uuid": "22591738-0544-468b-94bc-9a08112dcd46", "value": "SecuriteInfo.com.HEUR.Trojan-Downloader.OLE2.Powedon.gen.27371.6656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e224dc-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675337249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337249, "uuid": "b23ddcf3-a9ee-4048-9aff-2d3cdbb75c2b", "comment": "Malware payload (AgentTesla)", "value": "ad86b1f39d83a57759771cc3324ce03f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337249, "uuid": "90ded5cc-6865-4fdf-96b9-0f10adc016b2", "comment": "Malware payload (AgentTesla)", "value": "f61e31e6021c21e2f8fdaeea5a301b707aefb1a932b53a86eede5cd8f2cfa468", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337249, "uuid": "0a3fbf3e-10cd-4ec8-97a8-dca8b3b027af", "comment": "Malware payload (AgentTesla)", "value": "3034d5c00f060382ad5cdb85672740ed3483edd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337249, "uuid": "58c7c8f5-5389-4a4c-94a7-fc732342bfa4", "comment": "Malware payload (AgentTesla)", "value": "964268914ea0f101479b389eefe5e25b982bd6313e26085ebe61bf5236a4e2507faa41abd50941195962204b136e5a96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337249, "uuid": "0a91f4b6-ec98-47be-adc2-ca6c3743bde6", "value": "T148159D8737B1A8BFF69B407144283F886FA07013BF56A253973739D49B098FBB698151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337249, "uuid": "925dc55e-1320-45dc-aee5-86db2d1d36db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337249, "uuid": "93a9acbe-2801-415c-81ef-fb6038ee2bdb", "value": "24576:MIu26F0xM/cr4CQa5rC5Es8hIPqG4yPa7:gWi/2ZQaR+82Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337249, "uuid": "dab81d34-702c-4b66-896d-76ec86b066f8", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337249, "uuid": "9693e6a0-d69f-4ce5-9bdc-e942cf7eca95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337249, "uuid": "331fc26a-3aa1-472d-b3a0-cb3f506927c4", "value": "MaerskLine Shipping DOC_2241518246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b181a6f-a31a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675356776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675356776, "uuid": "46326539-affb-4083-8f3e-82f2500de50c", "comment": "Malware payload (RedLineStealer)", "value": "1b968e9189f85ac131374959d6f13010", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675356776, "uuid": "547271c8-7c00-4ae2-871e-ddca7e71a3f2", "comment": "Malware payload (RedLineStealer)", "value": "f7f53cfeab4cc2cc46f018da63f0e888fd3dc4d75477fe7b090f908752a498d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675356776, "uuid": "33686e87-b579-4f51-b00b-56ad1d17ab83", "comment": "Malware payload (RedLineStealer)", "value": "c2f77c0eadc24af9d6012a647709617a783282d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675356776, "uuid": "9b55d4d8-f53c-4b2c-aae3-63f34bc8655c", "comment": "Malware payload (RedLineStealer)", "value": "c57d768ccd3889a19cf0b8ba41ba68e8b2a058a59d59b6fa738fd51b244a622a9ff3de758e3b38810bd621081ed33328", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675356776, "uuid": "5ff88a9b-eb2c-4a20-a503-afbc7e6095e7", "value": "T11464B77ABF48E874E820293BCF534381B2AF5DD86515CD07618B2981C9A27FD0BF7661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675356776, "uuid": "fb1b1339-0000-4004-89d4-2350bb8689a8", "value": "933c3c1939cec1543334fac4d41f0119", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675356776, "uuid": "426dcd11-ae5a-49d5-b557-4ba3e57fbe49", "value": "6144:3xKAs2fICenf8lB8AT0xaYAewSYn6NcD8S:3xKx2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675356776, "uuid": "c2cd396a-cf4b-498e-a0c0-5d741bbf3718", "value": 322327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675356776, "uuid": "deaadcc8-dd65-4c9d-986f-e7342b857a0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675356776, "uuid": "5a9bb148-325b-465b-8aca-ce8c410deded", "value": "1b968e9189f85ac131374959d6f13010", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b9e763-a336-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675369013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675369013, "uuid": "b7931c39-83bb-4263-926e-bdf1a9027e38", "comment": "Malware payload", "value": "8aed11d1c1b2b45c076b5caeee127786", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675369013, "uuid": "fb1d4a6c-d9ad-4c85-82b6-de0fd944dc28", "comment": "Malware payload", "value": "f82b97d8adb76fe9c5ff0ae6b649893721a3b213c3215a8383607e62d4692db7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675369013, "uuid": "029f39ff-bc45-4aec-971d-cc5a49b71c52", "comment": "Malware payload", "value": "64a5799c270fef93e49eaf00acec70c84e65c723", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675369013, "uuid": "61ae80c7-6c77-4899-9321-ec74cc90a7fb", "comment": "Malware payload", "value": "ea045c110cfb4de900771103597b971c0db3c3aeaed508eeaad72ca2b43eb41f7b40d51fecc12f58500e33fff1c7b2e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675369013, "uuid": "d1b00d64-f189-4884-bcec-22e0494672f8", "value": "T12EA5334BD6F2C077E092EF3939A141087B75BBE92678042774ED7AE32FAB7007415A94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675369013, "uuid": "e811c650-e0f4-4951-a0a9-95ccdb080017", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675369013, "uuid": "e5c4c698-8c8b-413f-b3b0-dcb65630ae75", "value": "49152:bgTQk8ydjUdlXzrDI/IGB1vvhYpYgpzJ/SM/r3PGLCgv2MR:c8kWnDS3DhYp7/FP2v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675369013, "uuid": "2b515884-a8e0-4749-8541-59ecdf1bbd4f", "value": 2075389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675369013, "uuid": "14910248-ddb2-4b17-b9f3-da0ecd256df8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675369013, "uuid": "767522f3-e7dd-4834-8c47-9f507a97fec9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d70cd82-a2e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1675334017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334017, "uuid": "041e61d0-7ce3-4389-a801-436f581ad5e6", "comment": "Malware payload (ModiLoader)", "value": "bb8db5ada4ca9cb3f07ff7035e1cbdec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334017, "uuid": "d33dbf9c-5904-40d0-8751-b7434b2af17c", "comment": "Malware payload (ModiLoader)", "value": "f89bdf26235faffcde237bebb15da55250f780d07a87a4304651a2e6b7e7e45a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334017, "uuid": "a84424f9-9ed0-4fbd-ba35-fe57491aa9f7", "comment": "Malware payload (ModiLoader)", "value": "4fc35a028a0bf58a14f5068ed68afae339e21566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675334017, "uuid": "c4105bee-e2ec-4394-8771-f718975ba34e", "comment": "Malware payload (ModiLoader)", "value": "6c8adbf092c6e2fad7ec6daf210a1f207dcda82b4ace3cdddea450b2f5769e57695eec7b64340e11b3b0d7ee962ece97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334017, "uuid": "634f440c-b261-4f70-9940-fd3d0f1ca4e3", "value": "T1A8E48E13B2B99836D13716F58C1697BCAC167D302934A44D2AED7D88AF3B341F42A5CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334017, "uuid": "2a10aa95-2b5d-4344-b9bb-4b3def5aa022", "value": "26a25227f74e66185102d6e0ba9c1593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334017, "uuid": "453a84e1-1e9c-4770-ba48-d2961ebfdcb0", "value": "12288:+J8P4O2utBLvuQ4ZNn1AjnJzQFftOZCcgy:mIWutBLm/NnoJzQFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675334017, "uuid": "a71a2760-fd57-4fc4-a8f8-61a315d0b933", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675334017, "uuid": "a7d319c4-d12d-4ac4-813c-43fa7d15850c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675334017, "uuid": "05859812-fdc7-478f-8586-629c070ea86c", "value": "Scanned_from_a_Lexmark_Multifunction_Product02-02-2023-173507.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e22199-a328-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675362806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362806, "uuid": "49644477-a6f3-4f5e-83ed-c914416d4b6e", "comment": "Malware payload", "value": "70f1b93e88becf61d56e92e66f184606", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362806, "uuid": "1964031a-8145-48fd-a7a5-73db26d7ef91", "comment": "Malware payload", "value": "f8a558b5018b7731d5a4d458fcf047b58748fc0fec8aca8ae177dc0f1bc9d47b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362806, "uuid": "7b80cd0a-b9a0-49cd-bb59-e91bc3670f55", "comment": "Malware payload", "value": "2a22bedca07daf9b4a47e4be9c8a8d257d9dd682", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362806, "uuid": "22ad40cc-1c93-4edc-95e9-c99f7b2da7aa", "comment": "Malware payload", "value": "42e15bec05b5af391f8d97bc279bb8cc9d3f68415818e6d8e851d24de204c1cb1b8a36e28c08925406c97ee113a1bbed", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362806, "uuid": "682458fa-b1db-4ab6-ad1b-e315619aa444", "value": "T11FD6222275C5C633EA6F8330652ADB7B51F97AE0377380DB53D8992D0E719C08276E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362806, "uuid": "0e071b3a-916d-4365-80c3-5a0d8e16195b", "value": "393216:KoJxf6wAMQ8MLCCBtBOy2suKLRyfWVC8:KoJrh3wBtBXruKLgWVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362806, "uuid": "8cf32a88-73e1-4f1f-bff4-a18d0b6b63fa", "value": 13090304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362806, "uuid": "06436057-2790-4ab6-b1c9-b2513275ab80", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362806, "uuid": "2319a929-2b38-4bcc-ac61-12392dd8287b", "value": "SecuriteInfo.com.HEUR.Trojan-Downloader.OLE2.Powedon.gen.5954.28818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f08d9b8-a305-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675347951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347951, "uuid": "b04e4f6c-218e-473a-8ae1-c7ec035868b3", "comment": "Malware payload (AgentTesla)", "value": "d81ed82ea53f8e56bb98eaaef98f4d80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347951, "uuid": "9320c61a-f40c-4096-ab5b-7ec468c1d024", "comment": "Malware payload (AgentTesla)", "value": "f90d2b7322438acc8decf28392f29916b9b87ce99072f867d3e278ce6fc295fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347951, "uuid": "eee45d16-a89a-4e18-b4f4-e8c2ed275093", "comment": "Malware payload (AgentTesla)", "value": "01d76f1b404b125a7b8bf3f3829101124965ad9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675347951, "uuid": "90b797b7-50d8-475e-a99c-5b40505eb4d2", "comment": "Malware payload (AgentTesla)", "value": "276abfba08b2561579959ca287dc5a030b865f68a8044fffdbebc39c17249ea876ba9128a7aeee878ddec8dd57a39eed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347951, "uuid": "d6a39cce-91a0-4b16-ba7d-9e6e09c77a12", "value": "T173453305424D958EDDCE19BCB1A0FB4D002C108ED2DB14BBA79A3065F75B1DCBB1BA79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347951, "uuid": "915a94b3-4e0d-4070-9dc9-daf1dddc3f94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347951, "uuid": "37354716-eb13-4704-8c2d-4d51dbfd0c64", "value": "24576:QpbnahUHVL9XoveLj48xCbGmx31VprkdhVKfhoyNDjgGKySlXYrZSD:QpuKHXLU8kb11/JeyNDjgxySeZSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675347951, "uuid": "d8f210b9-5123-4bf9-bcbd-f690f6c11c86", "value": 1269248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675347951, "uuid": "13bf1909-55c9-42a7-b77e-318c4ebb3d8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675347951, "uuid": "3ca23f12-f45e-4962-b437-54ab66e10978", "value": "Product presentation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4c54f7-a2ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675337047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337047, "uuid": "d02b207a-c13c-42e5-a6f5-a81ddd2e621e", "comment": "Malware payload (SnakeKeylogger)", "value": "f36c8883d8d913ae17a678ccce6ee48b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337047, "uuid": "7ff803f1-7b70-472d-99b8-f73e612aaecc", "comment": "Malware payload (SnakeKeylogger)", "value": "f974f22e9f49dbf0f8563082310d8cee776f93511be8d1a14134946bab72da18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337047, "uuid": "c5182351-0e7f-4eae-a3c6-daf65ffada5b", "comment": "Malware payload (SnakeKeylogger)", "value": "8db33d8efbccd209230aead6c4e6ce28fe03778e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675337047, "uuid": "eed89131-3fc9-4e7a-bec3-782a5f54716b", "comment": "Malware payload (SnakeKeylogger)", "value": "9219116d18bf2b0be1165bac2f444b41976f744f362b26288fb332ed27a38e54ba3e56625f78ae2876e8e95091b810e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337047, "uuid": "00b3c10b-5ae9-4a92-ba58-3b547d7906cc", "value": "T17DE49EBB2440D9DCCF6D83F3621AC081239AACBE843CD6897F9633D24BE5B554C92657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337047, "uuid": "9694be91-bf4f-4e5c-b220-6ad40ad9d0eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337047, "uuid": "340b9c97-462a-460f-93b2-8443cb2932a1", "value": "12288:wEhFDutOc6duxKLo9ymz7qgJBLdRrCISC3iEtD5/uDGuTLNQyMtZ4Odx2fo9v6nB:OHVJBBRrCi5EGuTOtZ4OdA66nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675337047, "uuid": "de6c8eb0-a9da-49bc-8c4c-5ad6611f0476", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675337047, "uuid": "85958895-3e3e-413d-b238-7f58f711f898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675337047, "uuid": "261bde33-a820-4ddc-849a-66a2c81bf437", "value": "\u041f\u043b\u0430\u0446\u0435\u0436\u043d\u044b \u0444\u0430\u0439\u043b_01099388402_vcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ceb1c8-a28c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1675296106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296106, "uuid": "ff832aef-b49b-4d18-8055-f03065e80ac2", "comment": "Malware payload (Heodo)", "value": "39e9d79665406935d15203ea29ea99b4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296106, "uuid": "8a4532d3-8c73-41ea-8e1d-faf1d2ed3db4", "comment": "Malware payload (Heodo)", "value": "fa3c5ddf45785d51e0df6eb9d2529960a85d401f2b7d9fb1925baff45fa147a6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296106, "uuid": "ef076f6b-9296-4254-8c6a-0aeac6ba7100", "comment": "Malware payload (Heodo)", "value": "2d71150d1be07be35d8347363721978229ea9421", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675296106, "uuid": "94513137-64b7-4dce-9c48-60921825cae5", "comment": "Malware payload (Heodo)", "value": "1fadc52df837357504296658dcf2575a6245f00420096704e744e638c63bc4b8cedc07ae3a696bcaf62eaffcc9c8f1f3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296106, "uuid": "c132ae3a-5b4b-49b8-b8a1-b602227c021d", "value": "T11F848D678635C388ECAC98F25F75720390265BEBED8408A2B6495C0FCB9428D71EFF55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296106, "uuid": "814f68b1-94f1-4feb-9067-a94d6d5aabf9", "value": "675837ad7e27123374afb86867ecb5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296106, "uuid": "67375b3c-3d65-47ba-889a-0221944736fb", "value": "6144:zrliZjGaBMd+bVJx9AEy5LIGhKq7vXaoYB9l9uzQNosKnAtu+4ocqs:FiJK+bVv9PytIGhKq7vXmB9lIQN2nA6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675296106, "uuid": "890c9985-08cd-45b5-921b-c1cf6d66f56b", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675296106, "uuid": "0b406a8a-d696-4a53-8d4e-fee5e24ad6ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675296106, "uuid": "820ffa20-8107-4c9e-b498-bb9f9b85cd93", "value": "ssd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c509c86-a345-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675375247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675375247, "uuid": "904ba062-70e1-437f-bfad-1a27375cae0e", "comment": "Malware payload", "value": "e27fcbd599d93f7642073e1867f048e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675375247, "uuid": "22c48108-52a4-4bfd-af83-93878c370916", "comment": "Malware payload", "value": "fb0fba19933650ebd71b9eaa698decc35ef6b3ee6273c8c1bc9c5da98d3e290d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675375247, "uuid": "d3bcded2-7446-450f-bf43-811c333208f3", "comment": "Malware payload", "value": "7da5e90294b9c252da825547c5172e11db8cd98a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675375247, "uuid": "e0f1c100-89a0-4349-bbd2-82d31c3b0faf", "comment": "Malware payload", "value": "08a33a5c186e1dfdb1dcd947fabc824bc3f23e8227cf9cb9675690ad676237d871b52ad03506a8dae4a21d6d1311ab86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675375247, "uuid": "3a57a1bd-7791-474d-bc75-8bd48a96a2f4", "value": "T1EE648E4262E2FC41D721CB728E1EDBF47A1DB9518E287F6A52185FBF2972172C5A3310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675375247, "uuid": "37fbf7bd-01e7-4232-b002-23bb7e093cb1", "value": "2ff60b2f756b6533c2643b340c02a5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675375247, "uuid": "bcb02a42-f1c1-429a-a13e-506e214d9b35", "value": "6144:Gl6TLh0iN/u1lyWu3T4TWLIXYgldPqlwKwpxEjV6ptCbNKN:Gl6TV0w8ybUWcileI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675375247, "uuid": "478e8015-ee3d-4115-b02b-f98895b8a6b9", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675375247, "uuid": "77412349-e879-46f9-84cc-ed5aca1348eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675375247, "uuid": "ffa5e34f-2f06-4203-a90d-8c1b8f0f31e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5401d5-a2ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675345182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345182, "uuid": "aa0e38c5-9435-4303-9c97-0b10d9d7a737", "comment": "Malware payload (Quakbot)", "value": "bd0ebd840439189cc64af2d0cd0dd130", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345182, "uuid": "e5e8236c-538b-4227-966c-443d298ec2df", "comment": "Malware payload (Quakbot)", "value": "fbe95e4d58b31a15569d3e4ab057bc47abb193c9afacdda186be51b2c1ac582b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345182, "uuid": "61d2eb77-eccb-4a3e-b474-f96e5b73dd22", "comment": "Malware payload (Quakbot)", "value": "72cef301ca25db6f1aa42f9380ab12ae2e99a725", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675345182, "uuid": "fb465499-50ce-4582-b139-5b7fa9c4395d", "comment": "Malware payload (Quakbot)", "value": "f07afd0b7870a41b9fdf75efdbf8923b8ed045819e446abbf76b3c3d8f4d3283feebe8be1fd3124a00e4b7b1991e6e44", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345182, "uuid": "302f3bb4-fb0c-4127-8269-1c5e62a35a99", "value": "T14A84220B7501DBB6C2A683318676C6EDDBA5EC0C4F47B523568BB0CD3A71AA14377E84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345182, "uuid": "4587ae95-411a-450e-8ca0-2379fa41693e", "value": "6144:Vn1X0lyS6gYhkJceU2iXT+XYhwNabhXx3r6FiNhRfpwt+42OTTF:V1Xw6gzJceU2khmOC4Nhxpwc6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675345182, "uuid": "c0d9ec13-235a-404c-9f1a-2e455a8d00fe", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675345182, "uuid": "a51542f4-65c5-419b-b6eb-fb6f8b8a580e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675345182, "uuid": "6423d27c-c429-4c32-822e-6139985512db", "value": "bd0ebd840439189cc64af2d0cd0dd130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811e7189-a290-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675297704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675297704, "uuid": "954cfd28-afe2-4529-8ca2-71e6a7c46178", "comment": "Malware payload", "value": "2e66a40fe4f9831eca305df12801c9b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675297704, "uuid": "3acb10b2-7902-4443-bce2-e29b83a7795d", "comment": "Malware payload", "value": "fc7578249e73ba471d9ac209d2cf585da71c3628740ee882a52d44e3a6744b97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675297704, "uuid": "db78ddfa-70a4-41f8-9b6d-c88a7a32800f", "comment": "Malware payload", "value": "9d2ea95169088934decc65bb80f03184a48d0484", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675297704, "uuid": "11e2246a-9ef6-4959-bdb8-9a59205bf799", "comment": "Malware payload", "value": "4c76392a704b7a36c80066f3d13227ae60f1761d2ced88b3c63e6ee351af6c683c4a9837ccf8a314dee20fd7e7ca20a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675297704, "uuid": "a6c6d1f5-fa44-44af-af26-23693389801b", "value": "T1F176330B7FD99071C61D133287AC5C9B62FDEFA50C2142E733681D9E9F6DB14C2A62A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675297704, "uuid": "11f62d59-2142-430b-be27-fc4f370f7c00", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675297704, "uuid": "7b357ea7-5838-4582-97b4-a30f6a4446a6", "value": "196608:91OCwPQCglXT4ZqPw/zXgBUddT/Xi1TqUXlBlgmi:3OtQCglXc8KXuUdhvYVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675297704, "uuid": "6048f6ae-d3f0-481e-8874-f3a27fff38d2", "value": 7651671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675297704, "uuid": "45acbe79-be27-4d06-9104-2cefc44fce4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675297704, "uuid": "d61cc6c0-5ed9-4c58-a5a4-c331c86b2e15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c556e39-a328-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675362818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362818, "uuid": "6bf75d72-395c-4e08-b3a3-9c3a67110eca", "comment": "Malware payload", "value": "9b1b983d52da71b95b27a65060675e78", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362818, "uuid": "d60c6a3f-c4ec-43c7-9d2f-eaad5311d401", "comment": "Malware payload", "value": "fc9171498a9a5ce1b209b6181e54abc81c93111d2c5e441aaa8c9fcd9aca43e9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362818, "uuid": "38313ecd-984e-4c9d-adaf-c1a4def41745", "comment": "Malware payload", "value": "f157f2dffc8147539caf502472c7654ff47dc18a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362818, "uuid": "5ddc42c7-2d69-4763-a4ca-f263b83718e0", "comment": "Malware payload", "value": "b5272112b6bc760f73727adc57b695dce9664753dc8bf1090a18f3801fb2edb82ff122848151f49af3cc37b4cddff090", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362818, "uuid": "0a27de67-3b24-4537-8adb-ddb890f07880", "value": "T10237233278C9C232EA6F4334166ADB7B51F96EE0377340DB53D8996D0E754C082B6A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362818, "uuid": "35d30b4a-2a9b-409f-ab01-40f0adf90cab", "value": "393216:Ioq9n04ph6pVrsGJB1Mv42sgoYlC9nclm5wX11Q6xLbDUtAcDHqCyox1+:IoqVc5sm1g4f7YlsnclVQ6xLbjayox1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362818, "uuid": "86c3a165-ae70-4c10-bd27-b44bcca96b4e", "value": 23662080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362818, "uuid": "314497eb-d157-4eb1-83ba-031b5a8359ac", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362818, "uuid": "8471d9cf-1590-4378-a60c-5becba7c6858", "value": "SecuriteInfo.com.HEUR.Trojan-Downloader.OLE2.Powedon.gen.8467.32033", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fa706e-a2bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675317016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317016, "uuid": "92e4a5c1-d7d3-49ff-b730-d0dc930b2770", "comment": "Malware payload (Amadey)", "value": "b1146ec9318c55479bd80be9ae6410ad", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317016, "uuid": "675cec74-82cd-4326-911a-78cad99a7f00", "comment": "Malware payload (Amadey)", "value": "fcaa3b47fc9a61baf5e8317fb8bd62028bb6c5190702d21c3645c346a4b66d53", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317016, "uuid": "eb7cc8a7-f41e-43bb-963f-bb19bc3eb696", "comment": "Malware payload (Amadey)", "value": "3b73d97d82c088c9b9e4343b1eb231b3097b146d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675317016, "uuid": "1d63b4f3-44ce-4efd-b18b-78c1e9a77ec3", "comment": "Malware payload (Amadey)", "value": "196dffea907c5735016893fdc64b77d1ce48611a3257df406b34945f32b8ec03aa25cd251e91bb7357f0232f14ceecf6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317016, "uuid": "146e6cbe-71ad-4029-9970-6eb1d33637cf", "value": "T1C6749E037AD0BC49D532CB729F1EF7E4B91FF9504E9863B61228AB1F14701B2C96A725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317016, "uuid": "302dd9ce-1be1-4187-8cdd-1d83e623b0d4", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317016, "uuid": "814ac033-700d-4472-8135-721cce3570c1", "value": "6144:T/LomuF9DSbA2q8tL9mrDhvW6UvSCXK/o9/CJTk637eQfnd5SCyHCB:jGFI28ahvPUXXko9CJb7d5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675317016, "uuid": "9dfb05dc-8ddc-43aa-8594-01cd0ba627f0", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675317016, "uuid": "9c87f716-01d4-463b-96cf-7ba94e290f38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675317016, "uuid": "c141148c-7f88-4d6d-bcb1-7d87fead17ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d28fa29-a34c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675378389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378389, "uuid": "3df68a82-3965-4e9f-9609-ad4f3f8c10e4", "comment": "Malware payload", "value": "a232156764e5b325d9c96ae9bb647073", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378389, "uuid": "68d78869-813b-4fa7-8015-7bd27ecae475", "comment": "Malware payload", "value": "fce5cbc308f65adf5333787e2ff8e4dd34b8f67541eb4a0180871a761f15bb72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378389, "uuid": "a134f81f-bcbb-4339-84bd-16909feedead", "comment": "Malware payload", "value": "299142a50cf6938a8489dd4e6bb045258fe762b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675378389, "uuid": "40e5e9ee-1ad8-4216-977d-bd53a2af2c03", "comment": "Malware payload", "value": "02f8b4c44f1413d1c5712b7e5f924cf054c1aa64387ad2ee6c8355aa6bf7ae096733a17cbf29a389fbdf10507502ab3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378389, "uuid": "7918bc15-80df-4820-9fa2-c79a0e82faa7", "value": "T14FF5712D7B79EC34E406A6BBC7A285A2D506DC31D923CA1B3509FF98B436F5052F134A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378389, "uuid": "d2811de9-7b0e-434d-88b3-e0183d2ca8d1", "value": "4026ea621995ba43fe317a55bdf9a127", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378389, "uuid": "abfd8ac6-a77c-412b-8d7e-c0526e5bc3d8", "value": "49152:rFyzYQW17zO/tceisXT/blVKIGl0G0Eb8yFMRo:rFyzYd1v6isXHxI8yF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675378389, "uuid": "cbcdc645-644f-46fc-bf54-28b40827c17d", "value": 3526656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675378389, "uuid": "e7f5a600-3d7c-454f-aa54-6ae7cb4c9b1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675378389, "uuid": "daf02b0d-5b57-4a4a-8ffc-0c0ea0d00371", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8810649d-a2db-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675329928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329928, "uuid": "3d760fc2-8ddd-4417-8aa6-77b7e4ece3d1", "comment": "Malware payload", "value": "8161fbc9f7ed9f73da6b7b778f69a7a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329928, "uuid": "c6364529-1143-4201-9828-c477455e0d8a", "comment": "Malware payload", "value": "fd2d9bf96afc80ee891b0f7efd5f4a143d11f8e0ac8b2df1cce676bf86787368", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329928, "uuid": "65c418b2-9940-46ac-88b4-ac0dc46803cc", "comment": "Malware payload", "value": "ae4b522758fbf2dc99ddcf6aedabfcb956855ad5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675329928, "uuid": "49e00749-7358-47c9-9169-c2f4d84c00e7", "comment": "Malware payload", "value": "227d93ca62e75329528aa9ec4bff7b433759497a68409cdb5b9668121e654016b65dcf51fc8a294bc2826bc3504fd8f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329928, "uuid": "89ff3c44-1746-43cc-85aa-2912fb692ccb", "value": "T1B776330079CBC8F7E9698571DE543F95A2C6F2488E75917FBBA86C2A4E34006D484F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329928, "uuid": "719486ac-7235-4e62-975b-b23e6f3f753d", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329928, "uuid": "fe1a05b4-7ef1-41d5-b6ef-b185be8bad14", "value": "196608:91Op1JLgt0z8MGkZECkQ5Lz795RTEgOw+Ci72:3Op1JLgKGkZPdzp5eI+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675329928, "uuid": "e88b641f-4dfb-4e78-9f36-21615852b607", "value": 7601420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675329928, "uuid": "548603fb-4a9e-4f4a-94fa-1a9a95c0fc1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675329928, "uuid": "3a6f1fae-1886-4447-842d-18ae4ce1bd73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec32c3b8-a326-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675362308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362308, "uuid": "248bb7c3-c8bf-4b6a-b879-1df1f02e4d9e", "comment": "Malware payload (RedLineStealer)", "value": "a01bf8e70df5e9874b6655b9f987401a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362308, "uuid": "7b2e4027-2b1f-4d9e-801e-c0dcf0c0cd70", "comment": "Malware payload (RedLineStealer)", "value": "fd30998521058cd6003f00fbc622a6d0dac2515ed498cce69e007e11eaab5a3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362308, "uuid": "ec30d249-8a46-44a1-93dd-d4f0c8f44bf4", "comment": "Malware payload (RedLineStealer)", "value": "b9a9c7bb4562e8e0871b6a2322f8def50a1490f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362308, "uuid": "29cb3ca0-cdc9-48da-a090-3bde1af1fcb1", "comment": "Malware payload (RedLineStealer)", "value": "592933243ec10c7f6dfcbfb52c5e215dca70df2b8c24322ceb02d5336705f8da01dcabce4bf8f2c8aabb6dfecf569f0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362308, "uuid": "71eb5744-233c-4a3b-9547-97a3bc6c1736", "value": "T131740B887670FD9EC867C47F8A681C24E6636466570BA203B05317ED993D79AFE070B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362308, "uuid": "9c0e510d-badb-4b81-a822-eb4f0fe25047", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362308, "uuid": "a3d7d2f6-b97f-466c-8401-841501d63353", "value": "6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362308, "uuid": "84dda832-70a5-48eb-9950-5c9b91ed8348", "value": 345380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362308, "uuid": "99363b83-7d43-4dcf-8a0a-9d952fd66817", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362308, "uuid": "37fbf16b-e6dd-4024-8e75-2bf8ba4b38b1", "value": "a01bf8e70df5e9874b6655b9f987401a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a486d935-a327-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675362617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362617, "uuid": "1bc27365-22dd-4df3-a9ad-780602e3d7ef", "comment": "Malware payload (AgentTesla)", "value": "15a8edf7acb4b60f82b62dd9c3f506a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362617, "uuid": "520d87d9-2e59-462d-92a3-7683e18975b5", "comment": "Malware payload (AgentTesla)", "value": "fda0911dca7590a76d9ad415817b83f11b1857569d356169c979c1e39592a9b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362617, "uuid": "7b411ff9-e60c-4b79-98ca-af8d3ee83c49", "comment": "Malware payload (AgentTesla)", "value": "e8ba9e9985f5e7677a8b70385ab53aa6b1fc3c16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675362617, "uuid": "2224decd-4856-4563-92e4-cc34f973b213", "comment": "Malware payload (AgentTesla)", "value": "aa2bccb33e13cd51a16245a8f8c48aa92be347e074094c0b23de24ea0fa3a3c2d2b592a48c48b45326a065807f440713", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362617, "uuid": "9ff21f3a-5859-4a24-b4ff-8f7ee9e11c88", "value": "T163058DD377F198B3F68B00B5142877C92FE07603BE55A253A77B7AD09B518BBB298101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362617, "uuid": "38bf4842-780b-49e1-a640-c448f15ae409", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362617, "uuid": "5436b585-6dd2-4bfa-925c-0d86c57bd88c", "value": "24576:T1dH+A0K3HQYDGOxYqekGuk6F0xMpqG4yPa:TPHr0K3BDiqek/5Wiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675362617, "uuid": "c7acd695-f205-4d5a-8020-6ae82eb49557", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675362617, "uuid": "2ba79121-1e17-4894-8e55-573f2a2f3f6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675362617, "uuid": "1a13d3fe-d0ba-4d68-83a3-aab65e646295", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5b4c34-a2f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675341662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341662, "uuid": "a754c0b7-21cb-4b59-a965-e031537b75bd", "comment": "Malware payload (RedLineStealer)", "value": "d13b6cd2bd5492c239265a7bafc9a842", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341662, "uuid": "e3dd7676-baff-4308-b689-2b9b8923b9a9", "comment": "Malware payload (RedLineStealer)", "value": "fdcec2ff72e1308fcf4e48856b1580239ce1eb241812344f841d02d0f4a02233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341662, "uuid": "2a796658-04a0-464f-9d7f-fd53c03dabc0", "comment": "Malware payload (RedLineStealer)", "value": "e380abdea8c76a456f672be5a237cb8ba7f634dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341662, "uuid": "4e2286be-e8fc-40c0-83f7-5ddee43f4835", "comment": "Malware payload (RedLineStealer)", "value": "6dab2016a2a78816cfc61858e8df6e9535ab9591af4a9877cf94ee3edc9a7a99075a1e972eb11ed6174330353678582e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341662, "uuid": "258488ee-c56e-470b-9709-853c28026108", "value": "T187740B887670FD9EC867C47F8A681C24E6636466570BA203B05317ED993D79AFE070B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341662, "uuid": "d2eb472e-80b9-492f-ba2c-b89f909e468f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341662, "uuid": "27fb14c1-f3da-4b49-8439-407eb3338881", "value": "6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675341662, "uuid": "184e605b-16e0-42d9-87a6-30cb361c072f", "value": 344671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675341662, "uuid": "ba935a51-3475-4f21-bafa-e7ff67c2fa97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341662, "uuid": "f279a420-33e5-4d0b-9bd9-120970f9e3f3", "value": "d13b6cd2bd5492c239265a7bafc9a842.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade07aa2-a2eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675336863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336863, "uuid": "6707851c-6aba-4bc7-86ba-d4740d4800fb", "comment": "Malware payload (RedLineStealer)", "value": "0ec61b221ab8f72bfaa28ccef40a0ee2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336863, "uuid": "d08535e0-9e03-4f30-b690-8b2147f68ed5", "comment": "Malware payload (RedLineStealer)", "value": "fe15159587b30b55007c4ad99cba929386209b64aa19a28cb3ff9b28f74c7ff1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336863, "uuid": "e6d35c1c-0313-4b8d-aa3d-7ba5a6b190e8", "comment": "Malware payload (RedLineStealer)", "value": "c392b83fc95630c2828a4ae644c402715a85e916", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675336863, "uuid": "9e8c4bb4-b83a-4103-8944-1e0d6d762860", "comment": "Malware payload (RedLineStealer)", "value": "f8f7a0492f30e8989bf4990533f412b3794d6f4b5a02e8688c559f68818b6e1c8cd10bb7f422bcdd980cb391ea7f6067", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336863, "uuid": "00785209-95e9-4ac6-a2bb-5d666acf524c", "value": "T15C94BF52B2E0BC49F5328B728F0EE7E4791FBD508E5877772224AA1F14711A5C9A3339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336863, "uuid": "3f7f81f1-ebee-4fbd-9346-28343c3a350e", "value": "20540b45038474bafe70cf1c181e44fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336863, "uuid": "da0831b5-0166-483f-8620-271b7c534e20", "value": "6144:SodL3pYLOknp5aXPtLLOe/nAxhzgEpmOhZyDt3urqei8K69/CJTk637eQfnd5zB+:njcOIrglniuGmOSDteOmZ9CJb7d5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675336863, "uuid": "ddd8d127-23a8-4723-9212-b80d564a65b1", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675336863, "uuid": "27322b23-570d-4236-af70-bfbd243f0bd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675336863, "uuid": "0dd7d250-a148-4c3a-a8e2-6ebab96b84d0", "value": "0ec61b221ab8f72bfaa28ccef40a0ee2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad6a957-a337-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675369339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675369339, "uuid": "045c5df0-5983-45ee-a9c9-f44b03479bb2", "comment": "Malware payload", "value": "cc2db35f43b4a12700c431811a463439", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675369339, "uuid": "3d215a57-2a84-4d35-a71e-4387410ac610", "comment": "Malware payload", "value": "fe9c78249937d57aaed2792238caeea298e715d9cf261add1fbfbaeeab084d40", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675369339, "uuid": "60d0e978-f803-475f-a20c-53164f3f939b", "comment": "Malware payload", "value": "d838aaf8d656b7d8d0f48d13646e677eaad35f20", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675369339, "uuid": "df822855-e6fe-43c1-8302-7614b7d1accb", "comment": "Malware payload", "value": "4c9f0354e11e455fa4f42a440a2e0b4b4803e6be9ef6a7e6afb6a07162f9aa369a824b5c251b86263588d0237b46f522", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675369339, "uuid": "58f85e3c-2672-40d9-a8ca-163d6c08ade3", "value": "T15D323D4847C493D6C8B57B19CFC66706C2043E165EA61C5096B5F743BE86B3F62E1B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675369339, "uuid": "ebca6af3-553f-4ba1-9eea-3c940c276d75", "value": "192:YoVivS9W9c1+YqNAmzCFFVCcVXowajgUWPeks8B4+0gXoOAcwLP3OUy8y40DXKl8:YK1U9tYHmzCFucVXdOgXPekXBD0wodcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675369339, "uuid": "55d0385f-d36a-4a3e-8dbd-9b299d43076d", "value": 11195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675369339, "uuid": "1fb9ff28-1dc0-415f-bd3f-a065296e1f7c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675369339, "uuid": "cd02692b-ee31-4bb6-a178-2d4a9060c534", "value": "Manuel.doc.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6e20fb-a2d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675325831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675325831, "uuid": "99447eeb-072d-4d57-8985-59fb1d76aa65", "comment": "Malware payload (Formbook)", "value": "a0ab5d7addef570ac00ebc96aea1a7cc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675325831, "uuid": "fe3c3b21-7ba3-4f9b-a5b2-f09c24d632e4", "comment": "Malware payload (Formbook)", "value": "fea8335f28234eb3003a9dd7a366ae03af520b3ed9b3372caa17b21233852176", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675325831, "uuid": "58f501a1-811f-4821-98ea-d3cade683afe", "comment": "Malware payload (Formbook)", "value": "037dc6b775fa77ac0bda29e23ba1a74f301c65ec", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675325831, "uuid": "3e455dbd-ec0b-45b0-80df-cd784cecc1f0", "comment": "Malware payload (Formbook)", "value": "46cbce48420f924b6ba51b2ef1183b61a0e036256791430873411c4b1a77cec966735ef391a854739d1bb543a4f79d64", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675325831, "uuid": "0ffbdeec-b432-40e1-a6d0-98d2d4bc3b72", "value": "T198558C8777B19872F6CB00B1142837CD2FE06103BE95E267AB7B79C0A7069FB7698151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675325831, "uuid": "f0357cb5-5690-4b85-9cef-2e8d77b67823", "value": "12288:Ntz8L6gu+xMRSR5SEtKypyE4s09JtWsJIPg8zLvqsEqG4yPa:QLzyRU5Zp74so3WaCTC1qG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675325831, "uuid": "49e08aaf-6ed6-4fad-995b-b455d5d78d66", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675325831, "uuid": "74c8d030-71e6-4a86-8c67-3c1ea2dcf5ee", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675325831, "uuid": "585f3541-c739-42a6-aea3-a072f828433d", "value": "REVISED PURCHASE ORDER ITEMS 2023-14-31.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82fb48b-a2bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675316801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675316801, "uuid": "ae681488-7473-4857-9692-1c88e562f74c", "comment": "Malware payload (GCleaner)", "value": "7f12ea37202273ca07d1e18e5c37d522", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675316801, "uuid": "69597a55-adee-4c0c-a0c3-b91fe1a9670c", "comment": "Malware payload (GCleaner)", "value": "ffd0801051fbfba484f95b4a826aebb147dbf9e38e33f845705e336b43655091", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675316801, "uuid": "04cf4adc-9649-4856-9733-ca3424f4ed9c", "comment": "Malware payload (GCleaner)", "value": "c3c3c35db4ba668389209ef1df4c95a37bb9aeba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675316801, "uuid": "711178ae-38b4-4a8d-b1b6-e2e12d605a40", "comment": "Malware payload (GCleaner)", "value": "c0c35f7bf861ba14377a21edb8c42d03a82c8d129a54dcd0e5e7b6774a89861771df4392652cd3bcf432c0886bfb76f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675316801, "uuid": "63591ace-fed3-468f-a690-95e0057ef9bc", "value": "T14695333280BE853DC011A9326B3F516075B57E8A44BE2093342D766F2E6B3916C6DF9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675316801, "uuid": "e2902ae6-1634-4a65-873d-3d4393746a2e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675316801, "uuid": "709154dc-b301-472f-83e0-0c8ce0ea6d9a", "value": "49152:bgnTrufnZOEnhLNZX4TXC+Y4uhgLCgv2MR:cnAnM5TXWfWv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675316801, "uuid": "4d0d5352-8384-4336-87ba-1cda59bf0a98", "value": 2036118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675316801, "uuid": "2b28e5b7-05fe-4168-a6e6-afb5e9848730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675316801, "uuid": "5d3b8830-05f9-4165-ab80-a69df30c52e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040c0959-a2f6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675341303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341303, "uuid": "215e811b-3a6d-44d5-a089-f7d6d539bb08", "comment": "Malware payload", "value": "0f378fb044f6d4375236bb076cd9ed52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341303, "uuid": "be762875-d789-4a75-9498-576bbf2af9ba", "comment": "Malware payload", "value": "fff717938237fdfc839f04b56053799416e444d7339a076f5c5dbb7bb8cb1534", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341303, "uuid": "aa9579d8-f7aa-42e0-8d5a-a2676fc3308c", "comment": "Malware payload", "value": "fcfe9befb0d268eb98fa5fd06978e0ef692d8c95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675341303, "uuid": "4a3a11bf-5dc8-4672-8cd0-839ca0eb7300", "comment": "Malware payload", "value": "53785e9c3f7c161a6d3b6f3a1136da295bcd2bbd276d9c287caf3150d57d88dc72e1d8b42a4ff58b53d3143115d926de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341303, "uuid": "95ecc353-07cf-4073-b9ee-65394ce3c28a", "value": "T1FA1533BC79AB2CDAFDF50BB075F52F37A00D86300A6C103AE961699C06A2F75F457482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341303, "uuid": "94905014-a5e6-4faa-a3bc-c33f5318f16d", "value": "b602426ec706e7b23572160bb5b68285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341303, "uuid": "a7d554b9-9d20-437d-93b0-40e5e57413c3", "value": "24576:NFe+stiGYO2DFRCfNUbNuvQWgindSosjcPgjyiwC+:j7qiZFRQqaOha1iwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675341303, "uuid": "b77a31d1-bf18-4f85-ac8c-4647bba96155", "value": 918000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675341303, "uuid": "bdfaeb22-739a-47b5-829c-a2e8f95ef15c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675341303, "uuid": "3b42469c-a414-4541-b1fe-18481b675bf4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }