{ "Event": { "published": true, "date": "2021-05-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-05-27", "timestamp": 1622160182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "658f2439-173d-43b7-bfdb-85f51bf82d3e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1afa483-bee2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622116722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116722, "uuid": "813fc9c7-9879-41d9-9e8e-a7262e3e780c", "comment": "Malware payload (AgentTesla)", "value": "2bdbf39b02914ccc8ada9a047c5bff74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116722, "uuid": "a761233e-8c07-413f-89e7-765e756e7b4a", "comment": "Malware payload (AgentTesla)", "value": "00c1c7137096f7619f2da696db483be08ebfbe6cfba6bf4eacceb5d60be4a095", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116722, "uuid": "f08237c2-d47d-4430-a7e5-725d1c3ab557", "comment": "Malware payload (AgentTesla)", "value": "01aef4b653471c956600694ab3661101e68175f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116722, "uuid": "653875d8-3a2d-4fb4-a6dd-b82cc141aa7d", "comment": "Malware payload (AgentTesla)", "value": "88f1603a6b558fae6c8157f8dd4ecf0967e10dde3cc569b31c395967f1fa7cf654e619f85b00593d825082aacb0960e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116722, "uuid": "11273bd3-b05d-45aa-8951-2a397006c6e7", "value": "4144221A2AC685FBED17967004BDEF3EC6B7AA140612951F13001FBB07782D3F6995B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116722, "uuid": "f3ce5e72-f2c7-48cc-b489-ac7eaa35e699", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116722, "uuid": "ccf6aa23-f81e-40cd-b7da-da65b903e047", "value": "6144:cQq2l2Zll2BykmCp76iauYZolKBBIKALzQKSv4muke:Pl2TkmgDBl40T6uke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622116722, "uuid": "fbbd2f78-c767-4375-8a05-c088903e7f29", "value": 275222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622116722, "uuid": "67b864d4-fdf3-43c3-9bde-bc1474a50db2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116722, "uuid": "2bdb13b7-7f22-4e59-8485-4509f73bed34", "value": "Balance Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad84a3a3-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622141545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141545, "uuid": "84957044-0ab4-4c98-a06b-166c98ae67e7", "comment": "Malware payload (RedLineStealer)", "value": "81b1d226ce95493de687b43bcacb6121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141545, "uuid": "1e4162fe-3941-4519-ac17-ac79295427d2", "comment": "Malware payload (RedLineStealer)", "value": "015413a27756d532fb91bd33bc910274232efcfe170cd93794dd1ebfbac72212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141545, "uuid": "ce882ff2-e261-44df-80a0-ee1baea1e385", "comment": "Malware payload (RedLineStealer)", "value": "d5a07888e4368d1f5a50b5ee162c22b999888e42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141545, "uuid": "575ac07b-04a1-434c-8a0e-2689aa07c4e4", "comment": "Malware payload (RedLineStealer)", "value": "96bf0846355f02f40a081fcd1c05f99c60301ed9d322e2d92014f7700552ba664f9ea9d738a5c0cc734ef360fe7a2181", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141545, "uuid": "6b9f050c-e468-41d0-91a7-b2a2eeeaa319", "value": "51B4F103F9C588B2C47219311A29A7517A7D79201F288ADFB3E84D6CEB751E17335EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141545, "uuid": "98496832-8ff9-4382-aba7-522d08cf991e", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141545, "uuid": "46335aa0-193c-4b6c-a529-b550fef45e6b", "value": "12288:OhqxSLo5C1Ps4XhHcd8/r4Vf2cSryHbbhfpH0Xklk:OHLmCiIh8GcVf2c+yHb3lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141545, "uuid": "fcc0b8b2-6ae9-48a4-b0dc-c2a03fd64046", "value": 494373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141545, "uuid": "6d22f160-6257-4771-b0e2-d11cf80ddd8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141545, "uuid": "26fee525-3147-42b5-afb6-062a16b82300", "value": "81B1D226CE95493DE687B43BCACB6121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91137826-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141497, "uuid": "3b2cd338-0c16-438e-870a-c7666e990d32", "comment": "Malware payload (Stop)", "value": "3cb8a1f2a9e41cf948311f4febc86662", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141497, "uuid": "92b6733c-048b-4a43-9081-d7f3e42a2dce", "comment": "Malware payload (Stop)", "value": "015878c38776e7940231d6a6b9be6cc9bdfd984271e519e9251ac57b21a91d1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141497, "uuid": "00a09010-beb7-4ddd-88b7-6cde105789a7", "comment": "Malware payload (Stop)", "value": "9cd70d5f5cea85d0afc4d415dc5b90924c828c9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141497, "uuid": "487c65ed-9122-477d-9b33-63c464bcf537", "comment": "Malware payload (Stop)", "value": "6bf582a62a78c5bf8190b476322a72f611d00abb6ac3b4b254d042ae99ccbca42dceb65fa3ba1ebc884a0d4c2cf78eb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141497, "uuid": "afd78fc6-b69e-4716-a72e-db3e8469de8f", "value": "8D05F120B6A1C038F1F796B4CD7982B867297DF26B3450CF72D92AEA5A346D19C30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141497, "uuid": "03c1131a-4886-4602-bd3c-abbcc73e7f82", "value": "556bc424bd608c9e064a122699e67eca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141497, "uuid": "89d16ca3-871e-47d7-8087-8ebebb38d9cb", "value": "12288:EJcTmlmyPthULtLBondqp2hmor2tX5ajq8V54i7KCtPJ80nQsRP+V6E0aJAE1rF0:PT8tILBUqpAmeaXwqi7tFVVk6E0PGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141497, "uuid": "3fa76abc-d4d6-48f8-9de0-038b00afe154", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141497, "uuid": "313b6847-6888-42a2-b536-7eb6239bdf35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141497, "uuid": "b79a54a2-ee5f-4d41-b184-bfde53bd67d0", "value": "3cb8a1f2a9e41cf948311f4febc86662.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e0b07f-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141527, "uuid": "0afedef9-0ca9-4c7b-89ab-2b8ffcb1bdf6", "comment": "Malware payload (RaccoonStealer)", "value": "fa6efe30ca525741e65ce82db9156820", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141527, "uuid": "8931e18b-b1d4-4273-9f3a-5988c4ae1039", "comment": "Malware payload (RaccoonStealer)", "value": "015ea8b72d49366ba4af19e83b676d9caa57ebc98ca1e2e9d5e3ce7292a1ad53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141527, "uuid": "b75f73f4-a023-4511-b152-3995597bf69f", "comment": "Malware payload (RaccoonStealer)", "value": "a1c2ed4bfd7f45af616111b4907b35e50d311655", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141527, "uuid": "6933bbc3-da49-4087-a91a-f43af0413b66", "comment": "Malware payload (RaccoonStealer)", "value": "2afa29f9cf61aec98fbfb432de4dbd36d83673453d9ae50972909b3e8e68a75ea9846c560a209e29748fb7eca1e0d163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141527, "uuid": "34b9755f-dd33-4479-b366-767b4f014871", "value": "DAC4CF30B691C035F0B712B8DDB5827C673A7EB1A73590CBB2C52AEA46345E6AC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141527, "uuid": "47a09c60-ef35-446e-aeb0-ab6723e3f392", "value": "a26f0e6bd2952037425bd22d2a7efb64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141527, "uuid": "f8371818-406a-4ae2-8b4c-e425eca06ee2", "value": "12288:Jp7mBE9n27O+mlW0W7un6eYB/eUqtZEkR7g9fi:JpyE9Mv7u65le8ktg9fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141527, "uuid": "894809e7-945d-4510-afcb-31983f590310", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141527, "uuid": "1472b735-df5f-473d-899a-84f004d9e26c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141527, "uuid": "a3f399a3-3a93-47d4-abc7-6485a8f145c0", "value": "fa6efe30ca525741e65ce82db9156820.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d68d700-bead-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1622093629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093629, "uuid": "65890a80-52ab-48e7-a445-e87e4f45a730", "comment": "Malware payload (AZORult)", "value": "63d167a3dde13e6adedcc524e94410ae", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093629, "uuid": "01927c57-bb79-4eb0-9823-97c2ec66dc8e", "comment": "Malware payload (AZORult)", "value": "0166da02532082c034a8ce64050372ab2ff9b7798d11bbf9518206c12d3bd21b", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093629, "uuid": "3f31be68-7d24-4ad6-acd3-270612990b62", "comment": "Malware payload (AZORult)", "value": "652a8873e24fa58fbd41e2b49e0d7d0be3815ebe", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093629, "uuid": "dd571e16-bbdb-4900-b406-299015713810", "comment": "Malware payload (AZORult)", "value": "51a7bf228530ef76a6c4d9e776434e9f89c098e30ce1602c1608ce6d09907072ded205d967b503c2ff45cc1b8c1b18be", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093629, "uuid": "b2c7fbcb-d538-4147-93fa-7cb594ab4018", "value": "81F3020631DD88CBC9265231927BBA37EABFF740236615176BB45F6B3A611C3CF12690", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093629, "uuid": "a1a1d809-455d-4ea7-96f8-a3f370be4655", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093629, "uuid": "209200b0-398f-4dd8-bf0d-ccef7489ed7d", "value": "3072:cLk395hYXJTMuhnnpbiwhyKVfR68FHo80XvdzxtGENsRG4wHEkC:cQq2m9iwESTIvXvdzrfcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093629, "uuid": "85848afa-a7dd-481a-a08f-252327b7ac09", "value": 168523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093629, "uuid": "3fa61d33-214b-4f0c-8c0a-7f5157d187e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093629, "uuid": "946bf525-be51-43a5-8bb1-522984238d18", "value": "POBKMIN20210000000231PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856d25f8-bf1e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622142337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142337, "uuid": "c663cd79-84ac-4934-8093-7de19d4ee61d", "comment": "Malware payload", "value": "afb651b6577eb5a0b605f1cf56e807cc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142337, "uuid": "c3485a29-150d-42d9-9ec8-0a3c7853dfa1", "comment": "Malware payload", "value": "0187fc0bc8addf4a9dcaf818471743ff9f75d531d341863c74af74f95b3c29f0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142337, "uuid": "410d7cf9-ec09-4759-9421-92355348feda", "comment": "Malware payload", "value": "102cd8cc2da158ce562287af707c1da088e92025", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142337, "uuid": "927ee36a-4746-4860-8b28-265909ffdee2", "comment": "Malware payload", "value": "9a5232ff7648718fd660e1007bd32f721edf22ad177448fc6488799f1777253944a7c6cfbd7cf22ca0cd3aef299ebf89", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142337, "uuid": "570942d4-0d7f-4b96-aefc-0c290dc02c8b", "value": "3FA1FAF466BC4C91DF7F81659678FC2D12D7700396C60789B19ED9420BA9B61710BCC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142337, "uuid": "88108502-2c36-4e5b-82e1-615bf0b47ee3", "value": "96:c3SMC7k1O0kkMAfnvNqJxlmaPsQ20/89yN+/32e7cfRTbw:oSMCUO0N9fvNQxQ+sQ20EcN82eKRTbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622142337, "uuid": "13adcc36-8261-4aca-b845-41fcb35cec56", "value": 4964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622142337, "uuid": "18e885f6-9854-4d0e-a0cc-b89b716a9c5e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142337, "uuid": "0cf3cf81-c46c-47b5-9d66-1e23290123d0", "value": "Order Confirmation.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c18a1e-befb-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622127308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127308, "uuid": "d937e5d2-59a7-4caa-a64a-c82dd2fad944", "comment": "Malware payload (NanoCore)", "value": "5cf7843b7bf6a27ff84c42f0c8c9e6e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127308, "uuid": "ceb86e81-03c5-4270-8bd1-154b1b2d514c", "comment": "Malware payload (NanoCore)", "value": "0248797389854c9ca071aaf4e3c5e27d4a071524505a8b6afb38c5ab05fbd141", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127308, "uuid": "5ca599e4-b15e-4f75-86ce-7fe41d536322", "comment": "Malware payload (NanoCore)", "value": "e878430aca070b4001227281fc578d3e2c122d58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127308, "uuid": "d0fb0409-99a4-4239-9e55-6db884658d7b", "comment": "Malware payload (NanoCore)", "value": "86a3e33392fab359b66f4084ab6c21891391a2dd740966078ac4b7573838283474f7b9adccd21e714a75d603d65dc98a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127308, "uuid": "a4cec148-d238-4f0e-9b65-7ed8e23d2e65", "value": "A215E126CE858E79C1CC19708131275A3F6B6EC2A973D6CDC9C9F87D6C36298963817C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127308, "uuid": "a489f87c-1783-43e1-b37e-d2cd500f4297", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127308, "uuid": "1e1b8f00-5e21-4952-a8f2-6d17bbf54e95", "value": "24576:E74FFFlONmjSfOHIXig/gqTNCIGb86bjT1lT:E74FrUNmaOvgeIGb8KdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622127308, "uuid": "3ea81b51-f416-487e-98bc-bb6366804634", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622127308, "uuid": "3088a702-4696-4f8f-a22d-10fb9c89dbf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127308, "uuid": "e9e2cbf9-5027-4c9f-bc0c-418a4215616e", "value": "Payment Advice Reference0000 docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea929b2-bee9-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1622119589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119589, "uuid": "3bff5203-5d3a-413f-8734-62789fbafdd0", "comment": "Malware payload (CryptBot)", "value": "6122c77e5590527c7870064c51531e9a", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119589, "uuid": "b8e3fbc7-8df6-4f3a-a996-dc2d449e9d31", "comment": "Malware payload (CryptBot)", "value": "056cc0e43fd5b75d6aaa8ab8651394428b1751c538b92aaa088ee3ff79efc20f", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119589, "uuid": "82b4d8ba-e613-4d45-ade0-11ade9f8dc56", "comment": "Malware payload (CryptBot)", "value": "2df8ba456f571dceecc83a14088c289115842f07", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119589, "uuid": "237bbcc7-d994-4ac7-9b39-b891366f0f48", "comment": "Malware payload (CryptBot)", "value": "c0164a5af381db977f73b9cdca053d8fae9678ec0b81ebfad7536b074fd90f8eaf14d28078ded3c0e4c075888bda811a", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119589, "uuid": "2556b17e-8289-42b7-aff5-67e093714f7f", "value": "7EF4F120A694C034F0F312F445B9A278B93ABDA1A77090CF62D47BFA5A345E4EC71B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119589, "uuid": "5e28bcc5-b8fc-4597-92fb-68456d9ad749", "value": "0693a6a9ad49d4475fdba0f7412d435d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119589, "uuid": "2e9d2c3b-cdf0-4826-9663-9222eb187a3a", "value": "12288:svCXRLNg+vDKKc9aj3qWRhqs9KgFr9HrWs0QEY/9E0Ugc5uYn8Bb+k5R3KmKOiUV:sv4LNisbP9pOQ5VEQEXwbdarOiUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119589, "uuid": "7039982f-23cf-436e-9609-2436074f7060", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119589, "uuid": "68265693-a60e-456f-8959-c8c88ddf3311", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119589, "uuid": "2107de3f-d3ce-4763-a142-c65432c1c4c2", "value": "6122c77e5590527c7870064c51531e9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a4523a-beac-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622093557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093557, "uuid": "09fa2290-e1c9-46ec-891a-f312f4eadb57", "comment": "Malware payload (AgentTesla)", "value": "4ff8bb7a9f01ac5d510b6a5788913165", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093557, "uuid": "efdc9d22-2ebe-4772-ac62-424abad01801", "comment": "Malware payload (AgentTesla)", "value": "06edf7ddc282ea3b4f44a968ed79184ae9a9af4d52894f6916e2fe43923b5fe0", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093557, "uuid": "7142fbc7-17c8-4b0d-9628-7045ab8b2dce", "comment": "Malware payload (AgentTesla)", "value": "2bbfd99696559242ebf8a956f0d1547b63f7d0cb", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093557, "uuid": "6c1efd5e-557a-4333-90db-c265a9191e72", "comment": "Malware payload (AgentTesla)", "value": "698c736ead9fc407d73fb31362b5326b633bcda3cfa5be8ae13c4b1fcea072633ebc288ac5584f148375f4701395b7e4", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093557, "uuid": "fec4b5d4-f759-4249-8472-67461d058934", "value": "8BB423783B6EEE07B1D42B17B859E3D0473FB4629E943321CAF6B5D1950C8A66F110B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093557, "uuid": "70e45f26-fe00-4545-8414-855a9a3bb0f9", "value": "12288:oGwFtxG3q1rKye935LPlm3DxcBIC2JAyVQBIbbOEdG7R:oGOt0K6Z5ZLgJPQB4HQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093557, "uuid": "7e5c4eac-d3ad-4db3-9bc3-b44c3d576de0", "value": 523576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093557, "uuid": "3f24553e-e41c-4044-871c-0fe9c6e41410", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093557, "uuid": "de8eb5c2-3d99-4c9a-b94a-ba180bfcc85e", "value": "Scan docs.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d6cebe-bf09-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622133432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622133432, "uuid": "dd0f079a-04ff-4136-96ba-6b9afaab4419", "comment": "Malware payload (AgentTesla)", "value": "bc2fde30c802ad61d5a875c18888b6e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622133432, "uuid": "ea5902d9-0dac-4aa7-aafb-4d4e18bebb94", "comment": "Malware payload (AgentTesla)", "value": "072bf8223b1f7319bad96fd52a9ef470b3c0b7f2a3c1ea9482e1a7a4e27db343", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622133432, "uuid": "577ec3de-33a6-4021-93da-1c21c51662d3", "comment": "Malware payload (AgentTesla)", "value": "f833c431fac787a029e0017e1d2b1e1ff565157d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622133432, "uuid": "0bd5187b-73ac-4b8f-9faa-bfe0ac5d5a87", "comment": "Malware payload (AgentTesla)", "value": "8c451d2641ee9b9b5e378427a1a6a8216ad17844a33014889a031313491fb46594e25326c0433e69254ab55c57446989", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622133432, "uuid": "d45e6470-074f-4821-b122-db06084ba0eb", "value": "C725DF847110B48EC816CD35AAACCC64EB5A3C62B3565F837D93336F59FF5828F112A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622133432, "uuid": "359dac90-c69e-4902-b345-f4d3d5eb4173", "value": "12288:saVRa0hy1RM7O/LtKgVIX5og+uLCM0l+/ealw0Oz0+E4H444h:tW0hkF/hbIXKTu+tl0lw0C64H444h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622133432, "uuid": "e9b47cf5-eeed-4058-b262-43baf419d57f", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622133432, "uuid": "91a88a72-801e-491b-ab73-376f72fd37c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622133432, "uuid": "7de9d867-2c82-447c-89f6-dd84a5fc4c88", "value": "Shipping Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfd34f0-beac-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622093442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093442, "uuid": "2b3c919a-7f94-40fe-a9e0-29ec5352afde", "comment": "Malware payload (Formbook)", "value": "f2af2d11edfac75d0d326ceaee8e3c2e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093442, "uuid": "f01e3642-6246-47da-8545-24acf421ce9b", "comment": "Malware payload (Formbook)", "value": "07f73ff04ab80e4556fa01e1e93c345d768988b0d4cd344dafb605273bc651fc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093442, "uuid": "936abfb7-c678-45b9-8ad5-65c3e2233148", "comment": "Malware payload (Formbook)", "value": "b18827e7784ee6a86beecea0cf0eb3c147ba6c11", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093442, "uuid": "a68a0485-bc0d-4b58-99db-38190f2d6c22", "comment": "Malware payload (Formbook)", "value": "17d8936680e2766a629d692090b45ebdad9b4360257518c2b4dc7d28db5504a7ecc15b100b7411c270570c119941eb66", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093442, "uuid": "06daf5e0-c498-4776-bc39-494406035855", "value": "2535334A39B65BAD91B3637B7FC488CD66F1A0CB1DBE5C85D464B342FB62B84442123C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093442, "uuid": "56cc81e4-ecb5-4705-a33a-2c0c283057f3", "value": "24576:9W/rL1+qQnud/OVa/kBuJIPjumxro2DCeY+X3eQ1+i:I1+BudH/quJIPjV1zln115", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093442, "uuid": "efb6f8be-51e4-44a7-8f9f-989ebc59b09e", "value": 1150256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093442, "uuid": "bbdf4a4b-0eb4-45b4-a863-bdae72480291", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093442, "uuid": "81158ede-c33c-4dd4-9494-bfca4b8c1058", "value": "request_list.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83bc191-bee9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622119766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119766, "uuid": "82ffe052-3d61-4f02-b91f-5fa836066a09", "comment": "Malware payload", "value": "16a784f0bc650f261cc77be66df1bcbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119766, "uuid": "38d3ce34-c0ac-4704-b884-7ad046ab9190", "comment": "Malware payload", "value": "081d46c9eae290ad95937c1e87ac2fbae0b345ca7d00a4fe7d5ed8384d200ac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119766, "uuid": "1231e68b-9f1f-47eb-8474-065e3feeae45", "comment": "Malware payload", "value": "0ff2e0829833aa322ac75d1c7d18bc06304fecc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119766, "uuid": "50ac6314-8e4b-401e-b831-9a8eb24d79e9", "comment": "Malware payload", "value": "17db04055d36f5dfd74d34da7b7e760b7d27b8c4e2062a83d3eab692fd76d11d245ce0411c1c80e8c45d1aafb94a2c09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119766, "uuid": "23918e06-23c8-4412-8402-e3bcf1daff66", "value": "DA749E3167E0C039F1F362B449B59379A53A7EE26B3491CF52D13AEA5A316E1AC30743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119766, "uuid": "ed60a49e-9423-491c-b385-3dd0aba9671f", "value": "556bc424bd608c9e064a122699e67eca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119766, "uuid": "a848f7d6-76a6-4943-bacd-c213daf06588", "value": "6144:O6+TdqXlE7/wVIEwg+6TWwxnSks5SzL482DTR9Znk9OGer:O6+Tdqa7oBwg+6HIkGSPO1nYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119766, "uuid": "ec0fadf3-276e-4d06-9506-c845125dbdc5", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119766, "uuid": "3da38dc1-10ef-4853-a5ae-0eab332477a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119766, "uuid": "f21a83bf-1ab1-41aa-b299-5233c9787a0b", "value": "16a784f0bc650f261cc77be66df1bcbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ec3e2a-bf1e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622142519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142519, "uuid": "e246a981-9b8b-4e01-a9cc-8420c93cedae", "comment": "Malware payload", "value": "af419df015339576f0a09418772a2936", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142519, "uuid": "cbbb9efb-f4cf-462e-9f0f-a733af036c2f", "comment": "Malware payload", "value": "09d7088f3bdb7e5072dbd3698b2453ba3915b046709596a30819ada7b701c7e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142519, "uuid": "aec43474-1258-4191-8872-36066449cc2b", "comment": "Malware payload", "value": "621fb99cbb22503786aeb24e2f82f8fb84ac8b65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142519, "uuid": "819d50a6-02d3-47cc-b7b5-d0dfb09bb255", "comment": "Malware payload", "value": "8bff0336870b153d416fcdd8203b1463a33188cf70589fddbc68d73395e065bd0aea49e38796adb8b631b409a12cc693", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142519, "uuid": "b8b843dd-46f1-4712-9473-df5837f96787", "value": "D655D02E26646716D17EC3F8C9D09517D3A2D0277122AEECA8C143A50B82AC77DD73BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142519, "uuid": "66a7ddc2-b365-4a1b-970f-cc2e88b3620f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142519, "uuid": "123737c9-9277-4c1d-ad77-e5558f87d894", "value": "24576:EXbBqybvsoKoyPtayStr9CpldGV/TJvpkK2WAgZBBfP70VAm9MEK:EXbBqjoKXyoXdGVsFWTJPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622142519, "uuid": "c05f28f6-db0b-4deb-b0ce-aca43af4db90", "value": 1387008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622142519, "uuid": "99f151bb-e10e-45db-911f-d97e398a694f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142519, "uuid": "a4183bfc-df5c-4b7c-96c9-3a7dd707e2eb", "value": "List doc__Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f365502-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141467, "uuid": "30dae47f-220e-4355-95b3-4e87e530787f", "comment": "Malware payload (RaccoonStealer)", "value": "4baf16d80b49243e792e35b4dbd7257b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141467, "uuid": "3969e6bc-35f3-42e7-81d1-e299ce62bea9", "comment": "Malware payload (RaccoonStealer)", "value": "0a9594abb9e096e856116444125d74e29bace6bc8a0c80c8fec53e638463997a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141467, "uuid": "1bddddd0-003c-48dd-8f5f-673a56dec211", "comment": "Malware payload (RaccoonStealer)", "value": "8fcf3a275541965a138d07182b5ef224c2baf732", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141467, "uuid": "b7e727ad-4d24-4632-860f-38e488f7bfed", "comment": "Malware payload (RaccoonStealer)", "value": "417ed01ee1fac4b8299c2ee8578881718e0c25c495f00425cc58e6bae3d44a1386e956951893e625cc7620c915635855", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141467, "uuid": "5df07484-fc17-4713-b2c3-b9827292a675", "value": "1AC4D0206AA3C035E5F396F448B69274A53A7FB2573691CF62C53BEA46346F4AC30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141467, "uuid": "970efaad-1e9e-48da-a19b-1fdac9b20aa4", "value": "556bc424bd608c9e064a122699e67eca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141467, "uuid": "68f3015f-121b-4400-8496-817befb72f8b", "value": "12288:zaJwT8FkULxrsrakK7Ik0fBGi6JUyCTc9+nObaFU:vTKxh1F/VlCooF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141467, "uuid": "60521175-a195-4542-a2e5-17dd509bf45c", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141467, "uuid": "0c084f6d-aa4c-4c97-bf3b-f553da998815", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141467, "uuid": "c61cf229-c3d4-4387-a1d8-d57243e1980b", "value": "4baf16d80b49243e792e35b4dbd7257b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364ce52a-bee6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622118152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622118152, "uuid": "c9facab3-b9f6-4504-82ae-39d8842cb6e8", "comment": "Malware payload", "value": "d952a51f3dd6d9115330ecd359037ca9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622118152, "uuid": "995d4afd-ace6-4c09-a9d6-610a31e27ccb", "comment": "Malware payload", "value": "0ad7d9d858a6f0a0b70ba22f44b2dd02e572a1c63ffdb5209b25cabe1c176280", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622118152, "uuid": "badfd250-7547-4d2b-ba95-e520f32a0d48", "comment": "Malware payload", "value": "aebcabf2f2ee67c911e0e4c449a9aa0aac7965dd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622118152, "uuid": "e2befa69-c323-42c8-8841-df3b7edcb07b", "comment": "Malware payload", "value": "875727a66ec21db67fc59fbefe47021ee6c065849f461c33c11f85028182aadf96ac4bebf4052a5601869fb0b305d652", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622118152, "uuid": "372deb3b-55bd-4ffe-844b-56d9ccea9e4f", "value": "2F052390DEC82F6FDF294379640BD70D21C5FEBC9365A2B792E8749E2139A5090C7C62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622118152, "uuid": "3e452d65-5f05-4ee6-b74b-d55e543e668c", "value": "12288:TlHep/GnT9YzWHkGY8djc0AHAYQSLp3OZQnxn51gSSBbdb4n6gP3Rgbib6s:W/GnhYzWHkCmdHn1F551gP23Rg+bb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622118152, "uuid": "9412f593-2bda-424f-a6a3-a8d139979302", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622118152, "uuid": "f926bb5c-88f2-4d01-820a-7251e085a10c", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622118152, "uuid": "a345a754-466e-448b-b227-f6da1f54fa09", "value": "0ad7d9d858a6f0a0b70ba22f44b2dd02e572a1c63ffdb5209b25cabe1c176280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93fbc99f-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141502, "uuid": "5311da67-bd01-4af6-9e62-8ffffbec9dd5", "comment": "Malware payload (Stop)", "value": "b557e8133dab5a0832eecd845afcffbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141502, "uuid": "71e5cdb4-184a-41e0-9ac5-bac9d3c2fc16", "comment": "Malware payload (Stop)", "value": "0af763abdb40c163bb84dfe6aeca0ef709547aa8d690f0f0600db44924b366f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141502, "uuid": "52c3a961-83d5-4366-be3f-1607c7525036", "comment": "Malware payload (Stop)", "value": "bda90354c252e44b3ee5aac4f194966b038b40e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141502, "uuid": "372e2c3b-69ab-4d71-97fd-8f8d7d549d71", "comment": "Malware payload (Stop)", "value": "71877c0e4b212abf845fef0cf0a300df15e87bad9721a6f94dde1028cb77e57d60ba9f24d3d446e8e46e760ad2964933", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141502, "uuid": "36480948-53dd-42d4-8554-a07f56de799e", "value": "8105F121A6E1D038F0F322B545B6C2B8A53A7DB2BB3090CB52D13BE955746E7AC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141502, "uuid": "aaa5eeaa-7e2e-490f-84f1-0b263ae740c8", "value": "556bc424bd608c9e064a122699e67eca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141502, "uuid": "9576c080-6038-4646-836d-d96f34a14850", "value": "24576:KT05PoDvM4c5xgaBkIIYis9blLtSwpOsgSp3H//:fevM4c5xplIYiWxtSfsz3//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141502, "uuid": "f1517fc8-78a3-4667-9e8b-6ae5dac53b8d", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141502, "uuid": "600a173c-ad06-4ea2-a2e4-ae78807b2c83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141502, "uuid": "ce29ba9d-ae9e-4524-99a8-b7872a427fa8", "value": "b557e8133dab5a0832eecd845afcffbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc832d14-bec0-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622102164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622102164, "uuid": "ee6d4d10-b849-4c44-b948-2ac050d9c8e2", "comment": "Malware payload (SnakeKeylogger)", "value": "be3a31bbdde54f98e9c76766f3c76baf", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622102164, "uuid": "7e27ebfe-2afb-4aa7-9729-0eca11df7057", "comment": "Malware payload (SnakeKeylogger)", "value": "0c16e5263622cec17399099c20dcb7afe3cd285d1ac9d2731593c3de0d1f4000", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622102164, "uuid": "ce760ed0-2d37-4a5c-b133-0659fb688513", "comment": "Malware payload (SnakeKeylogger)", "value": "5c411bede2d4269cb37e0eadc9d69eca6785384b", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622102164, "uuid": "88726d7f-9274-4a64-ab66-83cb04a239c3", "comment": "Malware payload (SnakeKeylogger)", "value": "5f65797f019963f5ddf12fa0398457a87c743a9d401bb567f8b92a075b5eb403b37b5561e500df0535e68770762780cc", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622102164, "uuid": "5a751764-6506-4f3f-9cd4-ea44744c11f3", "value": "21054A3439FA902AF173AFB55BE4749ADA6FBB733B07641E109103460723A81DDD253A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622102164, "uuid": "90ae1581-20b0-4771-b34e-b41997f17fb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622102164, "uuid": "014636f7-ee67-44a6-b356-e6f2112c01ba", "value": "12288:N7A2K8iTGFN+xyNBVJE4UXsD4I7+4wLZ3DjL4MKOk0R2uRb1Ttpa/7jS5df2eli/:FBqIja4UoA0AL80Kr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622102164, "uuid": "8fc97994-959c-4c64-a789-cf4932147c85", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622102164, "uuid": "8b21df4f-d14f-49c4-8d8a-0b3d20e8752b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622102164, "uuid": "4400e54a-387d-461d-8f16-18a5124be025", "value": "Original Invoice PL&BL Draft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9209a78-beb0-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1622095152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095152, "uuid": "9b9ba6ec-d377-46fd-90d1-23182ea650ae", "comment": "Malware payload (CoinMiner)", "value": "d9d02fc8a49a364b07e681e6848d1bde", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jeepeg", "colour": "#0DF790", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095152, "uuid": "dc85cf41-03e5-4843-8704-b2ec7a285c92", "comment": "Malware payload (CoinMiner)", "value": "0cd3dd68e24b1eaefd656aec5f90d94e79955e61fd1e90e13594d2413e6a135b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jeepeg", "colour": "#0DF790", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095152, "uuid": "60031abe-7e42-4fa2-8c48-4fd1168e0608", "comment": "Malware payload (CoinMiner)", "value": "e6f3f91045436f04c9c13518de86c05ef14061b5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jeepeg", "colour": "#0DF790", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095152, "uuid": "af58a143-22de-49c9-ad69-726bbe9207f9", "comment": "Malware payload (CoinMiner)", "value": "1e6e949cf972a69c36b12a52016ea79ed8a2c1f3e3c60f3a37f369c52e5880d440559c18948e5bf255764e64fd710578", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jeepeg", "colour": "#0DF790", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095152, "uuid": "110b150f-4ad7-4e29-ba11-4b47998bd724", "value": "D0652380E9D996DBC376097A2A69CE800F67E9430016CBC95DD0F66C6CAFC71454FE2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095152, "uuid": "b182a7f9-de01-417f-829a-b337990645f5", "value": "6e20144075bbb41a42c79b3e320ad5d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095152, "uuid": "e433af05-595c-4ba8-aaae-a45525f842e0", "value": "24576:IVnjN6MGHv+2xIuY3rfBmKU4vJTxq5MM2d6LNXV0PtGap75qsQb0XwV:IVnB6XP+2xIuYtmKb1x82d6LT0FGa7CV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622095152, "uuid": "d23ceeb8-887d-47bb-ac6f-2deb30aeab2c", "value": 1491327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622095152, "uuid": "52078513-e544-4065-b370-64c6b48e9f84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095152, "uuid": "e7a310f8-50ac-4f74-b174-146319493545", "value": "jeepeg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21809c82-beb2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622095784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095784, "uuid": "315395b7-3686-47a1-addc-d8468809c0f1", "comment": "Malware payload", "value": "f40eaafd653c30bd0a80b35388943f79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095784, "uuid": "90f424a4-3e25-4119-a9b3-d8b093752636", "comment": "Malware payload", "value": "0ce75a68a6c717a15ebb6bb1e62d6e2d2af1c8b64b047ec3d9dd50434e9ecf40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095784, "uuid": "58048c0f-27ad-46ff-a4ea-ec095b46348d", "comment": "Malware payload", "value": "c4cff09be7aa8eb62017a2f71d2beafa69ead940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095784, "uuid": "fe8f1f73-9cd7-4b8a-8b43-ab011ea9aa38", "comment": "Malware payload", "value": "c02ed4efea789bd3a88852a7605bc15853a2b303b7f336710b9229404a1dce1ed0438166afcf3a127840fc13466dc6a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095784, "uuid": "b981d03b-c0fa-479e-874b-dd3742cf928d", "value": "05456C27B3C284F3C1634A38DD17A6A85C66BF31393498967EF52E0D7E7A2413C29197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095784, "uuid": "29071a0d-d6b8-46c6-b559-92a6b7e70bfa", "value": "f537b216fd1d228d82b4c032326b2d86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095784, "uuid": "0f42445d-1850-4746-b5dc-6fdb3466034d", "value": "12288:14rDy/HJMbgSSxbAQ3LkDJ1iqZ6egzItpFSofPv01jHvfbQOpwINsJ:14qmjSxbL4DJ19AegzItPjc1j7QmsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622095784, "uuid": "a33d5f2e-12bd-46d6-9a99-289568fe4072", "value": 1192568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622095784, "uuid": "671d582c-8669-4486-8f78-f94dc285e270", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095784, "uuid": "c45109ed-f9da-4c09-b6b4-eec1c842848d", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1ab08f-bf31-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622150456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622150456, "uuid": "97ef4019-2156-4821-8a51-0e4662b3b674", "comment": "Malware payload", "value": "9d7e18c61efaf1a7362e15654d13be63", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622150456, "uuid": "2d4d0591-e3ee-4679-a972-63dd0ff5b1c8", "comment": "Malware payload", "value": "0e37236baf4ffd32c94711ba767810af3d24049cd9fb9e5c21535839c05f2491", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622150456, "uuid": "6bead1fa-91c1-4403-8b77-2835768fb760", "comment": "Malware payload", "value": "d22104b8aad8792fbd98c30a1cf50507e89e7e74", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622150456, "uuid": "928001a8-762b-4b05-907f-2432401d3911", "comment": "Malware payload", "value": "345f6dc90abf75ab0eefe1e2b4763e120133ff610d48f568b1e9577f5986c79d444de19ac039fbcdca490353f905bc00", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622150456, "uuid": "343c8229-56fb-4ee2-978f-0851e3a54c9e", "value": "AA64F10035DA80B3E6BD0C391474A1AA6B673962ED71DDBFA760566C0F742D08E36D2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622150456, "uuid": "634fd91b-3071-4b17-8bf4-ee16a9ca6303", "value": "3be1d5ab8d72a6cacb37ceab2cf243a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622150456, "uuid": "60e5f57a-7856-4610-a48d-96295e4fdf4a", "value": "6144:gIkY+ERzFNuS07UYGfPnO9iKDXO0mVxTizAQJCylf:3xNdz3OUYt8K/UxCvDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622150456, "uuid": "723f2ac9-9083-4c4e-ae5f-dc275df13308", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622150456, "uuid": "02d67068-1edc-4223-b010-a5b3dc2fabb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622150456, "uuid": "a571309c-1951-49d0-82fd-2d2004409093", "value": "0e37236baf4ffd32c94711ba767810af3d24049cd9fb9e5c21535839c05f2491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e84ee5-bece-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622107953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107953, "uuid": "3a26b269-5322-463c-83f1-441c462946a9", "comment": "Malware payload (AgentTesla)", "value": "805c9aeef846d60def078754f471ccfe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107953, "uuid": "de26e992-192c-4dac-bfb5-840f9c7fa8fe", "comment": "Malware payload (AgentTesla)", "value": "0e50683305682d628b8d4671db7d774a5fcd988a5a33a73c8bba6ee4423c0f07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107953, "uuid": "d31a5b86-2125-4469-8e27-94a9da6d76a1", "comment": "Malware payload (AgentTesla)", "value": "cfb02e22cf65783bef1f86f483f8e5e53172fd11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107953, "uuid": "22096b31-40e9-426e-b036-ae0fca736f55", "comment": "Malware payload (AgentTesla)", "value": "72c975f669d91b9028117b22c3157fcf7870c8d93b917b3e6849289041bd16c2b1d9034b9b7d9e0422c7fe68408764b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107953, "uuid": "3686ee7e-f2d6-4eee-92d5-e27363bbf5bc", "value": "8DE4BE91A290A4E7CEF85E7B6A0ADE340F217DF8E11991A535DC3D9F74F66F30244182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107953, "uuid": "dac8198f-6953-4e59-a10c-b1f40576d26f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107953, "uuid": "c8572a7a-f171-4505-b178-9e15e12b51eb", "value": "12288:y1iOz1A5/kZcv0KkbXnl9g2WQr/tPDLueGX52MMMMMMMMMMMuMMMMMMMMMMMMMM1:mz18/kZcMK6Xnla2WQr/tPDFGX52MMMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622107953, "uuid": "1243ef4f-b3f8-44c0-b643-61e3ea731025", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622107953, "uuid": "37519c56-ed3a-4250-acea-8606365b784f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107953, "uuid": "17c41b16-f504-44fb-90a2-15c509f2a749", "value": "Bank_Information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78017b6c-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141455, "uuid": "d1f1a1b1-6d02-451f-8907-0f11cc7f4485", "comment": "Malware payload (Stop)", "value": "27c9c2b308128510ec9c0a4de96030d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141455, "uuid": "15a190a8-4c22-4dab-93fd-ef1c594fe5d5", "comment": "Malware payload (Stop)", "value": "0ef85dd4ef72b440484579832f14f83ac6c769fa3ff03a7e8a387adba424a54e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141455, "uuid": "f5664f7e-f8fc-4823-a969-ba76d03c906a", "comment": "Malware payload (Stop)", "value": "2182a7b49b0f14baf37a27ae40f1eea13f1656aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141455, "uuid": "0b0903c5-4436-4eb0-bee0-c67081dc39a5", "comment": "Malware payload (Stop)", "value": "8dc79f286a931234996de95e2598d8d913c8d159c0b22fad41d089b50e674943f8618d14dccf985aa0a766ff30f9a35e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141455, "uuid": "f1d425d0-b8c9-4cd1-b10f-71397c8258ce", "value": "DC05F12C66E8C034F1F716F544B58278A93A7DB2AF7840CF52D42BEA96366D4AC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141455, "uuid": "9d2f7d09-1b59-4c63-81e2-4f8b4f9895dd", "value": "bca4c139115857ba195befba3c3bfd5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141455, "uuid": "ec1ac204-c947-4c0e-8259-d5fd47c39fb5", "value": "12288:HDb/9DZytrSs73eOcuU7ftONAwZAEmFAiifsPGothlkRONGeHWHp/TtDCSwM:P/sr3y7FgobFOfsOoCQNGmmp7teSwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141455, "uuid": "593b12da-2c9a-42ac-9654-68b932b69415", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141455, "uuid": "b1bd5fe1-e1d5-4df8-a184-2ba6c55c503a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141455, "uuid": "a159053f-dd37-4b8c-b25d-2312cd99c89a", "value": "27c9c2b308128510ec9c0a4de96030d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5659e37b-bf3c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622155143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622155143, "uuid": "863fb0b4-4761-4902-8c55-06186539d1a3", "comment": "Malware payload", "value": "b0d9b6a3cb10c203447630adb8d72340", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622155143, "uuid": "57b70277-8b93-41f6-b36b-79b9358f21f3", "comment": "Malware payload", "value": "0f1a79f5fb1ac35570ef10c302c36de882401d4acd7ad686523f0b47761eea6c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622155143, "uuid": "918b707c-a16f-4f61-9edd-65fafa5378e2", "comment": "Malware payload", "value": "aac9814d402568830e17d6619fc4a4a5732110f3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622155143, "uuid": "3f06226b-2073-4809-90a6-fc7fc3176adc", "comment": "Malware payload", "value": "9bf402e699131915edb38c94cd994b6db35064ee1e0c237eaab2df67ba3caded48643e7716c64ff3b6d2adff0775b2a7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622155143, "uuid": "6e612add-a517-4952-95db-a3ccfdb087fb", "value": "8003F11C08287CF7E75F55F3A158486BA7CC159AA2C4D036AD31131F6AB911F2F9BA0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622155143, "uuid": "272d31bd-af2f-4dad-bdf7-b5d682134d66", "value": "768:I7Adtiew89CBtvqj+9Styx/J6qYpZgUquOuLvJGOoc8JHYMLbdB46:I70w89Cbii9Sgx9UPOuLocwI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622155143, "uuid": "41fe7d0c-11e6-4a1d-8c40-6db9d637035a", "value": 41114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622155143, "uuid": "bb9cd51b-1d27-494a-be82-a91d73c70f9e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622155143, "uuid": "a72b5b00-22e3-402c-9000-7f441eac4c4a", "value": "SecuriteInfo.com.ProbablyHeur.W97Obfuscated.28009.5354", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9573acbe-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141505, "uuid": "43aa90b9-d19c-47ed-9437-2f2a954c41e1", "comment": "Malware payload (Stop)", "value": "731336eb82ff5c632d6a8b5278069a1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141505, "uuid": "8c6cad7e-ce57-4387-86e9-3cf5540621a4", "comment": "Malware payload (Stop)", "value": "0f6ba9459b661a25b94ad0a376324ef821d3d6c5e6fecdbe4b3b44f89a57a865", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141505, "uuid": "7c65ca21-e62c-47a1-9928-b5dcea3e7632", "comment": "Malware payload (Stop)", "value": "a77d9cf6a62764d874d86c599a9ed221939acc45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141505, "uuid": "89d85f41-e4b8-4ae8-ac70-25e03e418d2a", "comment": "Malware payload (Stop)", "value": "262a745c4017392b1f6a67100dce04f1d3da5a4293490d731b9bdfea2f597a5f082a13658dc3dee728602bd44b2a2f40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141505, "uuid": "9c1f0953-7632-4d13-b539-b1f1bff507a8", "value": "FD05F020B291C039F0F72AB459B69278E93A7EA15B3490CF62D32BDA57347E59C30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141505, "uuid": "bd439ef6-2950-486e-87d6-f8009a630252", "value": "fdbe3f2aedac4f7a47219085c5785404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141505, "uuid": "c145008a-646c-4332-aad5-a28bb5ce663d", "value": "24576:5wgloqeQBkVZHcCv361hPoIzKIOf4UoP99bvu:5AAkVBcCP6Lw8OgBPTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141505, "uuid": "baefa61a-0221-40f4-b84f-71a5b811343a", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141505, "uuid": "cbc39652-5f31-454e-aab1-1bcbcc4aaccb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141505, "uuid": "904f5c28-b3b4-4db4-91fa-d4ded7b1af73", "value": "731336eb82ff5c632d6a8b5278069a1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65652b0b-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1622141424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141424, "uuid": "e17cdca3-467c-40dc-bd5f-d5b689a63391", "comment": "Malware payload (AZORult)", "value": "42ef7d3c5c8207031217b7bc0271b7bc", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141424, "uuid": "e530d1c1-51f9-4bd6-bedc-3634617b9bcd", "comment": "Malware payload (AZORult)", "value": "0f7408139a27e01de88a1a7167954990b075124f3ed31348d6ecbd2d2660e057", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141424, "uuid": "d0f7ef73-220e-4922-8d63-4e7abfae3b4a", "comment": "Malware payload (AZORult)", "value": "f288798d52f0d6fd8f55399463c5c5c995001009", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141424, "uuid": "847de93e-afae-4f12-8ca5-663d22b9da4c", "comment": "Malware payload (AZORult)", "value": "569e40f10ca1febe0d1c601bf3f7712a8cec2106df406f64f79235b79898e9a8206168400cf9ab674dcfb86c196f07d4", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141424, "uuid": "6df089bf-df5f-4d0f-8281-1a22395c92b0", "value": "C1B3196EF7C19277D02408BDCD45A1B9907975302E391822F7E64F6CD8F96C2AA6C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141424, "uuid": "475a47b8-bb1c-43d7-9143-33c95b1963b8", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141424, "uuid": "9c26d1fa-88f9-49f6-a8d5-533a3573ad1c", "value": "3072:KExRaQ6raoCoCyz6/mqv1JR+yBtGOeheWginPq:faO1tme+1winy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141424, "uuid": "cb8bfa17-118b-4481-b109-5c9250dafb97", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141424, "uuid": "50cd7507-79e6-4a7f-8b60-d004ffe8777f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141424, "uuid": "8dae7420-7120-41b4-9ecc-8892133d73a2", "value": "42ef7d3c5c8207031217b7bc0271b7bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e754a50-beeb-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622120475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120475, "uuid": "bde61093-8c86-4f3d-a230-f754ece7fbd9", "comment": "Malware payload (Formbook)", "value": "4eed6af4be56b61fbeb981dfbc9006a8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120475, "uuid": "a63c6978-e203-4ea0-915c-157e8c30a2d4", "comment": "Malware payload (Formbook)", "value": "108cc18c30a306c9fcd29d6d587cee73e18ccabbda0cb669b513a22b300d3a1d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120475, "uuid": "0485118d-e5f6-4b1b-b8bf-d12e705fec57", "comment": "Malware payload (Formbook)", "value": "34199a4df71dad661dfa98994f4f5e1ef1e2fa16", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120475, "uuid": "7ded7e81-9fe5-448e-bcdf-52f844ceae90", "comment": "Malware payload (Formbook)", "value": "33d1373e1fa5eebbe29c13a673a3f9457cfe323ae30e4e2a196e5d6f58dae537eb0062838aae24a4a43999fff5ba866e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120475, "uuid": "89279772-0c23-4dde-a487-8a3225393aa8", "value": "EB24125931D9CDF7C3164B3559B32F75E6BE73540712866323B01FBA2B221838993BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120475, "uuid": "b78105e2-7c48-4246-bd89-0a63bf462b3f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120475, "uuid": "b09c2485-16c8-40d1-aecb-ac1d7f82dd83", "value": "6144:cQq2rV5fGtCot3T8VI4yni4xnLUN8wjJ+PF5cznaVmKK:PrV5ub3R4y/xnLUnjJAA+mKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622120475, "uuid": "3378382e-ce3b-40d3-bc76-2fab53b34b8a", "value": 218236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622120475, "uuid": "59a08848-c61a-4506-8a7d-217c87d01a54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120475, "uuid": "b05a6d32-bd44-4759-950c-4b9db34d9547", "value": "Taisier Med Surgical Sutures.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07b9aee-bef3-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622123968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123968, "uuid": "c9212394-0193-4546-a785-c6de375c00fd", "comment": "Malware payload (SnakeKeylogger)", "value": "b3d8d3d346f5b57903c4529facbd549a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123968, "uuid": "4fd98cf3-05b6-4d89-8b72-cae8e1cfc959", "comment": "Malware payload (SnakeKeylogger)", "value": "10f9a6ac8f7b3203dc0898451865c04c8c7defa1b2a873f29bc8fec28b173932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123968, "uuid": "46207d40-35b9-4fe0-bb59-9d6ae75626fd", "comment": "Malware payload (SnakeKeylogger)", "value": "853181e34ded03cc20be6bcad6fd95f06ad5f033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123968, "uuid": "ed4e767a-45bc-4af9-a71b-98527dc1ba98", "comment": "Malware payload (SnakeKeylogger)", "value": "ec74fb1f3f0b48b790840017adc7f8db2283a55f9d4e83087921c88b78a035c5d0d7ef401d22af196c9b4fc2310125a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123968, "uuid": "3bd3012d-1d59-4f92-b8bb-e5b94f3f8d2b", "value": "5184120DA69AB8CFCEBD3EBAA0C403891331E0A59545F3CF4D44BCB491663EB154E6D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123968, "uuid": "f689c354-19f0-4d98-a91d-e3b41518536b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123968, "uuid": "3b2e6505-b185-41cd-9757-6d38e3688f0a", "value": "12288:Ka+kO6YXPCWdZdJmTy9Bj9aUUTT34M0PnisX:rTYXaWdZdUcj9aUk47isX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622123968, "uuid": "e5eaf615-42ef-4d49-8aa4-787e522f8a33", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622123968, "uuid": "010b078c-bdcf-40a2-9ebd-0f0f213051a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123968, "uuid": "4b8b5985-945a-4c6d-b748-10806cb1e1bd", "value": "VfuGVHUjGlgG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8f3be9-becd-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622107508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107508, "uuid": "b7bc821e-0ba4-4b4f-b952-125f7ee501e4", "comment": "Malware payload (Formbook)", "value": "34eeaf1f21628821395a37aafca0f829", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107508, "uuid": "ca8c91a0-387e-47b2-8300-e25f80e36364", "comment": "Malware payload (Formbook)", "value": "10ff3deefa320dcfa9931e035ab3bb3973b30792a214eeb105bab1d070d209a2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107508, "uuid": "f5a79ff0-4860-4c7d-bb2b-473f6ad4f6a7", "comment": "Malware payload (Formbook)", "value": "7ece692bac9cd0f65156175bf75a65aed7fb38d7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107508, "uuid": "51a25565-bce1-411e-b7da-e65bba90faf2", "comment": "Malware payload (Formbook)", "value": "4db1a99b4a84f8ce69174649b9eb4864d3300966abfd5c2f66a3a54f37b24ca30d206687a05c6171137952e8468c0f7e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107508, "uuid": "37fa1667-ff14-408a-b64c-68c5c626b4b6", "value": "50C4231BA4B43CDB7042128EE7B5DF9B92A7D1413C3B922C67B1F58E0311768468B66B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107508, "uuid": "f1815ba4-374e-45b9-b572-720af16ba41e", "value": "12288:sD9N/fCsxIJksLQpAm8EcNwES7D9SQAIIrl//mp1WNOU6Dcr/7ykI1R:srNqSskpAm8EcNOIFmWNNLGlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622107508, "uuid": "10119020-27a2-40d6-a0a0-6975a997ba70", "value": 584645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622107508, "uuid": "aa1431a7-bf60-49c6-936e-cf3f0f3ea773", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107508, "uuid": "88f62fe4-c38c-4537-8e8b-63bbf9d9f1b5", "value": "Payment SWIFT_Pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2680fe-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141437, "uuid": "1ff75315-967f-49a2-a629-cf89d06454ea", "comment": "Malware payload (Stop)", "value": "ae3dce1ab32c7d17fb34c01a81b09213", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141437, "uuid": "4089019f-9ff6-4ff1-9dcd-c26c05f936d9", "comment": "Malware payload (Stop)", "value": "11dea2cf4fc9e439167677ab62e694afa13dd59ac8c50bd91035b135fe938291", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141437, "uuid": "bcdaf72e-89df-49cb-b929-bbdf4a26d4a0", "comment": "Malware payload (Stop)", "value": "98f861431a01f2edc56ac5c81a2a9930793a5e71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141437, "uuid": "fc1e0d48-ce7f-4428-b72f-91b057148067", "comment": "Malware payload (Stop)", "value": "3ec6dab3f3a66c76a7f31ef1f1234ceb32937430455ad32e645490937b040192ca6850474522f57b1b060333fb304104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141437, "uuid": "5add87bf-e428-4571-9fe6-601731c3ce40", "value": "E705F12162A0C03CF1F766B488B59274A63A7DB2677C91CF72D43BEA56366E09C30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141437, "uuid": "829e2a29-87b2-4b4b-afc1-110b4ff15a30", "value": "dac802e4a8085608765f3bd680d77304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141437, "uuid": "81a8ed44-0a63-4193-af87-c47075b5c015", "value": "12288:ond/QT/SlbKJiLmbjmxqRBeCylIX3J6vNCvgYZLyvAyzg2zIUh09aP/L:E/rbbkylIX3JJvH8gC09aP/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141437, "uuid": "5e8eb644-e58d-453f-aabe-33373662e4f7", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141437, "uuid": "5a805d4c-6c34-4e6f-9372-f589cff894cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141437, "uuid": "15f4c05c-191a-41e3-9265-1dd02cc7b170", "value": "ae3dce1ab32c7d17fb34c01a81b09213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a042780-bec4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622103609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622103609, "uuid": "c77d4c59-5f4d-4704-ab75-ac69d96fbc2f", "comment": "Malware payload (Formbook)", "value": "1c850c85df885a3503462cb922434d62", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622103609, "uuid": "b8a881c2-44da-40dc-a9e0-08b6476d2586", "comment": "Malware payload (Formbook)", "value": "128f01731175307967b3d631feef04d99d385e79e384ede6e04ff745e86b7804", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622103609, "uuid": "8209ce7a-8c07-4692-8e93-acbf4a390c58", "comment": "Malware payload (Formbook)", "value": "53940cd6f58c20f8cc3894b98a25507231b14182", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622103609, "uuid": "0bfa1960-004d-4c00-a75a-e5db716f42f1", "comment": "Malware payload (Formbook)", "value": "c3e10910309c37755af3c3e63c610b921f0b7543b1da4e2b05668e4ee8a8655c252652f846784dabf95257f91c4ada62", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622103609, "uuid": "3070b12f-d930-4ff0-8df3-27e0c35461f0", "value": "B834126C72C6DCEBD8A3063145B79A39C77A978D6302232F6FA50F7D28619C3C612653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622103609, "uuid": "d2b60766-c05b-44a5-a16c-08db03fd9a29", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622103609, "uuid": "1fb541eb-346e-40bc-be9d-69f4d8d49286", "value": "3072:8QIURTXJyM3s0fU50MhkVHX0Laa/SDwu3sMyxsM3pbsSePjLLQhkr0tc/xkcnUs0:8sh3sbjiV32ucnsM3pArY4kcA5DV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622103609, "uuid": "ff03ce3b-3725-4036-bd1d-e5a6c14fa378", "value": 244434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622103609, "uuid": "c4561620-5ed6-42a9-8f00-829cfeea4659", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622103609, "uuid": "97666604-283f-4864-aa8c-3a47b0e83369", "value": "pl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac6113b-bf1f-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622142561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142561, "uuid": "f73b33f7-67f1-412b-b4f5-6ba7bbc7cd06", "comment": "Malware payload (Loki)", "value": "d8ae00d59a4e37d52cbf58ce5a334a8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142561, "uuid": "51e223e8-ba96-48a1-b326-846e014532da", "comment": "Malware payload (Loki)", "value": "135436959a69ba37b46dd45ebde2c5646c7ccce4ad5e1ed69c932781ae911d7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142561, "uuid": "f5e3ef70-9ed3-4685-8e7c-5c9e86b2f7ea", "comment": "Malware payload (Loki)", "value": "3c58a75221c19943ceafe7f5f1bd860d0f326ecb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142561, "uuid": "ab5e7be0-5be4-470d-b260-283d26866af5", "comment": "Malware payload (Loki)", "value": "b3cb534fef99a8edfa8469990c6bd4d56b89c435b1f0d45e5b5ac24531b1e5bd225f4589815fcce15363c1399205176f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142561, "uuid": "27e19fc4-22d4-4eee-bbc9-be15c22d7ca3", "value": "ABE47D2E26545716D17EC3F8C9D0A513D3A1E127B162AEFCA8C243A50B826C63DD73BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142561, "uuid": "59d0728b-b289-43ac-ad31-d35501a09fd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142561, "uuid": "3eef5f5c-8af2-4094-a81d-50b3cd3bcd86", "value": "12288:bNnUgtdL1hU/MomImlyVDfem4qvRnUNT2g7F:drdL15QUyVDeW21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622142561, "uuid": "1cc5f39d-1e6f-40b8-b0bf-09e7a87fc732", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622142561, "uuid": "f5025b40-837c-4843-81eb-55121a44b8dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142561, "uuid": "f1c902e3-e038-45cf-8e1f-5b916e098bc4", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291d0134-bea4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622089783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622089783, "uuid": "51b8c922-8d5f-4f59-9427-20d322fe7407", "comment": "Malware payload (Formbook)", "value": "cb6c87f8ea5d63a28244ad5b9ff3ce3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622089783, "uuid": "edacd264-4c76-436d-a33c-affaa80d12d3", "comment": "Malware payload (Formbook)", "value": "14854d1ce96dcc9795941ec7248f8d2481d5649cdeecaccbfe840f259bc50bde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622089783, "uuid": "b3e54d4a-d4d3-4921-a479-abd694de104e", "comment": "Malware payload (Formbook)", "value": "40524a066ef1649403759f295d952f135e9c4003", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622089783, "uuid": "35931233-41bc-4976-b4dc-b9870133f094", "comment": "Malware payload (Formbook)", "value": "7547fd942ebed30b63c32eb487ed26552a663f4d96e9737827832a3c57a4128e3a78bf1eed52018800e2e3ed6b358415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622089783, "uuid": "a2cb5967-5af6-4543-8298-1d07abfadd91", "value": "B524120932C110B7D18300B01573EE269ABBB7651258621B6B792FBE1A776DB8F039D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622089783, "uuid": "36d5ff89-4098-4c30-a35b-f5eefc9a89bb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622089783, "uuid": "ee1a1256-2140-48d8-819f-ede09752fde6", "value": "6144:cQq2/PTw+lkdnLfcjH4GHXUqsYrwAk0I39ah3MA2BrCZY0:P3Twjn4T40eAk3Na9or0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622089783, "uuid": "c23b2479-6e72-4dd0-9a02-bb580e504191", "value": 218122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622089783, "uuid": "5fe0cdb4-d63b-4f29-84f8-7c9e6460ea6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622089783, "uuid": "b093030e-2dd9-45b9-b8a0-4febe2b4a156", "value": "HEN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c9909f-beb3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622096442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096442, "uuid": "a9a8adec-5532-4cb2-be57-17341394c4d8", "comment": "Malware payload", "value": "050b77b8fc0f7764770f21f956f0c346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096442, "uuid": "b666ffc2-677d-4271-a0b7-25fd1a611c2b", "comment": "Malware payload", "value": "176bf85027726361b30d4b0e3cd19aa631ac4851f9868e5aace2568b783f60e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096442, "uuid": "0560e00b-c368-4644-9f1e-d895ff3cbee0", "comment": "Malware payload", "value": "825216d74898711250c8ff61066045add6669348", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096442, "uuid": "59aa4a67-0fa4-410c-819f-92b878294c94", "comment": "Malware payload", "value": "203786bff6b5940faa5564ccdfc78dfd998f8afa0d86aa813effdc34005985446faff824c6a378b559d364add5248025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096442, "uuid": "4a559afd-0e63-484f-9966-2d7b5ce41580", "value": "E6445B21A6B0C034F1F716B448B5A279B53A7DA27B7480CF52D43BEA5634EE5AC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096442, "uuid": "748822d4-77c3-4aff-9e6d-6fe9f9ab2211", "value": "b0ea5360984cd75edf9d1528f542b372", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096442, "uuid": "f4721a74-bf76-4ece-b2b8-80278701c78b", "value": "3072:8xEpeN/wkDxczzktXG0pxalIKe5RiMFLh0y0X/gqNyyuITi8oatiIPr:8GO/RDxSktXDpIK5RntdwdVjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622096442, "uuid": "4ddb0b65-c5eb-4860-ab0f-7e7b49f16e8f", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622096442, "uuid": "1b62b0c6-350e-494d-8961-793de2bbb06b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096442, "uuid": "973bd10a-246a-4fa8-9c84-ac3ef0313e61", "value": "050b77b8fc0f7764770f21f956f0c346.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91e3b6f-becb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622106829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106829, "uuid": "51a54eca-2fab-47bf-8315-6d27ea140861", "comment": "Malware payload (AgentTesla)", "value": "a8f32cfa376766f4b6ae4fa5ceecec29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106829, "uuid": "eb499088-607b-4e14-8c8c-72ebbbdcd673", "comment": "Malware payload (AgentTesla)", "value": "181b0c25c769a2c3754328a0cd79fdd58c6a9960340c52e7ee4bb96643de09dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106829, "uuid": "f9f6a450-5a44-4d03-a9e5-78143be047ec", "comment": "Malware payload (AgentTesla)", "value": "124e584621c06db3c975b3b708a044eb2e1d9f86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106829, "uuid": "5c589873-e306-4abe-9cad-8aac029dcb0a", "comment": "Malware payload (AgentTesla)", "value": "ac0619f70e70ce285fce2b8449508a18f1bd9bc86e7317fd5bc468ed256eed61becd56d37609b92a44459282ff5f0141", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106829, "uuid": "4080fa5c-5d91-4204-ae05-23de307831c6", "value": "7EC4BE1233265D83C0390AF40026A68133F26AD67D9EE9CE5EC6A1EB1FD8FD1DB0554B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106829, "uuid": "4e7289ff-7692-4c2a-b430-06eeb7abfa00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106829, "uuid": "d988f524-0b90-4d72-bf04-115dc8551241", "value": "12288:C9uwlUJnvkbep6oGkyJBQiKBtEVHDV7QQRdGhwlR:TjQJn7DjiQR8hwlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622106829, "uuid": "52a11a52-da11-4034-895f-8c054490ba01", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622106829, "uuid": "fffdfd84-33a5-4429-8b8e-4b6694d8f450", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106829, "uuid": "5c416e73-8ac6-4e6c-9d11-034b9528488d", "value": "ProofOfPayment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4403d5-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622141434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141434, "uuid": "9dc1d88f-0c0c-4864-b900-19fe7a59d911", "comment": "Malware payload (RedLineStealer)", "value": "71b9778f80bf6cf3f7ba661c79dcf65f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141434, "uuid": "7d42f41e-5b02-4ad4-a3ea-2027dc6daf7b", "comment": "Malware payload (RedLineStealer)", "value": "1863a7088799029acf04f2ed7b2ce4d473f27df19a36e373f1a6287aeb77ee9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141434, "uuid": "ec945027-657c-49b1-92ed-dd18be981de4", "comment": "Malware payload (RedLineStealer)", "value": "19cd4bec783399e8c4355f2fd17014a43bb9411b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141434, "uuid": "29cf2bec-4bc4-4939-8af3-48511d883c3a", "comment": "Malware payload (RedLineStealer)", "value": "575c1197ee09330a71bb1d08d2ca03d9c7f465292829e9d94d9f7ea1472055c261bbf4b093f3b2c6cd0e8c69601b1b6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141434, "uuid": "64dfa14c-8436-4966-8963-3ebe63ab036b", "value": "5BD1C710B3D84672EEFA06B65E6353508774F785CC278BAE68C422475C37B010AA2B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141434, "uuid": "977f13c1-1bf1-4195-a972-bf04813321f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141434, "uuid": "738fbaa4-98ab-4f8b-a10a-891ffd75be2d", "value": "96:GwvQzCMJPoqYFrMnG6+0zGR1JWJXYPwGIXM3W0fzNt:GDmqOrqXxzGR7cXmUcRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141434, "uuid": "995427eb-67cd-40e2-96a6-2b20827a1471", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141434, "uuid": "a7a2e51f-9994-40cd-9418-60d576370731", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141434, "uuid": "cbfbe323-25da-4eb8-8bba-93de27573a8b", "value": "71B9778F80BF6CF3F7BA661C79DCF65F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb16b47-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1622141597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141597, "uuid": "9e6f60d9-08dc-4951-b495-bf209dd62cf5", "comment": "Malware payload (njrat)", "value": "e3329c654c728155a7e46dd7e8656cd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141597, "uuid": "e8b68aa2-6ffd-45eb-88bc-e2f88c1b183d", "comment": "Malware payload (njrat)", "value": "18f9e2f8d672f44e75e8837b6e66f52fc537177fe419de1da8d77660bbd5b19b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141597, "uuid": "21626fa8-4a53-4706-aa11-348eb761abb8", "comment": "Malware payload (njrat)", "value": "5d14fd9197b37d77b9348cbd6a0bfef9be056401", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141597, "uuid": "d2146346-88ce-407f-ac9e-628693692cf8", "comment": "Malware payload (njrat)", "value": "4a62f0f6fa8b372e113faf6d0bcec1b1480b8e682da956f4cd26dfb5c0ba80a5f5efdaea5c6f6096e8a1c463a500e1f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141597, "uuid": "bd309b7f-5214-4e24-ba05-60429698e00d", "value": "0D75E11373DD8361C3B25273BA66B701AEBF78254AB5F56B2FD4093DE820122521E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141597, "uuid": "4b27f2c5-b2aa-4af4-b819-ebbbf007882c", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141597, "uuid": "741c064c-3bcc-4324-a3f7-bb0da9e3d797", "value": "24576:vtb20pkaCqT5TBWgNQ7aQrZB76XCU43ARx/PDQkzVcKFMG4iXsO5gBS40jSiK6A:sVg5tQ7aQrZB9/qsGzcxTS40m5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141597, "uuid": "e1bb8855-6c2f-4e8f-98d1-3df800eb45a1", "value": 1623040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141597, "uuid": "78a7baaf-5c22-4183-8c27-4eec5131fe16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141597, "uuid": "67aaf3d1-0980-47f2-8a62-dabc9ff548fa", "value": "E3329C654C728155A7E46DD7E8656CD8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cda0826-bec8-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1622105305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622105305, "uuid": "1689bce3-1813-45d3-991b-5fc4f2839890", "comment": "Malware payload (RemcosRAT)", "value": "cfb9f7901ba202693ad900f2a7efcc39", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622105305, "uuid": "da893903-b0c1-4321-b7a0-7b09d4e99b37", "comment": "Malware payload (RemcosRAT)", "value": "1986e5695327904220ee08b1d266648411b436e248e2e400215d209309d16f7a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622105305, "uuid": "e8245fe7-edbe-4f49-9c76-f50ddc6f0dc4", "comment": "Malware payload (RemcosRAT)", "value": "b30a91cfabbea7247b496b95a1616a0329a90936", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622105305, "uuid": "afc621c5-36b9-487a-8b18-400c43139e72", "comment": "Malware payload (RemcosRAT)", "value": "ba558779419f27153af768e68af186c76729f1b1e1055e2879a259380528725b0b3027805e4aeed39fda58f9c8bd1c81", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622105305, "uuid": "b67986e5-c0ac-44f0-b348-7c1cb9e52d81", "value": "E9059D26F29904F7C1661F78AC1B43A8AD3ABEB01D2465977AFA7C0C4F393513D252D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622105305, "uuid": "97cdd54b-efa2-4e91-94b7-641e79bf2b84", "value": "3ce36334df24b9b0e96702a83ffba1af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622105305, "uuid": "f448828e-6108-4710-a872-e5c4c099f2c7", "value": "12288:Sq/664+YlIpVmBVMuYl/lnu6ZerpObSVE9QkrhQdsNsY:Sq/6H8mBVmkCEpObVqGsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622105305, "uuid": "48bc2063-9289-4e7d-80a1-add8012655c1", "value": 836224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622105305, "uuid": "b8ae9e12-5c65-41de-9e66-e9580a3102e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622105305, "uuid": "64aa0e5f-e251-4435-9fa1-a9666e0155a4", "value": "URGENT ORDER 2T6U545267,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649587cb-bef3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622123813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123813, "uuid": "b77a226e-1bb2-42d6-8764-d05909508240", "comment": "Malware payload", "value": "22ab8d36387b5618d91cc2c39130f442", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123813, "uuid": "855498c8-3796-478e-b1ed-aa81a5c65549", "comment": "Malware payload", "value": "1c2a04dc7dbf27a4a5b18a24c12c26b8fb74a5c73b1229ccfe64c57e3a63bab8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123813, "uuid": "b24deec0-1e89-429a-917a-02d376374c3b", "comment": "Malware payload", "value": "bc26e07aa411a1d89ac1f0283b468a57d42359dd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123813, "uuid": "44b877e7-29c9-4328-a4a6-77d8c8660153", "comment": "Malware payload", "value": "1800b5ff22c0b2fcc7f8d9830be952f41fde1d76e69c502d10b2b0c79b5ef909a3116aa46d890d1edd263f34e2caddc6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123813, "uuid": "7ad47fd6-f6a5-405e-b5d5-c8078afede92", "value": "DB53A41077E4C526E0390B37CEDAC6F63734BC40AE56632B3094732F6D76B959A64B90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123813, "uuid": "767f9d42-8a28-4875-8a54-9c87ce46b8e4", "value": "192:M01pra7o2FrcltowXwmz5xPJ5UL59HbCjSoxdDTT6XcvTBFoP8u92+V:lso2FrC+3FeBYclFo39D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622123813, "uuid": "be9196f3-6b00-4618-9d47-ddb15800e3e7", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622123813, "uuid": "c557f75c-e155-4bb0-8481-a63a11707a07", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123813, "uuid": "0b50ace2-f95e-427a-b614-6c2716d3ee4f", "value": "RFQ_ORDER-001G49 NUEVOS ORDERS.ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c24e02-beae-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622094420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622094420, "uuid": "d5590d49-4eba-4e7f-b5d1-e80f0f3705cf", "comment": "Malware payload", "value": "9cf2038d451528fc19feb24ed6f5fb0c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622094420, "uuid": "fa58bf8d-1b32-4fdd-a281-8bc2eddad27a", "comment": "Malware payload", "value": "1ebf2ee31466e565081dd91ddc57c39216b1c0a416b88bb4c44470ba6c0a2ffb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622094420, "uuid": "d53a9ca1-2db8-41de-8179-21d4cbb8adc8", "comment": "Malware payload", "value": "b0abebedf60dad10909d7234a9cf7e4dafc4e6a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622094420, "uuid": "cb4a3ef7-b387-48ba-a1cc-357da01077a3", "comment": "Malware payload", "value": "12d8b45fe065392c623f3fc7d1ce006d358de6173d9690cddbab37aa405c02fba6f22abb66cdf18ffdce1f6a75364fd3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622094420, "uuid": "07585303-bba0-48e1-8703-b7e2ec84c269", "value": "202533FEBA940DAB5D9F7324741B9F241122BF78D066437836735B0E1D1A5E3C24722A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622094420, "uuid": "3f77dfbd-148e-4245-b460-02d305d61de7", "value": "24576:BrLprldkNkyLRq6F+ouAUYFCJTZHJIsYYG7:FLBrGk0wQhFClYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622094420, "uuid": "06b8e9c8-f05d-4e67-bad9-9f47bc24ddcc", "value": 975680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622094420, "uuid": "0e4c0570-fdbb-41f1-b104-2e10ab7a7ee0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622094420, "uuid": "310c79bc-ffc5-41c4-8ff0-9c8e5e91440a", "value": "Re,Purchase Order.exe 45678#.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece5e2fd-beed-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622121465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622121465, "uuid": "96a135a6-953a-4f8e-8422-4a9adb91b70e", "comment": "Malware payload", "value": "e05ff6ab3d009358d7b22842eaba17be", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622121465, "uuid": "fc9e75b0-c210-4ba4-b7c3-b42630b27e68", "comment": "Malware payload", "value": "1f6ac303166c0b4566cb04e6c834fe35ed62479f733bbe6986c102aefe1f2ddd", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622121465, "uuid": "9dd4a8a4-9396-4480-a732-24b8b4b79256", "comment": "Malware payload", "value": "ae815605e3e4571f616e6168b7f7e08ed498e293", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622121465, "uuid": "4a6e7fc1-af56-4abb-90e9-b5e9d113c74f", "comment": "Malware payload", "value": "15f4ff8e43ffa44affccda7d726b7c006616ff957403e71a6980c61494fa6b9ecaddabd7e3435a5962c4513c47f012ac", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622121465, "uuid": "c83f83d3-9c33-4887-8970-3697efe0cae7", "value": "E3D4E0B0FA869926CE5B02779C51D7E6233CEE858B110717B2FA334D4E367C8C626B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622121465, "uuid": "6228dccd-3c05-4a28-b6d8-ab07e116a715", "value": "12288:QtW28O16rr2ExOybW9xG580+EKF0fQtJ4hcv/fB28kJCqZd:Qo2826rr2Exk/EKFMea228uCqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622121465, "uuid": "c5851734-1329-4057-9b4f-d069bf8fcb95", "value": 635392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622121465, "uuid": "16fc7ae5-db68-4a40-a2ea-a0f87c8568d4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622121465, "uuid": "ff0d290d-f945-442b-8a48-4a608c52aac8", "value": "Document_46161561.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007dd512-beb8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622098305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622098305, "uuid": "a8bbc458-cad3-40fd-91e2-4f4eb8fba5b8", "comment": "Malware payload", "value": "876e21d9334ffdc81d43faa974ff8c9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622098305, "uuid": "50e62e54-7b32-4b77-8463-22fdd7505e3c", "comment": "Malware payload", "value": "220a16db1e97f5257b8403d4921ef514e32286a46d322a48c7a36ecfd0fb1494", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622098305, "uuid": "70c34885-e7b7-4e03-a004-5d87d31386ab", "comment": "Malware payload", "value": "3727c44568e260217528335437023f6dffab7228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622098305, "uuid": "b40d7808-66fd-4ee6-bf1a-80781293ec77", "comment": "Malware payload", "value": "89ea070273b8b33514e9e1816cee891eca85890bb8521b020d7186c7c593e6f75ea42db69f4eec38a9fb2509893b9cc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622098305, "uuid": "d5edc1d1-d31b-4b32-8a6a-a81d77e9c0fe", "value": "69254A3A7B8EA5B6C83219FC4D9FE1D1A85A36301D34A94BF6945F4C6F34242372B943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622098305, "uuid": "c6fa5e7c-a4c3-446b-a0ea-4c20e711cb64", "value": "cbe4e63e0e3bc9b1288271d640a5dd86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622098305, "uuid": "0b4d3631-6b90-4064-b56d-63d5c06175cb", "value": "12288:hwG0h5lVtSWclFGuyxzOk2fSsR1L+MGZkiWv1oWIS+PYOW7j2RohS:2B58WgEU/SsR1L+MGZFWv1opBW7j2RZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622098305, "uuid": "f301a255-f407-4daf-8505-7e4b5928f4bc", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622098305, "uuid": "1a37b006-51f2-4b8e-890c-07c68da21780", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622098305, "uuid": "b8650ae5-d51a-479e-8458-f2da85260eff", "value": "876e21d9334ffdc81d43faa974ff8c9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b52b521-beeb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622120442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120442, "uuid": "82a11a4d-1f38-42dc-8a74-e183f1f34c1c", "comment": "Malware payload", "value": "1acd7c2449923f91712cf6eb9056e877", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120442, "uuid": "9b3d6c36-3c22-4b40-8329-3fa1fa522d6a", "comment": "Malware payload", "value": "228872b54dcf971fe377eeaec3e01b49c4b66fc16073e65e61a9e1c532ee162f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120442, "uuid": "148498f8-4247-4989-9578-1895add1307e", "comment": "Malware payload", "value": "6d098dd4cdecb5b0e0f9c04f36ae9b0b7e463e93", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120442, "uuid": "d5a74434-d8a9-460b-8436-5b21c3be1661", "comment": "Malware payload", "value": "27c6aee6f49871843ec0d49b13a2977bf1b399e5e02cb9b386f523c911b170f977189d28d18faf9e2ed7ddcfe9c452c8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120442, "uuid": "33ed90c3-3478-4732-8396-cd818b60c2c0", "value": "71B423AE8E0DA9B8D3C15FF97A07B87F8B9C6CAB796781ED4054D3BEC2D09321145604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120442, "uuid": "075e8026-e7aa-404a-aa5f-62cf6312a9bb", "value": "12288:oX8VKB0gaDMLwyDetULKiR0VkMpIYAfc8vZRwortq7MwANdPRwM:oX8VKuzMLbDetULhYTp7Afce/wUXd57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622120442, "uuid": "fddf6ad8-bc4a-4553-ade4-6a0f6df3850a", "value": 505583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622120442, "uuid": "f3b911f6-8ec6-48f5-8df5-b1fefaa36f24", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120442, "uuid": "c99d3df5-5001-459f-8a35-e0e5391e8232", "value": "AWB.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5882b1-beb3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622096362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096362, "uuid": "f075469a-7e2a-4828-b97b-92c4d41a3de3", "comment": "Malware payload", "value": "5bbed8e7c219936e05c356cb633e24e2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096362, "uuid": "189b394b-886b-44bf-beda-c775f0d75af5", "comment": "Malware payload", "value": "22bf6cee4d85f9df7fcb16d3710d77a54de0f88ed46a094f236f69d4f940361b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096362, "uuid": "a7ec4a13-c08c-4212-aa04-926b404a3446", "comment": "Malware payload", "value": "4aa22a03f61cc357061795ee8cfe92407d49b6af", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096362, "uuid": "939f0f89-b5ce-4c6a-8651-842fbca4ccad", "comment": "Malware payload", "value": "08e545891b820afcb4635d021a1c6c8e0bb213e51bc34685fb54ee842df4c1f6bf35fcef269226cd0392320e725dc3b0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096362, "uuid": "aecd2a61-aa84-4dbf-a4ab-507643e334f2", "value": "DED1AF27384140DDEF139073E7FDB92DEB07A5ABC4517FF9A0C1153AE21A8891A6351A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096362, "uuid": "8576db3e-9380-47fe-ac50-0df5a3891d8b", "value": "192:wbR0wXBElivnZAPC3USUZG3fCs15ghSOMaa+Pf7rN:wbDxrnKPC3XUwPCs9OMaa+Pf/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622096362, "uuid": "64bf4db7-554c-469b-9bcc-573cacb0f352", "value": 6766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622096362, "uuid": "543fdd83-50db-493c-a1ef-6d2d6b6d8926", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096362, "uuid": "7847798f-c811-4046-8167-54833e40df69", "value": "5.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d4e419-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1622141604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141604, "uuid": "6d99f920-4bd8-4bec-ac3c-60f85e0b923f", "comment": "Malware payload (AsyncRAT)", "value": "15cab6e13628fa75684ce7fa19b05974", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141604, "uuid": "b61f5f7a-fdb2-4823-907e-146ef0c99f29", "comment": "Malware payload (AsyncRAT)", "value": "24ba90e981a5c9b46f1b889fd987d5e19f152c829c663b4b1309a5e74a03c468", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141604, "uuid": "7fee5476-a560-47a6-b140-33e7efcda130", "comment": "Malware payload (AsyncRAT)", "value": "761160241c899e02af7486c4a1a5be49bedf9c78", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141604, "uuid": "96701564-401e-41a8-80d8-808114a2d9e6", "comment": "Malware payload (AsyncRAT)", "value": "3a1ced577474b8db4abc946fb8427c51e0d50025d8966c70d41ef5ed47d0a68ec8d6f364a09e8926cc81274357cd5367", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141604, "uuid": "f8029d3a-d43b-466b-9d43-289e35ec7f80", "value": "11D46D2E16645716D17EC3F8C9D0A513D3A1E127B162AEECA8C243A50B826C27DD73FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141604, "uuid": "12b02ab5-ac34-400a-8466-6024db662caa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141604, "uuid": "22b605c1-065d-48f6-ac90-0bd637843101", "value": "12288:2Not8IkHO65O4Ke6/Y+90SqTLKpmSe0Hd3a/Ju:z6XO65aNPomcSe0HtaBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141604, "uuid": "2a839641-7ac7-40f4-8ac9-8160c26389f6", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141604, "uuid": "d1bafeb9-c8f9-4e0c-b31c-af46c97b0e18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141604, "uuid": "3f6361d7-0be6-43a3-a422-30b21da2affc", "value": "DOC20210019292.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a19393f-bf36-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622152465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622152465, "uuid": "8bae73e1-81e4-4437-9066-bb8a71566870", "comment": "Malware payload", "value": "582671a5b5f2170a49333296aa81b84b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622152465, "uuid": "27428d87-d304-46fe-93a2-3c5cb67b7133", "comment": "Malware payload", "value": "2587e94f3bc1ae54ff7732984925def76de934b3e1b1f7407bd66491db18f7e0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622152465, "uuid": "4af51c5d-84fa-4da2-898c-22fba323275e", "comment": "Malware payload", "value": "5e35f891922b5d724a4b6f37eb9609ea47e00fc5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622152465, "uuid": "88ca2c0e-c865-4715-81de-1542f1b8132c", "comment": "Malware payload", "value": "ddd89aad74d5696d5b4039cc938591822ac5fff157dbb8db84d1d64815bed697a7f68336da1b116ddd9909f579eb27a4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622152465, "uuid": "e8402336-83b8-4e32-ab26-a837ee4129e0", "value": "BF64F110B5D5C1B2D4B9093944A0B6AA179B7A70DD64CFEBE3705EAD5A352C0CF30E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622152465, "uuid": "1807a6c8-6bb1-4c15-9f24-6d1b0f1e244f", "value": "412bf25b766b96b032f6def12c60688b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622152465, "uuid": "d4f46138-7f94-4b2b-9a3f-cca98a96242c", "value": "6144:N5ac4RVUnKmLYjTC8aiCZsZbgi07Iml9vl2J8HjnX9jf:N5h3nKm0jTC8afsZbJ0Im3vEJ8DnNjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622152465, "uuid": "cb550458-091b-4eff-bb2b-912e80218edb", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622152465, "uuid": "2db38d2f-ec75-4185-be28-5d35b97acafa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622152465, "uuid": "04fafe4a-1a17-4909-a378-6be7b32e8e26", "value": "2587e94f3bc1ae54ff7732984925def76de934b3e1b1f7407bd66491db18f7e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a40811-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1622141586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141586, "uuid": "3c7d9604-c633-4283-ad97-8818aab29e61", "comment": "Malware payload (RemcosRAT)", "value": "65924d249093741c1af3d57311128a53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141586, "uuid": "31a4e0c8-d7ad-49ff-ba4a-449d80185670", "comment": "Malware payload (RemcosRAT)", "value": "26ceb57e95635a8c48ff8dbe512475716cd7b4155de3f34cd2932f90a688a7d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141586, "uuid": "cf4f0f50-59f9-45eb-afe1-2fb43ce2a413", "comment": "Malware payload (RemcosRAT)", "value": "3e58f90406dd7e2a235bc731598a1cc708167d6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141586, "uuid": "34f117c9-e7f1-4778-9226-6c72bbfb7e16", "comment": "Malware payload (RemcosRAT)", "value": "97ce823899b472cf37eb53d34efa5c1a382e53551ea86d42a1d1238d4f03d2e47518b9f8c771109f33c4e8da6666b197", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141586, "uuid": "d9257878-d00b-4cb1-8f98-5b2dd01e9de4", "value": "A4547CD2F11045EDEC6A173264270DA249A32CBEE6B9D11D71F936233BF71A3402A95F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141586, "uuid": "fe20ae73-04c7-4894-aaab-aa48fabbf58b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141586, "uuid": "9b01f477-8b27-4d6f-8e38-75ec584299b3", "value": "3072:NLk395hYXJDxh0VqBoU3LAzPM2nOHnjeySd725vkqK175:NQqPWVqB04LHaVOv1KP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141586, "uuid": "9d7069a9-7f92-497e-9fa3-c8eec11f6be0", "value": 301626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141586, "uuid": "fbb1a28f-70ca-4bf0-a015-c6755ab74f75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141586, "uuid": "0715122e-648f-4a55-803e-1f10b4b50bc3", "value": "fatura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2830f117-beea-11eb-875b-42010a9c0053", "comment": "Malware payload (SystemBC)", "timestamp": 1622119847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119847, "uuid": "acc15cff-bd8c-4efa-9473-937126349a07", "comment": "Malware payload (SystemBC)", "value": "ef135e02cd07e94c493061950ea99a3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119847, "uuid": "4acf398f-5eeb-4cf7-a856-07c56c090a9a", "comment": "Malware payload (SystemBC)", "value": "2866a252b6007fe9487d85b87ed23f6dddaf2f4f8ccc82328212985bfc6dd5d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119847, "uuid": "169cf6d9-e274-41a8-baf9-eb644536ef2b", "comment": "Malware payload (SystemBC)", "value": "1b0cbec8bc066ebe12ab6a66e8e8901c2024bf03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119847, "uuid": "d9f64e94-4d06-40ba-a9b1-f7f52419e014", "comment": "Malware payload (SystemBC)", "value": "575622a513989268b3ab1f5a08aa3a1e0da933f0fbd8a4cd1aca7a1169c45780a15481e2012aae69cf932691f703a55c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119847, "uuid": "5e3d6244-f286-406f-bd22-f53bfaca7786", "value": "20B46D22F2B04437D13326B99D5F97AC5C2EBE407D24AC4B2BE41E4C9F39781792A257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119847, "uuid": "72dede2f-9ab1-4e50-96db-07e72341ebfb", "value": "f055867a095ee7f0038e58a8abcee3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119847, "uuid": "a7dc8651-f837-4967-863a-873d1857bcce", "value": "6144:zEg5nOUIs9bdyXs14wKLw/LDZn1TUPgflDnAKzNYx4kCn4In8/v9Mm2nlI2L5D3G:A+OUIs9bW04wMoAPcJ7zNiIvmAEjQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119847, "uuid": "c6ddcf0b-0af0-456b-86f8-0e6e6a192d0c", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119847, "uuid": "4bcfc903-ab01-42ba-b185-b1a2efa60605", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119847, "uuid": "408fe201-2eb3-4376-9791-8b2ef63b5ea1", "value": "ef135e02cd07e94c493061950ea99a3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad63c79-beca-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1622106107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106107, "uuid": "7e369cec-85e8-4824-aea5-66f8b6ce3f5a", "comment": "Malware payload (Mirai)", "value": "4de6c9b390a2e9a1aee6c470ba705e6e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106107, "uuid": "80337c00-ea5f-41c0-9317-805c6c21d0f5", "comment": "Malware payload (Mirai)", "value": "2973da230e850b134f89760fc5258fa5edbf103ff114e9d42acd24d932ec711b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106107, "uuid": "2b7dd9ae-e216-44d9-88ae-96954d932309", "comment": "Malware payload (Mirai)", "value": "5f7fefca83f185900946ae04594902e860356b19", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106107, "uuid": "14bbf03d-1ded-4856-94a3-f8e6a52349cb", "comment": "Malware payload (Mirai)", "value": "3ee6aac0bd18983df80f670a24ff43640f0e3b13901a815905bfda0b757b87e7ff08f06fac7e511c087988b47155ea92", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106107, "uuid": "a998001b-b2b9-41a6-9e31-d6d631edf8d9", "value": "0164F1CBEA01AC7AF9DA47B57A6B0B0973F0DAC5D3C3B140A264C5443CBD685AB645C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106107, "uuid": "f0e38eeb-82f9-4d2d-a111-a4744c0971a8", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6coGPa5POdOQ33Q:7O/QJHZweEL/NOjCHm7FZZnccPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622106107, "uuid": "321e9586-3cee-480a-80c9-2037a235ae85", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622106107, "uuid": "bf516572-de1b-47ee-85e7-e1df36c903cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106107, "uuid": "20ec40b4-d9aa-40d6-aa01-8eadfdf60776", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b675ee27-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1622141560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141560, "uuid": "31943ebe-78c8-49d0-a94c-a309cffce948", "comment": "Malware payload (AsyncRAT)", "value": "84d286fda4478a2e66ce1ee07167bb28", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141560, "uuid": "9b2b408a-5fc6-4e1b-95d0-b73ebbbcbddd", "comment": "Malware payload (AsyncRAT)", "value": "29ae461a4b2e7779d94311820ea7ac4b11887b2d97c6c2ec63c8bddc35cf92c6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141560, "uuid": "7dc2ed47-51ed-42de-bf16-5224598db159", "comment": "Malware payload (AsyncRAT)", "value": "47b888f6996c04053a28dfa21bd7ef9efbf2ec49", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141560, "uuid": "9f369338-8141-4fb9-af05-30ae3153572e", "comment": "Malware payload (AsyncRAT)", "value": "bc97f4d7ee0a9d92a78ea0736d6af6854ca0086baa8cb1de517df771ae89f768955bf345d4b7745d0eb33d43e0884ff1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141560, "uuid": "49c000ed-6c11-4f59-9857-2fa02a8fe798", "value": "FC45A43573A407A5E4B3463546F8623787B37CBA3721E98D2C6133358AB65811E2DF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141560, "uuid": "7d6b0551-ce74-44d6-b93c-fa96f9ce486f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141560, "uuid": "a9906b1c-308f-4fe9-b931-7a8ee88e923e", "value": "24576:NUOPl+x7FIZVqOT62uToplvo5/uEg/M/y:Oel+x7FIZmoplw4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141560, "uuid": "74076efd-a722-4cd9-83a2-c7a651e4516c", "value": 1183232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141560, "uuid": "b46db5eb-8f59-4d3e-8596-feac4590af06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141560, "uuid": "7a5a82f5-eaee-47d1-811a-f6a8cd20564d", "value": "INV00288483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1956cc3f-bf1f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622142585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142585, "uuid": "c641de15-c482-4e0c-a0e8-568f13bece80", "comment": "Malware payload (Formbook)", "value": "d786f76dbcee2c40348dbbca5ff88dcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142585, "uuid": "8d631c2d-c214-4846-bc5b-ca946d90cd40", "comment": "Malware payload (Formbook)", "value": "2a825149b773f6a33297a584cb8482faa3ccda9c4e2987745f51705ca6b709e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142585, "uuid": "f55ea2ec-3b62-421c-8ec1-398ab7b87afd", "comment": "Malware payload (Formbook)", "value": "d8e14b44c49db39c9562e4ef38e1f3fc6adb2291", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142585, "uuid": "5e8cc703-92ba-43e4-be7c-0f318d559c26", "comment": "Malware payload (Formbook)", "value": "1d7b3350105990e7c081c70beb1aabd23f1a1dd5c5bf9bf818d9d31b7ed1e5db88e78955118ae007c4e0f89a15e2e61f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142585, "uuid": "cd62e673-d022-4cda-b216-15ca517ef85c", "value": "03F49E2E26646716D17DC3F8C9D09513D3A1E127B162AEECA8C243A10B826C77DD73BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142585, "uuid": "ca66f0ac-0f55-40e7-a382-8f7a35ead763", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142585, "uuid": "c9bacdd0-e7d8-4d89-be9d-75ae8fefe7fd", "value": "12288:HUEFDb0OSveHnHwL8tVK40LS7d2UWpBMXyHWsj3dMukAurcSMROO:Pb0O6eewK5S7gBMC3dDruhMgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622142585, "uuid": "ca301d79-f382-45a1-ad48-aae6997e0876", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622142585, "uuid": "42c94ec4-f1eb-48a2-9fc0-7cf9a735a704", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142585, "uuid": "53627109-40a4-4606-b5d5-a4e85b874f88", "value": "\u20ac9,770 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25471a6-bebe-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622101154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622101154, "uuid": "c884b75f-ac67-4ef4-b0d6-884caafda219", "comment": "Malware payload", "value": "396fc25f868a9b5415a42830ab37be12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "SambaCry", "colour": "#271E1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622101154, "uuid": "186a1855-2e32-4870-8380-798e4c665005", "comment": "Malware payload", "value": "2b0c93e14cbcf6bf3ab3a67f2d8dbbff6dcee7da8ab9254bbbe8cecec33c2701", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "SambaCry", "colour": "#271E1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622101154, "uuid": "dff43eb3-3832-46d2-b8c2-66a4989f6a24", "comment": "Malware payload", "value": "9bf9700ffe97d720b295b851b72f701345f87bc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "SambaCry", "colour": "#271E1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622101154, "uuid": "9ae9d005-37d3-4afe-9594-100aedebcda5", "comment": "Malware payload", "value": "81a005bb4fac25a55dca77c99180d1d778d3b3c4973aa303a11e5c3051ce083271be5286ebd81369192295f9cb9068b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "SambaCry", "colour": "#271E1D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622101154, "uuid": "89b0c6c0-7314-4e82-abd8-2078b879b2b3", "value": "0882331BB6E1CE3BC8990379947F0730B2F0D8A5AA535323260869766C437DC5E6798E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622101154, "uuid": "6370a47d-f1d2-4b9a-ae12-0344f503c3a6", "value": "96:R1MMBWBPSEgojMSRydkpI58JpV6G57WiKBCDWB1+ioJ0/T:RH8pSEgRM5N6CTKADWyiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622101154, "uuid": "4e089fd1-d0a5-4e82-a90b-af653af8d764", "value": 18424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622101154, "uuid": "20e27916-60bc-4861-9dfd-a8f3d702ea62", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622101154, "uuid": "c2f00e87-3406-4a5e-938e-f54a32fc24a5", "value": "DiQnYDeB.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b6854b-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141450, "uuid": "5d76ad58-7082-4e4d-b9e5-2d4582329a74", "comment": "Malware payload (Stop)", "value": "fa3d294cf961ac387078f139dedc914c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141450, "uuid": "1d0cb016-df13-4ebb-ad8e-b97fa7dbe71f", "comment": "Malware payload (Stop)", "value": "2cae77552bb1e0d1d5ae948fa63e68496ef66a90444942ae685c39a0df989483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141450, "uuid": "8443bd13-1e3d-46e1-b437-137c5aafa573", "comment": "Malware payload (Stop)", "value": "e8a59913de30f78a35c8f0068c0ca711098f125b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141450, "uuid": "68219f20-6b28-4992-9d8d-f65fa25ec372", "comment": "Malware payload (Stop)", "value": "fc565eb7277ee6fe32136d721af6cc37eedb03471047d07ff7e4769c7b2c1c65f864754d3ca3e514b4c0c68ffaf43071", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141450, "uuid": "b4c47abc-d5e0-4107-8cc5-510533e258de", "value": "BE05F130A2D0C038F1B716F468A882B9B53A7DB2677481CF62D4F6EA56356E4DC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141450, "uuid": "aafb74f7-d7d3-42e7-8492-4febabc42442", "value": "dac802e4a8085608765f3bd680d77304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141450, "uuid": "6d25c61a-d159-4a26-aecf-213fbbb3d776", "value": "12288:0mo/1NZlHXJlXV0MXDfRQc61/mF0ZCg44pHVG0qDBjLXG953HpB/rD2j+E8iir+R:g/3Xx0GlQN/meZucQjq9FHpVrDe8X+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141450, "uuid": "454f8350-db0b-44f3-ac70-fe2b925578a9", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141450, "uuid": "d7dd1fb1-48de-451c-b6d4-f39c695e1322", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141450, "uuid": "0c6ce22f-2374-4836-89ba-c4ea4ea468f5", "value": "fa3d294cf961ac387078f139dedc914c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0744ce-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1622141432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141432, "uuid": "c9ffbe0d-f79c-4fe5-ba66-059e950af61f", "comment": "Malware payload (Adware.FileTour)", "value": "86ce63ad5f2cf6eae2b3ec49f3fde226", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141432, "uuid": "590fcef2-5d11-455e-a067-b0011731b409", "comment": "Malware payload (Adware.FileTour)", "value": "2cafa910950afa826e2e255ebe4c40a611bcb12c012a502a36efeb2f4effe320", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141432, "uuid": "0365f435-c20f-4ce2-adbc-04a92aa1bc28", "comment": "Malware payload (Adware.FileTour)", "value": "cdbe51cae30a7428dd904154caf7a49b270af09f", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141432, "uuid": "532884cf-8d43-42a9-8461-f33fc1b1990c", "comment": "Malware payload (Adware.FileTour)", "value": "cc53e419f4ef53be22d7a9bc63f629ca06e80642df2ffca0ff9c828dd29f475366e1929b41ce96f3eaaeea93895b0a3a", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141432, "uuid": "8012d9af-e4e7-4c83-80c3-af73c4901a99", "value": "0D163390BAFB46F7E1C10D3498597BF318BE8799473085BBB370C48CDA1E5DAA426349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141432, "uuid": "bad885d6-bafb-4620-8f9e-39b1a0861db2", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141432, "uuid": "15afa643-3528-4d52-a9e1-2a6dba0ee8bc", "value": "98304:x6CvLUBsgLZ08l6lTYWpt+sk+vfZc6lkI2zhj+RNPw0KLq:xbLUCgLZTl6pYcKyZc6W6NPVKLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141432, "uuid": "daff83ba-9238-41fe-b735-4741deb80645", "value": 4046778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141432, "uuid": "4487bd70-7d87-4709-9e6c-38d19b01eb2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141432, "uuid": "dc3a03eb-9158-44ca-ab6f-9fd525c5a829", "value": "86CE63AD5F2CF6EAE2B3EC49F3FDE226.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fdd5868-bee1-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1622116128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116128, "uuid": "a46d5d16-9158-4809-994f-5e2b9ebc9016", "comment": "Malware payload (QuasarRAT)", "value": "155201aabfb2ecec89570c0d3a291de2", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116128, "uuid": "2fbfdbac-abe8-4b87-a47c-45811e7d5bb8", "comment": "Malware payload (QuasarRAT)", "value": "2d2d145258f742a119d954f7a6be15d87bc5251965f3170a8ce363bfac30f8d6", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116128, "uuid": "438f0730-d7dc-4786-a81c-d657ed02c620", "comment": "Malware payload (QuasarRAT)", "value": "c77a926ecc9faf16f7d685afa46c714f4c26bb96", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116128, "uuid": "7a676f6f-fae1-47e0-987b-bd45846b123a", "comment": "Malware payload (QuasarRAT)", "value": "2c9628ff7829ec2de857d589d4affb68a472e5ef6f9c1fc3f78116751767e9dd79ae2af75be76f50193612c042389fd5", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116128, "uuid": "bc7671a6-dce4-44ab-aa0d-6e942d0f7a3e", "value": "03E5632335AF40D5E072BEF5FAD06552891ABE2226067059107D32B607F2AC3CDB5DEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116128, "uuid": "a8452d16-6b47-44d1-9c71-238f7269a99f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116128, "uuid": "82192032-5b7c-41bb-8748-bfec91eae431", "value": "24576:n12D5PAt70oh320464YJtrm5wnzQfEI7OXZb:n1agh32ucz7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622116128, "uuid": "cd64dca9-4a23-442a-99cf-053681ed3367", "value": 3061248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622116128, "uuid": "a1e79e6a-9db8-411c-9f0e-13c500d5ab87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116128, "uuid": "6b3c118e-da09-4379-9956-242c228fa8d7", "value": "2d2d145258f742a119d954f7a6be15d87bc5251965f3170a8ce363bfac30f8d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f896cf-beb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622095950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095950, "uuid": "9339cfa0-f9c6-44db-a1b8-c5bba1920edf", "comment": "Malware payload (Formbook)", "value": "3905fa1ffa0fa6bcfcfe192db8bf0ac2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095950, "uuid": "07b4db34-68b4-41a5-bcf7-c0c825b666b5", "comment": "Malware payload (Formbook)", "value": "2e33d05840368e708c642f732f8237c8a7315a6bb4fbd618015b59b8271e9954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095950, "uuid": "2e4cff40-8ce6-49d6-ab7b-fdd992232087", "comment": "Malware payload (Formbook)", "value": "da164113b7796d843cf96a6e1ec7d8388a933e32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095950, "uuid": "1eaae376-9009-4f4d-b83b-7c83c975160d", "comment": "Malware payload (Formbook)", "value": "f0280557efee3cd6f596e9bf71c88d09af98994bb331e6f39b70b77e33fe88992eead5086caf954e7dccb29ef21f7efc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095950, "uuid": "7a3a5818-058c-403c-be75-8a43ebefe2f5", "value": "8C94231E33B98B5AFF6C16B288705120837EF0479A72E34A4790A4DF1F57740C5A6FA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095950, "uuid": "cb0476a3-2563-472d-94d2-79e58bc526e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095950, "uuid": "ab49c80e-a58e-49a6-9431-15aefacd5032", "value": "12288:rCoPyzEWh3Jptj5bglGKGzBdwQ9/Wnxj/9Iy:rCJzrbtj4qzBdZ/Py", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622095950, "uuid": "351c3a50-8668-45e6-b4f8-2df65b225875", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622095950, "uuid": "86ed5693-17e7-43e0-b871-de212d0024b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095950, "uuid": "9a106eb5-0b68-46d2-bcee-9f3e78ef208a", "value": "l4M4vBmzSCgDmGC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c652918-becd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622107452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107452, "uuid": "f67700bf-6fe6-4aaf-a2e7-c150f47a9b00", "comment": "Malware payload (AgentTesla)", "value": "f2b9e2f3c527e0d571265a3ab87b67d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107452, "uuid": "8e5b59d6-8772-45cc-ace2-f9bf047a8f03", "comment": "Malware payload (AgentTesla)", "value": "301ce03dd4b568332c1540034f427f1ec8b27061aef01bebb702c9da41755ebe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107452, "uuid": "b0d4485b-3d2d-468a-8947-c16ddb11f25f", "comment": "Malware payload (AgentTesla)", "value": "4ffb4e5eee2dba8ca4f7fc73dcb8e2a5c41c892c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107452, "uuid": "c21122dc-85e4-4820-ad12-574cbe176b5f", "comment": "Malware payload (AgentTesla)", "value": "06907d39fb7af9fba4b9c91435fe21de095401e8887d33c7e0008cb92c4c85f9b44d8460d4797a96d13c8a016887d4d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107452, "uuid": "f00e4ac4-beaa-42e8-a7d8-6938d387e987", "value": "79457C9CA054E456D46AC6B16DDA5433E092EF7F6070580C99DB7B1A27B3F41308FE2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107452, "uuid": "d3c34b80-0db9-410a-ac72-1a6e57c515b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107452, "uuid": "86affc49-dfb0-445a-8fb5-b7f301e1bed1", "value": "24576:hCd6769xWihS6CRNYly5PyTAR+B23hIK+:hCDTphS6C+y5PGAE23ap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622107452, "uuid": "dc2fc622-d4d3-4f21-a492-0ed220e0ea52", "value": 1213440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622107452, "uuid": "f714a28b-d775-4c8a-a9f9-4df0255eaa8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107452, "uuid": "a232ad85-e63f-45e7-a775-71bcfd7d9cb8", "value": "PO_287109139.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb32cb4-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141490, "uuid": "185f8c4a-d40c-49f7-ba0f-6b92fb1ef1ce", "comment": "Malware payload (RaccoonStealer)", "value": "b145bb40c4f1452cde5614728caaba47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141490, "uuid": "79426d00-c754-4ebf-a3f9-f9b5435f6981", "comment": "Malware payload (RaccoonStealer)", "value": "30533b2971baacd90ced91575f56e078fe01e88aebffcaf7784ebc4140259c34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141490, "uuid": "7a0ba0a6-91d7-417c-99f0-fbaf5a3cd49c", "comment": "Malware payload (RaccoonStealer)", "value": "2271ea45b52f58f722457f63596b91448b13a9bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141490, "uuid": "ad5f9d79-ba31-4068-ba08-51f88057fc86", "comment": "Malware payload (RaccoonStealer)", "value": "93a88f26937b1d9f4782d1a04d6b8a5074163ea32cd19b1c8d962ad25628a4c1f5a3503a57a86a8938b6cbb7a6fcab8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141490, "uuid": "dc1f5454-a52b-41af-bda1-1da2175470d4", "value": "38C4DF21A691C034E0F3D6F45CB582B9A73A7DB2A73440CF62D43BEA56346E5AC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141490, "uuid": "97fbe68e-8f6a-4a60-9454-3a6de7e69da4", "value": "bca4c139115857ba195befba3c3bfd5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141490, "uuid": "7e362be2-52d2-4e17-901c-b77182d29adf", "value": "12288:IzD/9LFCzLIcj8ttcTvTzEzQwI8UnMmsNHpk6VyrCODr:K/6La3cfAzQJLMmsVpk6gGAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141490, "uuid": "ce272939-a8ff-4bfa-b6ee-24a48fd7eedf", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141490, "uuid": "d4123b63-f685-45ed-b623-81749652d2aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141490, "uuid": "1f890800-a7ec-44a8-a517-6394798074e4", "value": "b145bb40c4f1452cde5614728caaba47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4f61ab-bee3-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622116820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116820, "uuid": "f16e8608-b283-42c1-8055-d65f0accf924", "comment": "Malware payload (Loki)", "value": "89fe4d956001d916ae4bd46f3e647bd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116820, "uuid": "d222c6ae-d1aa-4b74-bf32-3e4210285345", "comment": "Malware payload (Loki)", "value": "33a011d618f05cca14d9d987c92d0b880ba893480615fb32f40e58a4651a5a4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116820, "uuid": "0fd3bfb8-6928-4424-9c1d-39142ba9c9f0", "comment": "Malware payload (Loki)", "value": "3842d6d29ab620d392b7ecf6f490fd37b242299a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116820, "uuid": "7a04982b-fa94-42e3-95dd-732f054fd930", "comment": "Malware payload (Loki)", "value": "52fedb7194784c7a30bc8980a3d7164dbe593db7694bf6fe7efcb892e4abb2498ba561f88889ef6530a5da28608855ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116820, "uuid": "0066c905-314a-4c27-9427-ae2b6f9f3acc", "value": "A845B43577A407A5E4B3463546F8623787B37CBA3720E98D2C6133358AB65811E2DF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116820, "uuid": "1a5c486c-e6cd-4814-9fa4-d8d4f73cb3e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116820, "uuid": "4fe29eb8-adb2-45a8-aff7-eb76624d5a90", "value": "24576:YSmyxma41GfkzRUJ8eRc0lQV5/uEg/M/:/myxmaSG8zyW0lw4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622116820, "uuid": "19b4aee0-d153-4d62-ae96-8b2e1f142375", "value": 1222144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622116820, "uuid": "86551fae-8844-46ad-a33b-f76f5232ee38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116820, "uuid": "ca79dcb5-5eb6-4316-8c26-e28e591bd1d7", "value": "Original dhl Shipping Document_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1151f5-bece-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622108127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108127, "uuid": "d5eb5a5b-2210-41a7-9b8c-f5ca454ac602", "comment": "Malware payload (RaccoonStealer)", "value": "1ea80e6a35c7ebf9661d9c7fa5ae85ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108127, "uuid": "ee8f9122-2159-4f8c-9d8c-f3cd48172fb1", "comment": "Malware payload (RaccoonStealer)", "value": "34eea6a07ea67c590471581473b4a17d5ac8214e1ec94464af43fb2ce7334808", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108127, "uuid": "d73a4a85-8204-47c4-944f-c1056c1e2c1e", "comment": "Malware payload (RaccoonStealer)", "value": "5b0771b1886a5e77bc9fe9505a11e94d10a23d07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108127, "uuid": "482ee83f-28a5-43b9-908a-aae567b2ddd6", "comment": "Malware payload (RaccoonStealer)", "value": "ab861b5de01f1824c8317e512ac95a3cd84ebd97637a6dc59bdf629514e4580ccccc53d3fd9f8693b9fef227c23e4317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108127, "uuid": "af4ca968-9010-4558-89a6-e01df393abd8", "value": "25D1EA04B3C84A32EEFA42B66E6363518774F795D8278BAF28C4224B5C37B450E52B31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108127, "uuid": "215560e4-79e9-403e-85f5-0e2953316c0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108127, "uuid": "f7457089-3f9b-4c9d-b8b4-1f8fa4d098c5", "value": "96:3WmCPRTgQRmMnG6+0zP1JkJXNMaIXMe0fzNt:mlTiqXxzP7uXNocZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622108127, "uuid": "3051183c-6987-4441-ba8a-5f0bf67c3488", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622108127, "uuid": "622b30c8-35f2-4d8c-ad8d-0840657694b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108127, "uuid": "c5b7bac3-7bec-4804-8f33-e08bf7204178", "value": "1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d492fb5-bf30-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622150081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622150081, "uuid": "98984491-cbf5-4037-9b04-6e67ec7282aa", "comment": "Malware payload", "value": "db3cad4eab87f8567c0597926361447b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622150081, "uuid": "e18b9f50-8e1a-488c-9da1-d2cfb2df4add", "comment": "Malware payload", "value": "355e27face9221cba40aa70d9054bc9d38e57e167e72f92baae989d6b3cde2c2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622150081, "uuid": "1c5f47f4-83c7-4b65-bbf9-a2ca7df12b28", "comment": "Malware payload", "value": "f0ed729541a5ef76c55864b0c8d632e170a2a517", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622150081, "uuid": "d4b89454-591b-4ee6-9a3e-0eac685cfdf9", "comment": "Malware payload", "value": "50b5b530bfe85b0eb9f6e76f6ad32c485f8b033db0c3973c7459191e36563703168a42237bd21317ff1f5d2fdbd9c6f5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622150081, "uuid": "1517b1c6-fd9c-4f26-9b9f-41b58064a93f", "value": "CE554951F101A42FF6B406F2497A9BF7CE71EC038A2472DAD7DA3668073D993462DD82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622150081, "uuid": "10019caf-95ed-4fe0-8a0a-b37deb7f1d2a", "value": "1ead8b58f090444c7c586af0c5013096", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622150081, "uuid": "ed655f64-b150-4f58-984e-e372a6e19cc0", "value": "24576:jbaZ/zZ414hRSHiHAhbzvn414hRSLiHAhbzI:o7Z414MGGD414YGG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622150081, "uuid": "07e43cf4-9b30-4d42-be65-894149bc7e29", "value": 1282127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622150081, "uuid": "d2da64b7-ab3f-413a-a0da-fdfa32604fed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622150081, "uuid": "78425062-6c76-4526-84e2-9c64d83bf75b", "value": "355e27face9221cba40aa70d9054bc9d38e57e167e72f92baae989d6b3cde2c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e948a22c-bead-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622093971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093971, "uuid": "2ed67911-db13-41bc-b16f-42fb283af77e", "comment": "Malware payload (AgentTesla)", "value": "c43ae48b7d660e3efc0d4ca9c4e6e710", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093971, "uuid": "557a97a6-ba2c-4454-90c6-0aac8b1e70a7", "comment": "Malware payload (AgentTesla)", "value": "37ba529fbc8776f8f59bc70e4ffdc15fcbd4794453d7e368e8242dd82df6ad11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093971, "uuid": "15f6bd5a-e88e-41b3-ac3e-743a5c849fb4", "comment": "Malware payload (AgentTesla)", "value": "e10ea0947a5f321b7f11bace50d6c84a1bb6a72e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093971, "uuid": "f224a5e0-0745-491d-a69d-9b4f60bd3deb", "comment": "Malware payload (AgentTesla)", "value": "1a5c5429c78fc23d3a41f667fcaf6d454b4f72ee40d19f6db16bd1fb8c6cad0ea4dff747e1420b25346cf7edf9c89d49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093971, "uuid": "ef6818c9-ae17-4526-819d-98b039e017b8", "value": "2B7423158A1795E0C550C98E6ACD409FBAFB95A4BBAC3C40891C73C8708DF86EBC71B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093971, "uuid": "2dfeb3f4-896a-4295-a432-68a0953fbbec", "value": "6144:HQcfUxY0Lz/u8xBa2yR+HqhUVWe2IjZRAQ6BIOCtl6Mj2z0BP1Mp:pfIYwPxBZhHq7OeQUil6Mj2zqP1Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093971, "uuid": "7527a741-78ae-4419-b58e-657a2f3d86c2", "value": 339169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093971, "uuid": "d660f8cc-89a7-41cb-a259-815c3414e368", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093971, "uuid": "5fc93413-ae65-4da1-a1cd-72b02708ad63", "value": "PAYMENT BANK INSTRUCTIONS COPY.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f34c1d9-bea9-11eb-875b-42010a9c0053", "comment": "Malware payload (SilentBuilder)", "timestamp": 1622091914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622091914, "uuid": "1ea55b7c-4102-4c0a-a80b-16e1c3aad25d", "comment": "Malware payload (SilentBuilder)", "value": "986decb72a1aaa604cd4ae3d5d815c95", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622091914, "uuid": "48cf99c1-18ea-45b1-8b19-9b2ce563507f", "comment": "Malware payload (SilentBuilder)", "value": "3889272af2ed74b3b229a6a0d6025d3a9e96cd5f486f802cfe618c047181c7d7", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622091914, "uuid": "3afe927c-4218-4580-a8e5-3604d9521d5c", "comment": "Malware payload (SilentBuilder)", "value": "e9e4b2c45fe23f0a7f9468043ed2dd310786b29a", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622091914, "uuid": "0938f5db-56f9-4ee4-a7e3-6069d3f8acd5", "comment": "Malware payload (SilentBuilder)", "value": "4031d6064d6a68d7d6d3d12d70bb8d3284345bfddae856dad7749aa4c1f9d68c62acc15ee9767e7e43b23796f6a3f949", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622091914, "uuid": "a734fd18-908b-441c-8929-d7c90a1155c5", "value": "DEE4741CE24BA116D3214B77FE158395817BBDA2491DBA4A375DBA2ECBF01D0E71C328", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622091914, "uuid": "aeabd484-ec67-4126-baa0-060c06e93cf1", "value": "6144:d6tIrWqrY5O3NMHGRYc9u/YRTP85XbCxOdEMrPNj+gGtjMHwJV:DxOdEMV+Pt/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622091914, "uuid": "c86dd7e8-22ee-402a-aca0-9705e869aba0", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622091914, "uuid": "f0b31f3e-5b0f-407e-a3db-6c5d4f22900f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622091914, "uuid": "35a54a5d-91a6-43a8-94f2-d8ebe97af77e", "value": "lol.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f769739f-bf1f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622142958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142958, "uuid": "9e107917-4745-4247-afaa-6f5052f2de22", "comment": "Malware payload (AgentTesla)", "value": "0e24059570f9655711ba4454c21c9e2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142958, "uuid": "3d14019f-4384-49dc-aa8d-a23e3550d15e", "comment": "Malware payload (AgentTesla)", "value": "3931b6203a3812f8e88eab9f33619db282e61fd02e1aa5de7bf4289fddca4c6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142958, "uuid": "954179f1-2fbe-4403-b2b2-bfa402d4340f", "comment": "Malware payload (AgentTesla)", "value": "924d9bb832238ac36e04ec0d90a64cc78f3c399a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142958, "uuid": "83e0ab56-e6ce-4188-827d-c94732d06e55", "comment": "Malware payload (AgentTesla)", "value": "8961053149d4c2074b119a762282afd55f984cd50dfcb5cdf5fbe742d202e69639ff281fd45dc8039f46cf869db1cf61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142958, "uuid": "96356151-0eda-45df-9c39-d94421756b23", "value": "FEC19401A3EC837AE9B70F752CB353006279FB019C67CB6D2898911DAC27798DA71B70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142958, "uuid": "519ce24f-ba7c-4269-811a-4fa677260528", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142958, "uuid": "2760940e-43f6-4fab-a4f7-4452cafbe249", "value": "96:jrekZvkg2vwAUDaZ2j9YXQbheD1TIoDKk5WiUtWwAzNt:J2GO2JYA+J5WiUtWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622142958, "uuid": "6e7bbe8a-7888-4d20-b743-aa4927e99d55", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622142958, "uuid": "f4e1ed8b-6ba7-4c79-9dfa-0c20069a493c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142958, "uuid": "ab596dbb-99ee-4ded-be5f-845a209f3549", "value": "0e24059570f9655711ba4454c21c9e2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9056cfce-befb-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1622127323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127323, "uuid": "06d2ca91-a67e-4ae5-9ec5-2e22cd5a9d79", "comment": "Malware payload (IcedID)", "value": "de6721854fc03cd9f6c01db0379d123e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127323, "uuid": "352568d9-1327-42da-941b-587703086516", "comment": "Malware payload (IcedID)", "value": "39dde7049b772424639030d139edf59fb1f227604c6a3a16218868f9c64cbee5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127323, "uuid": "69056666-f870-46fa-958e-e4bd81336bac", "comment": "Malware payload (IcedID)", "value": "51a19e7d17fc000fee74a4589963a472c4e45121", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127323, "uuid": "343e58c6-956e-4430-a5ec-49e0e2e81d29", "comment": "Malware payload (IcedID)", "value": "bbb1e21befb3e0e9a9986a734c0c7243bb0b17063ca7dffa1eecf683b52b6fe377f563256dc6949f4a6b3412d91e8f7c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127323, "uuid": "abfbf395-cf7d-4df8-a272-c556101f0899", "value": "26033A94EE5E4F72F81BC9B58135BDBAF8712F223B00017D316EAA860914276DF9152F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127323, "uuid": "f74432d3-f3fe-4291-a84e-2f5a787df1fe", "value": "768:jN2tSDk4s1dmpiTD5w9CwGiBkHsmiKIyxHO6/UvHACqrn8V6HUX:DDk4s1dWiJwswbkH2VyFO6/Bn8V6H8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622127323, "uuid": "daf561e3-c75f-48a0-a298-2c3d2d119792", "value": 38527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622127323, "uuid": "048a2954-b20a-428b-b34b-c5bec2094418", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127323, "uuid": "8a753706-f3fe-4d02-b9de-51ffe542a96d", "value": "39dde7049b772424639030d139edf59fb1f227604c6a3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9867b4b5-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141510, "uuid": "915a06b6-37a2-4b44-8ef3-1fbec1286842", "comment": "Malware payload (Stop)", "value": "f5f66d7c56e60667e415b9b4f0228786", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141510, "uuid": "decd0ade-887c-4971-9c86-3c0941d6dfbd", "comment": "Malware payload (Stop)", "value": "3a09aa16c5145a98787f47ed450af31c32e30811fcb0595d688d1d83a2ef329c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141510, "uuid": "8e630f2f-1bc1-4ddb-8af1-438a359af413", "comment": "Malware payload (Stop)", "value": "db59251b5bde7faa2d9c68726a0ce5e9b3528126", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141510, "uuid": "b8646a87-2921-437c-85ff-33ceba660a6a", "comment": "Malware payload (Stop)", "value": "fccb124080177cde181bbf7f68ba36baea4d290dde7483324e5b62994bd779044f23b36339bcd06c1bc96a39e3033801", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141510, "uuid": "ed74ccdf-c622-4009-97d4-df82d2273ce0", "value": "4905F120A7E0C038E1F712B44A75B2F9A63E7DB26B2451CF51D43BEA46746D4AC30B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141510, "uuid": "2cb06da8-4ad3-4557-bf92-b7023b0df915", "value": "556bc424bd608c9e064a122699e67eca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141510, "uuid": "a4a08fd9-fb79-4e3b-a82a-822bb87882ce", "value": "12288:TbWTM13E0Jzsaqjvm/hA9H++J7AT4qdjLvE8UWOphHJ+gpdFjKfJN6FVzP392RsC:OT6JMjv79HhGEIbEnn+ghA/+t22NpXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141510, "uuid": "d667531d-c84a-4488-a9a7-311ecae2f359", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141510, "uuid": "ad9f3229-1f6c-479e-9edf-9e8e1d40b4d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141510, "uuid": "1d85054f-79c8-44ee-9d0c-801105e3041c", "value": "f5f66d7c56e60667e415b9b4f0228786.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557a0dc6-bf3c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622155141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622155141, "uuid": "8b12255a-c5d2-4af8-a331-5d7f477e8677", "comment": "Malware payload", "value": "fc5932462bd69e87c738f231ebd69f85", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622155141, "uuid": "138c0982-e251-4678-ade4-5df5070b7b9a", "comment": "Malware payload", "value": "3a1590ff5ad4f50d8b4f17428f341c6fcc4314c04ef465a8d51a3c9b3efca2f6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622155141, "uuid": "67f1698b-110c-4847-a73b-212be5b6c7a6", "comment": "Malware payload", "value": "8062d3eb7de5386cdca3478582a2d6840d0d7d6f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622155141, "uuid": "11c4ae10-eb8b-458d-bdd6-ec282765863e", "comment": "Malware payload", "value": "dab54ff79b894f45cf838e84beb9efff84f952da879441cfec7a502203d1d64f4dd4875fa21574d6bb6942f3bce19793", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622155141, "uuid": "f0fd0a77-ff51-46dc-bd42-16cf214dc365", "value": "55728C132776CE6ADC908D7999F5E8A3D7F87CA35C08C427750A7626ECB40DF8001B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622155141, "uuid": "e1eb13d6-80f4-4d75-aa7b-4e389a808b03", "value": "192:YM9xCNG3+juqffLolQXuJN6T93NoNQpEVbajATFOBfXAdJiUSb337XaQCFapvrg4:/YuqHC+eN6kN5ZTwlYiDbT9xrFSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622155141, "uuid": "d175bdc8-4efd-4537-9072-a5a2621dcb67", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622155141, "uuid": "1833d479-3902-42b5-b8b0-18c83ceb8f4e", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622155141, "uuid": "3c880dff-53b7-44d3-b011-7a142440b595", "value": "SecuriteInfo.com.BehavesLike.OLE2.Downloader.lg.5891.23903", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b8511f-bece-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622107845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107845, "uuid": "cb5bef68-f2dd-4011-81ba-cab5af85afa5", "comment": "Malware payload (AgentTesla)", "value": "4916a124cc953aa9208ca30525d5bfdb", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107845, "uuid": "5d365da6-02be-41a6-bd76-42ff8d1672cf", "comment": "Malware payload (AgentTesla)", "value": "3a2c294202eb4eebbc24a81041afadebae4d11fc741276cb8de8e812382354a6", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107845, "uuid": "fcf69cd3-0ce6-4723-90f8-d280632bd0dc", "comment": "Malware payload (AgentTesla)", "value": "9c91e3a9f2525e554de2d8ced84bcf7ece3b7b63", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107845, "uuid": "88962c53-b3f3-4e84-b3bb-f9cb1cc3b494", "comment": "Malware payload (AgentTesla)", "value": "9b874a0449f4e57a37cec15035dcb8b02288810484d41bf86022cd212f49d2723867f5ef2c56b649d3e5fdf55d9e3fb3", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107845, "uuid": "e80fb330-e388-4178-87fa-d9fda21f7743", "value": "B6542362703D0A91EDBB463167BB8A46B7A68C1B351EF334F2416DA9255801C2D8FC9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107845, "uuid": "7c82f3e1-4113-4581-bdb9-4a995eb06570", "value": "6144:UU9b3cUEHDOXkRgXOxBPSaCnIsBjihNslfIVDLk7cKxFG:1bMUE3CXESaFNSaLkwKxFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622107845, "uuid": "2168b93b-6396-4178-b4fc-bae5545681ac", "value": 283681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622107845, "uuid": "14ffd958-7c16-42c9-9468-e42cd2943ec7", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107845, "uuid": "5894cac8-10b8-4125-813e-168c1d80c35c", "value": "Request for quotation SPRANWPD21020.pdf.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7029eacc-bee3-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622116961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116961, "uuid": "2bdd16de-d4c0-4695-a06e-c17f2058bb43", "comment": "Malware payload (NanoCore)", "value": "72cbf5a853b6db320b69cc61ef53543a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116961, "uuid": "971f9b54-ddf7-4e77-8c92-c5095eabbe02", "comment": "Malware payload (NanoCore)", "value": "3d5e89a87b2845450d3d26843ae4747e8692c7f37dd13b3a49d56b3d37880a0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116961, "uuid": "78afe6e2-1ef1-4f85-994c-1ab9c350bfaa", "comment": "Malware payload (NanoCore)", "value": "71bdc1ee2e943d288c85c81c35a2ace5f7cbe79c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116961, "uuid": "52d3e4cd-e146-4e70-82a5-a73bcde340bb", "comment": "Malware payload (NanoCore)", "value": "c7d56b53091dea8dd6eaecce9e925c487bf8dff83f8cbf2555d826d0f9df16e7b9e8c961baf1ed59f7a9ddc7baccfb9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116961, "uuid": "40c7430d-b057-496a-b946-d293cb826917", "value": "50554B492504D712D239D3748AFAC4B303E0AC27E210EA9E9CD63F9637B67C7264656F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116961, "uuid": "9b7d817a-489b-4034-ba32-9496cbc76c72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116961, "uuid": "cf0905b2-af73-4dba-84cc-94f0fa404ba3", "value": "24576:0oEFo0N5PXLTHAeIQbK2RGX6tYi8cqb4:05b/bpbK2RsHiOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622116961, "uuid": "134ff712-a92e-42f3-877f-49b6bab90b41", "value": 1319424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622116961, "uuid": "43737166-2bf8-493f-918c-4733eeed0686", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116961, "uuid": "1762f363-4d5b-42fa-b5ab-cc9a71f14172", "value": "Purchase Order Contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344e17fb-becc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622106982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106982, "uuid": "29a0d0f0-3b64-4931-9857-c226e1036802", "comment": "Malware payload (AgentTesla)", "value": "e53a6dc2b42cbedd39ba8aa982fac29d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106982, "uuid": "ac6fa3c5-0157-446c-aa5e-c6c42867afa9", "comment": "Malware payload (AgentTesla)", "value": "3e93348fc012ad9b6652b8bff8c2e7fb4e202b0b2f1093e31dc7a23b6d10724e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106982, "uuid": "96492035-e6a0-4f3a-8f06-bd336d620919", "comment": "Malware payload (AgentTesla)", "value": "aed5b5f7b7cbb56cd7985e15226d3dc3413a62e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106982, "uuid": "4e9e64a0-0c5d-4e8f-9df7-3f5998d87146", "comment": "Malware payload (AgentTesla)", "value": "5b9c8f80e81bdcdd17286296ebf0608894d3e3b2b3a701b60ad54b8be38a7bf729649c161cf9d02c05156a49b04432ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106982, "uuid": "191cf815-51f1-4e53-be27-8bdb9c3e41d2", "value": "BA15AD2C116EF626C1A8C2BD0AD5843BF590D7373131BE69ECD30B995B19E807D9227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106982, "uuid": "a8b364c5-adeb-4878-843e-3e3013d1c615", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106982, "uuid": "2c6faa31-a8b2-44fb-8f5c-73d53d83e9d9", "value": "24576:jSSppE/UzE27iFdQtgIdyzeBjTiZlWUYEILA:jSY6DlQtgbzijTiZkUkLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622106982, "uuid": "1f6078c7-193e-4c2e-acd1-b54c9e21ad21", "value": 908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622106982, "uuid": "95fd541b-3763-4105-98f4-e906a83679bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106982, "uuid": "15fa0545-af7f-4169-bd12-cddd05ad7caa", "value": "Tender proposal No #10087440 SKM-SC #PO_SC1005 11_05_2021.PDF.Lzh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83aeec1-bf0d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622135228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622135228, "uuid": "68140cd4-2460-461b-9b61-4fe5d73c41da", "comment": "Malware payload", "value": "94f92099eefe43e827893ebe98da5d20", "object_relation": "md5", "Tag": [ { "name": "bonk", "colour": "#A8DF75", "exportable": true, "hide_tag": false }, { "name": "Win9x", "colour": "#378144", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622135228, "uuid": "c927932c-46ac-4320-b634-180c06037c17", "comment": "Malware payload", "value": "3e9a821d3cc6ca85e61a306367a8fbec2e189d4a0b313132eb952ba7a6896d9f", "object_relation": "sha256", "Tag": [ { "name": "bonk", "colour": "#A8DF75", "exportable": true, "hide_tag": false }, { "name": "Win9x", "colour": "#378144", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622135228, "uuid": "fe3c895a-5afe-4251-94cf-0e12dc8213fe", "comment": "Malware payload", "value": "a301fd5f60e39f7941809f114e18fc3ebcca4793", "object_relation": "sha1", "Tag": [ { "name": "bonk", "colour": "#A8DF75", "exportable": true, "hide_tag": false }, { "name": "Win9x", "colour": "#378144", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622135228, "uuid": "bd57623f-d146-4414-b72e-f8b932e3d9f4", "comment": "Malware payload", "value": "f0c7a788fa45026e4cd357e5d24b384dd73fbb6e9ea1e6360b3b27dcefdadbeec8049f6607a0e7449151939bcf1850d2", "object_relation": "sha3-384", "Tag": [ { "name": "bonk", "colour": "#A8DF75", "exportable": true, "hide_tag": false }, { "name": "Win9x", "colour": "#378144", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622135228, "uuid": "7088ef65-249b-4f7c-965d-fd9605e4f745", "value": "3B12C64766C1CCF1D7A2E270259A1B36FC3B503003B4E343EFF199A48D696216E6C95E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622135228, "uuid": "6f036aa6-18ce-4aa9-91a3-1668f932e043", "value": "85b4f800b137f5a96ba3ddaf09fdd13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622135228, "uuid": "2c8ed5ba-1d03-4dca-86db-72feefc2541b", "value": "48:OEPJluOTv2DZp1qV/rloltsd6+FwX5wX2Dqak4BtR2Bx/+GpcBF9kOTv2k:nPJg0voZfqV5oA6+iWGvk4FqQg0vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622135228, "uuid": "435d9b4d-0daa-4afc-9275-3dc28db7779d", "value": 9460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622135228, "uuid": "525d9300-e9a4-4ee5-b908-e080321ba6c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622135228, "uuid": "d9822e18-972c-4c1f-9905-f1e470f05c38", "value": "mohkdr9wb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e68c13-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622141589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141589, "uuid": "559c1529-79c7-4235-ba69-7006b8720e4e", "comment": "Malware payload (NanoCore)", "value": "240b3b4f23bc74d748228cf5914f1cee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141589, "uuid": "fa3260fb-cd14-4476-8bee-8508f5ed2c79", "comment": "Malware payload (NanoCore)", "value": "3f7f51a2a41fd652b3a547c0e4a944b10415ae29012db1e9831c45baf460b147", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141589, "uuid": "d3df039c-6b0f-4ae9-ab39-3736e5398bff", "comment": "Malware payload (NanoCore)", "value": "a1475186a28bb6ba0bbf76eaa362ab2e0a3325e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141589, "uuid": "98ea2290-797e-40e5-9180-245eed3873e4", "comment": "Malware payload (NanoCore)", "value": "be3d78a80dad1f357ca77d609ce30441fcd835928668e7295503ce9e938cfb9e9e44bb92d67f8bbcc364c9368ededd6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141589, "uuid": "9582a85b-690e-496b-93af-629e9cab40fe", "value": "9D54124AE6E9762FD1D669F836D395200BB0B367ED42D3CB8414A25517837E8C902FB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141589, "uuid": "6259d6ea-053b-4a1c-902c-5a3835680239", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141589, "uuid": "af595716-d160-48e6-bfb6-f43999178cfa", "value": "6144:O//4atS8KaNQL8bGeu/Ik767x4jCkdgBBNXRklp:O/Aat1t68yeLkfUBBkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141589, "uuid": "4c088f86-17b4-4037-a094-54ce63fc7267", "value": 290416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141589, "uuid": "83266560-30f8-489a-9fac-310bae85b955", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141589, "uuid": "102620de-4342-4488-9b6a-b6ebc8daebce", "value": "European Union M.8330 - MAERSK LINE HSDG RE..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c08513-beea-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622119834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119834, "uuid": "cecc6337-80d8-4260-98d6-6cac98554bc4", "comment": "Malware payload (NanoCore)", "value": "a5b823d39f412dac505d9c5907d65251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119834, "uuid": "ab5cd094-8074-47c1-b9c6-b351c7e37e37", "comment": "Malware payload (NanoCore)", "value": "408eb0b0d835fd9b2fb9c5d274def10ac5f94eb77bed666dff3dd67f8cac0da8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119834, "uuid": "63d05576-1c7b-44a1-8630-23dc25a58dc4", "comment": "Malware payload (NanoCore)", "value": "0b1044d06d2aee41e59b83c28b4e4945d4ce1ac9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119834, "uuid": "14a4dcef-4fcc-45e3-b21e-37c607a5289f", "comment": "Malware payload (NanoCore)", "value": "8bb3394b305b2df13074a42d00cf1a80ec2259d8e1007b9cfd6af8a5014eeacfe6952d07526456914a7ee84ad642dc12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119834, "uuid": "13e36d52-60f7-4b32-8a79-690138b19591", "value": "0985393573A407A5E4B3463546F8623787B37CBA3720E98D2C6133358AB65811E6DF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119834, "uuid": "bf3fdc3d-7bb8-4233-ae00-750cd180e0ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119834, "uuid": "299ec264-4eca-4c47-9629-0fe21ef76462", "value": "24576:y7Efkz+xgi1mNlr+MnznPCY04Ll+uPguDxls9Cdiw5/uEg/M/:5sz+xgcmNtP0GZjDc9w4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119834, "uuid": "f7b3c9e9-99ef-4fe0-80fe-ed8310e0ad26", "value": 1710592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119834, "uuid": "5000b0e6-a10d-4376-9c67-416e2104685d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119834, "uuid": "b6095abb-0c33-4b1b-8ae3-21dcb566711f", "value": "a5b823d39f412dac505d9c5907d65251.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183e6db4-bf1b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622140865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622140865, "uuid": "05cb37bb-39a0-42fe-83ab-671f0bb40ad8", "comment": "Malware payload", "value": "0b1d7c043be8c696d53d63fc0c834195", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622140865, "uuid": "c45bbfea-d49d-4430-8a9e-ec251acd921a", "comment": "Malware payload", "value": "41075a26a04b275417fdb62d276f62c8a0ef6a460dd1bed6dc45d9768680b2da", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622140865, "uuid": "f10f13b6-039e-45ce-b6fd-e64de7768b8a", "comment": "Malware payload", "value": "23063660cce71c3a456530cbfd9f35f24e150be2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622140865, "uuid": "2aa0a33b-d13d-4ddc-b6d5-9ec26e24949c", "comment": "Malware payload", "value": "fd236ae6c8699d9e5f1c00723b400273b563383ba13a4f4d761a8ff442945d58aeb9436956d0ca9f04ca26fc6f8140ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622140865, "uuid": "c3046329-24f7-43cf-85a5-c0d5cfcf41ae", "value": "555318248F9E9523CA6E577FB4E3074757B8C5833003EB97269A13B41C8375A1EA11AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622140865, "uuid": "954311c6-dec6-4ab0-a23c-fa70a5d2622b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622140865, "uuid": "8da9806d-d75c-4cb7-b1f7-ce527e9cc416", "value": "1536:yvfR0V/JL/JqUTqK2AUR880/rH4+XE53pIIDFYKrrXrPx5S:8aV7TqK2R880/r8fuQx5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622140865, "uuid": "034169cf-7d3b-4173-be42-8fa85153e9ac", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622140865, "uuid": "347ec3c0-e36c-48c7-9e87-0fc46fbde8ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622140865, "uuid": "def5cc40-da5d-4d58-9c1d-6f2f1d074235", "value": "41075a26a04b275417fdb62d276f62c8a0ef6a460dd1bed6dc45d9768680b2da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13fa50e4-beb1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622095331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095331, "uuid": "04cd139f-dce3-4520-b258-4673127c6579", "comment": "Malware payload", "value": "46c52ddab4a5c2ddc01f7ffc9ebbd24b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "tdss", "colour": "#D3EA85", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095331, "uuid": "9bdf561f-790e-4fd0-8b90-c973cce4f1c4", "comment": "Malware payload", "value": "43100547d1d170118905269dc5c5653566ae4fb68cdf566c52c61dad9711cfa9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "tdss", "colour": "#D3EA85", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095331, "uuid": "3e6bce31-9666-4839-aa61-e8444d896b4b", "comment": "Malware payload", "value": "af209b61eb749eea1a2120c7648cc15df17f427f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "tdss", "colour": "#D3EA85", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095331, "uuid": "262ef2a6-3fd2-4b19-8ae5-1dc641481652", "comment": "Malware payload", "value": "d8acc1d5f8f5392883aa505a19cb074b895aee503ca5fdf0ca222379362cd1634d7967c6b0ec0289ae3a62601483b5e9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "tdss", "colour": "#D3EA85", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095331, "uuid": "fe5d292e-56b2-43ff-a401-506ee3486489", "value": "7865338F5F517198C98CDBF9D84C44BD1BF2537A96321F4635D80C04F1A6AB0EA0AAED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095331, "uuid": "d7e33bbc-2484-4a4a-a4c5-5807fb328645", "value": "4c723d6b389aa537ce6b4dd647402524", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095331, "uuid": "db582861-58c1-45db-b228-d00c29a35e67", "value": "24576:9j/X+eSUPYNN7BV4nHdm2P+ZOX1bbtj6p7WnjF/PC:h/XrPY7NUHdm2Wc9wpaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622095331, "uuid": "c8866fe1-cebc-4f62-ba15-37fce19d94dd", "value": 1497600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622095331, "uuid": "f048fd73-71da-4a17-bc6e-6cbce59d4d95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095331, "uuid": "01f52aec-0275-433b-abab-a2c2671857ae", "value": "tanked.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77ae2b6-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141535, "uuid": "bfc59c59-cd57-4262-b0db-628212bce993", "comment": "Malware payload (Stop)", "value": "8100de13ced8dc869518c7705bc5b3ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141535, "uuid": "258d59c3-717b-40fb-a892-400536464a5e", "comment": "Malware payload (Stop)", "value": "440056cb35dd9ca59aa7b1921538158bcf3b37a8c984d9774238aec1f4c7a275", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141535, "uuid": "4c9e080a-6af2-434f-9a1e-9cee8854a660", "comment": "Malware payload (Stop)", "value": "d522b182847ab1b0d39ce9639227c7d381d4a541", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141535, "uuid": "ad14bbc6-6c4a-4765-be1e-4717a1883d98", "comment": "Malware payload (Stop)", "value": "47eb5cb10802e5a6a204ce99671233dbec78871be0a0b3ace700c29d80a3620c87ec61435d5dcc4521fbe1324320f57f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141535, "uuid": "96608b25-3ceb-4e67-af50-5197c15e5c4b", "value": "F605F130A791C034F5F212F949B692B9A93B7DB1A73490CB72D13ADA66346E0ED30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141535, "uuid": "a46fed0b-42f1-42c1-bad8-2c0d0033247e", "value": "cb971fcf399235e4e9a69622d3809fcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141535, "uuid": "8a5af316-c304-4b8e-ad79-67ac0baa1590", "value": "12288:J+B/X6BsLDwEDvhePi0ZWu07XawNyuObQM7BkKS8SPZVTL0sPXMG7tV7QfAm:J+ByBAAViXGuOUwkz8SPZR/b7tV7QfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141535, "uuid": "8c6481c0-5beb-4976-8cf7-6ee25222a8cb", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141535, "uuid": "b7f0de02-34d7-476d-b283-f18d0ec7fc08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141535, "uuid": "7ec85c88-3f28-4dcc-9089-077f916a6811", "value": "8100de13ced8dc869518c7705bc5b3ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8475d652-bf1e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622142335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142335, "uuid": "2c2efc05-1c6d-43e0-a9d4-751f8ec8c05b", "comment": "Malware payload", "value": "3d081d1bd8aa121b56754528d7b13981", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142335, "uuid": "9f4e95a7-8f88-48ae-86e6-7cbbe366d72d", "comment": "Malware payload", "value": "4435554b4906c5a294e08a579a0bd6e7ae78bd0dcce24a7225a29ab2a731bd28", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142335, "uuid": "e07b7e02-06c2-4a52-9dda-5f269c66dfce", "comment": "Malware payload", "value": "87db49098bc0aa0b88dfa5c7f3954544dd3058df", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142335, "uuid": "38d74c0d-eadf-4631-9802-d1d12dbffb87", "comment": "Malware payload", "value": "a80fea3cf16d89e8202ebadeea2842c07a823dc15c6fad88d766b2702cf343314873ff5de13b19dab8b3a21fd9903694", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142335, "uuid": "7bc007b6-b824-49df-ba21-29173b267185", "value": "80A109F4A6AC4CD4CF7A81A996B4FC6912C6710BA7C617A4B1AEDA4307A5B613007883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142335, "uuid": "914c7efc-3e43-42b6-a2c0-0678dbb3dc8d", "value": "96:Kdt9KksmzFk1O0kkMAfnvNqJxlmaPsQ20/89yN+/32e7cfRTbw:MXK4CO0N9fvNQxQ+sQ20EcN82eKRTbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622142335, "uuid": "fc50aeac-2f44-4316-8f57-54c1a471e5c2", "value": 5082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622142335, "uuid": "d10a12f4-27cc-443d-9591-d0d6ef14cd61", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142335, "uuid": "7124c1bd-8ec1-4f43-9af0-bb44968df84c", "value": "order-confirmation.doc__.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c23319-bee3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622117026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622117026, "uuid": "5d9cdac5-3ae7-414d-8bdb-97a8486f7965", "comment": "Malware payload (AgentTesla)", "value": "ce393ccb80e06b6892c8518b7975bac7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622117026, "uuid": "85c1693b-a465-4903-a010-792bbb8f3c76", "comment": "Malware payload (AgentTesla)", "value": "451543e3cab5143897b7e54b6e80f5109c506f37f9378b51aadcd9d93785cfd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622117026, "uuid": "d70a9b59-481d-4171-b5ca-eeebbfae2d9a", "comment": "Malware payload (AgentTesla)", "value": "360ee1e39ddaf948574ea54860fcbb94d3692809", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622117026, "uuid": "e8cf6a95-f49e-4e58-bade-2daf29cc1e6e", "comment": "Malware payload (AgentTesla)", "value": "007956f3d47bf3a7851dcaf46a7651f922eadc8ebd28bc7ed8fb7a1504c81e2d029ddfa96cdf1332232f88e0dd731a57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622117026, "uuid": "49204461-fbeb-49db-8da5-1854f2126ca8", "value": "57850C30BBF6D428F1FF3DB890A57FA38C6E773503B5506620C628951A44D9B0E6879B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622117026, "uuid": "1471939d-5dcc-4bd7-99be-71a144519dc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622117026, "uuid": "1536d4a0-c440-424e-8c71-d3c346cd26a4", "value": "1536:JMipa8MhPsosusIuasXsUwsdLZsE6L5FChsOEFpM9DstZMssxshsnLUTmz8/gZ6W:FZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622117026, "uuid": "be8c96a0-2ac2-430d-8236-a9b22bdd98f2", "value": 1842912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622117026, "uuid": "8b85b2d8-354d-42dc-a112-0f2ceb5a6765", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622117026, "uuid": "f70e4138-05b8-4aa7-8780-3071dbc1c8d1", "value": "qoute_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29521cf-bf32-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622151056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622151056, "uuid": "bab94b57-83da-4c6f-8558-35c0f7e9c904", "comment": "Malware payload (RaccoonStealer)", "value": "15cc8191e7728032cdabe71fac938139", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622151056, "uuid": "861af008-88b8-46d8-ba39-f16b82e73a63", "comment": "Malware payload (RaccoonStealer)", "value": "46e99e70a21a9ecd28e61195f175bea9260eea38b1718f6750166688d955e91e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622151056, "uuid": "423f1d28-932d-4a35-89ac-9ed91b7ed802", "comment": "Malware payload (RaccoonStealer)", "value": "1b23c3637e4ddb26115bd9152525d15b4af73a36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622151056, "uuid": "f2ce8b28-c5de-4e33-83eb-92554360b327", "comment": "Malware payload (RaccoonStealer)", "value": "0d322c36f6e3b3ea63390cecd90d2cc4eea26519e7db83d1ab77e69e1886582ba5c213f39b16e66c0bbd1f724003b05a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622151056, "uuid": "8bc1181a-c277-453e-a59c-653f03b59ec5", "value": "8016339277C105B6D5A0D0B4B99C9B7386BD43E807305CE3A764C94DAA3EC92B32774E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622151056, "uuid": "ab3456bd-6dc8-40ca-a68e-ac857e86b77c", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622151056, "uuid": "b51a6ee2-c3a8-4b00-8261-efb430bbfbc7", "value": "98304:xKCvLUBsgbg6l+Pmmfj9w9jEDMUxkZ1S+KnzFkZRmWxTHnl2A:xLLUCgbNlrgmxgMIkZ10smWBFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622151056, "uuid": "0304b001-9a58-4614-9140-5b0b9fc7f9a7", "value": 4113410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622151056, "uuid": "0f79161f-11d5-4da1-97d9-e16a93dd3124", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622151056, "uuid": "d50d952b-b4e8-48eb-9f85-7ef21f9375a5", "value": "15CC8191E7728032CDABE71FAC938139.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862278a1-beb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622095952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095952, "uuid": "a71c6b9d-2334-425c-a895-54759dca2d0b", "comment": "Malware payload (Formbook)", "value": "a811554bd29b6477a5ac89500242453b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095952, "uuid": "c01378f5-2b12-4a34-87cd-c17a23572da6", "comment": "Malware payload (Formbook)", "value": "473b56394b74234a01d3d49d249efb5da557cf356fffc1dc3cac654303964ea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095952, "uuid": "ed25d7c5-9b4d-4439-9b0d-2e0d38f9b6e3", "comment": "Malware payload (Formbook)", "value": "d14a70992e4f975c72d12c1c9d5f72d27d9fec15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095952, "uuid": "65be7dc3-be14-4ba4-ad4b-10cf2d8b1841", "comment": "Malware payload (Formbook)", "value": "4aefeeae39eb43b31e1d59cb6355ca4f4bdf8cbb324f7fa2a48110d9742c072dd2d5b3e24e876fa2d57675893a3f3355", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095952, "uuid": "e339dbd2-f1df-4c3c-abb1-6d57fca56e0b", "value": "79A2F921B7979231C9391A3708B552849776E38B952BCF2F748C110EEF6335757A3760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095952, "uuid": "c40e1260-bd72-4e15-8e7e-f23eeb9f32a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095952, "uuid": "d1bb1bd2-27e1-4544-9480-e984715a2eab", "value": "384:YEt/YIZ7lnJasu6XWc/tDzPI3ff9vwEG9/XwJwq6uJfq2GSLwq3ePdptYcFAbVcl:rF3ZxnJtJJ2GzPvtYcFAbVc6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622095952, "uuid": "f67be948-c42d-4aab-9b1d-395a6461cc36", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622095952, "uuid": "b8c3b3f9-917b-49f1-a967-333850c57f87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095952, "uuid": "e5068675-8108-4628-b9f0-b93b416f3606", "value": "sample products 1,2,&,4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6081823-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141533, "uuid": "d68e5e22-edff-41f9-abe3-15933c904878", "comment": "Malware payload (Stop)", "value": "2c15003d53135e89439d2e91cda4ca28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141533, "uuid": "0306dfc6-3d84-4432-884b-daef936a99e2", "comment": "Malware payload (Stop)", "value": "47a178b5f68bce5a1e84060bb1de9090b1c8161982f559820c57da5a5ccf04b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141533, "uuid": "603b6968-6cc7-4aa6-a36a-e9ce02012396", "comment": "Malware payload (Stop)", "value": "5d34146e89d44622d004ccc97442dcbac42c2915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141533, "uuid": "9e1fe683-cf1b-40cd-a0fc-b2e2880a6fec", "comment": "Malware payload (Stop)", "value": "d2e232d1be28ffbc41d63f9afd600aceaa56c7a6b31d6ddff45f0a762abd6b14e3004e70083cb75531ccb26718cfcbf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141533, "uuid": "a9fafb27-bdd6-4097-b94b-b1e0bce37e75", "value": "7605F130B291C2F4F4F312B475B58278A83A7EB96B3490CF52D426EA567C6E59C30B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141533, "uuid": "10b4f774-f3aa-4f89-9833-2117ba6fa98d", "value": "0693a6a9ad49d4475fdba0f7412d435d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141533, "uuid": "6392a916-4b73-428c-b2b3-d1e1de5a5877", "value": "12288:FvCE1LZgcrhUy4ZOmBCaC2fz31+uUZ29FFWlD6asBirlupRxBpkzZBmceTquhbou:FvRLZ8RBn931rUIZKDABiC/rlOuhou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141533, "uuid": "d97efc3f-2572-4659-a069-d2e77883767a", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141533, "uuid": "f02f6a69-d5ac-4209-bb71-c4337e599a21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141533, "uuid": "3d034dc3-183b-4173-adb8-16ba8f47a0c1", "value": "2c15003d53135e89439d2e91cda4ca28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157a4f7a-beac-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622093186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093186, "uuid": "b401719a-c4af-4fca-8325-a0bec413c86b", "comment": "Malware payload (Formbook)", "value": "5bd1604602a9aeeee4332ad2d7bd1bb2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093186, "uuid": "de59eccb-5a6e-4665-958c-f702d6c1a3e9", "comment": "Malware payload (Formbook)", "value": "48455ff00d5441fb5eab0db6b46964ec4f14611f15f8d00a7b8b24f960f9ef1e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093186, "uuid": "1221fc2e-d364-4ce9-b436-5736257931c5", "comment": "Malware payload (Formbook)", "value": "64cef1cdc0bb6ff3d244c57dcbd9ccc056eb1f3a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093186, "uuid": "f209274c-8d0d-4cf5-877e-871306b09f84", "comment": "Malware payload (Formbook)", "value": "707f055c49eaf9c952c21e8edaef29b0bda66e4650dc9e272c76afb06bcb88490007ffcb64ad79b7bd502e0316fbc4f8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093186, "uuid": "4068004c-057f-4fc8-a48c-b5f43b1999a6", "value": "5C242399D77D846399178623A0317B2447739CBE3613EFF8893DCA8AA17B79580CC381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093186, "uuid": "0578809c-69a7-49f2-87a7-4b1c90a56b4b", "value": "6144:IwE1iPsZhXjNrYAsEJljWkEEA+Cp0Q8juA1LKH4kDQc:O1tX5kAsNkEEMCQ871a4kDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093186, "uuid": "3dd508b4-67a0-454d-ac20-5bebf1d63bba", "value": 222180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093186, "uuid": "00f500cc-3548-4cc6-ad88-e5968e9232b7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093186, "uuid": "1c795bf0-2cf8-4261-a8e0-5a8f078fa499", "value": "Scan-copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bc222d-bf0f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622135727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622135727, "uuid": "4ce216b0-7d7d-4d66-9616-6a540adcfaf8", "comment": "Malware payload (AgentTesla)", "value": "eef154135022e368cdcd8713c56ff39c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622135727, "uuid": "ba9ef84a-75db-4cb8-8b6c-f3931ba761df", "comment": "Malware payload (AgentTesla)", "value": "493a50f6b2ac42df9552c7b9ce8b56e776e05fc0ed6d80c5b3a5d60909626e81", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622135727, "uuid": "b94f03c0-f52d-418b-bc0c-d253aae656f7", "comment": "Malware payload (AgentTesla)", "value": "bde75a942cb58e98f3a2b0cb2cb32fe090202740", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622135727, "uuid": "a4f2848d-6a04-4c0a-9b6a-edd169eb6957", "comment": "Malware payload (AgentTesla)", "value": "1eb4e40944dad6d7674022217018754771622d1bc0f1353665022e2df0d79e867126710b5f09443bbb04a977812d2d5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622135727, "uuid": "0e14395a-303f-4d21-9258-295c1be56cd8", "value": "3494F15036B48755C56A2BB9A83DB91C63B0F603B620D65D1EC363EE5FA23C0C60AF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622135727, "uuid": "21b9de82-3df1-4f9b-b317-29756aa1b44e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622135727, "uuid": "04b02222-b219-4a78-8dbb-5f03816f0b08", "value": "12288:SyhVWADM1GvqnuA8DfSgUW0UWrKxBThulADmd:bnWaKGvqntAxUNUGKjThYASd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622135727, "uuid": "a1d4c4b1-0858-432a-9ddc-4c3f983b5aa3", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622135727, "uuid": "cea0b172-4530-4627-82bf-2d574ff5d3e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622135727, "uuid": "a9a6768d-adf4-45d8-b4b3-934e1383481b", "value": "New order 20001789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83927a31-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141475, "uuid": "7260a71f-21f2-43a7-8900-78d0289927e3", "comment": "Malware payload (RaccoonStealer)", "value": "5e795548dc02fe1c17dd875862bb2bc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141475, "uuid": "899143ad-03ba-4ee1-aad3-13db5685f8cf", "comment": "Malware payload (RaccoonStealer)", "value": "497cd9ca8e4658e3c7540e453b49b45b20ddd45e79fa367db3fa28d367e5d959", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141475, "uuid": "a19b7661-0d3b-44c8-a33b-805566c1fffb", "comment": "Malware payload (RaccoonStealer)", "value": "72f91b2a04f22e69f3552e30207320b408cd76a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141475, "uuid": "d7ee451a-4c84-4aaf-be03-b7db8bf2a396", "comment": "Malware payload (RaccoonStealer)", "value": "5c7f10e66642f433f4b533c43c1f770fda3219a788d62289a09d01b00dc9e578014babe366612ae8f7916636b6cf0d92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141475, "uuid": "9cb39dc5-f221-4070-948d-f2755d4a36fc", "value": "ACC47C4CA63E1AA8CA2D1FB34867744885B78D1760E2F74F5E851CF4BF027C6894A1E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141475, "uuid": "0efcf1fa-ceb2-4656-8c34-5ec65d6935eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141475, "uuid": "d3679f86-ccc2-49fa-a932-72a4df8b91f6", "value": "12288:y9T/IYv/cATGKuPtBFrCNqOUjvpyoSh2/e8hqjP+1EWWw7ylGXm+D:y9T/rFszINuly5c/e8QjP++G7+Od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141475, "uuid": "38f9ac1f-040d-4ee1-8358-39551a6c7385", "value": 590776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141475, "uuid": "73b556ef-44be-4f98-b051-da652d2c066d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141475, "uuid": "165fa894-922c-4db7-a7e3-6aaa97a71afa", "value": "5e795548dc02fe1c17dd875862bb2bc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5356c33-bed4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622110634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622110634, "uuid": "d7ad4dce-fcf5-4b2d-aa3e-f8d52306f2d1", "comment": "Malware payload (Formbook)", "value": "a2c690dc3d1da6a98282fd80b9385d19", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622110634, "uuid": "1230e2dd-580d-4a9c-86c1-e289558de893", "comment": "Malware payload (Formbook)", "value": "4ab9d09d0ffc49408cb40fe30791e2dbe7d6ea5cec1d44d509c0032b7b0322c5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622110634, "uuid": "e04818c1-ddf7-45a0-9fba-b35a9720ab6e", "comment": "Malware payload (Formbook)", "value": "1fe68b6982326a109f71c4c8fa48f101ed190370", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622110634, "uuid": "8b50dfe4-d9df-44a5-ba03-b677a719390d", "comment": "Malware payload (Formbook)", "value": "5f3187b5c85a3ae58cf7a3a5ced3943e8431065c1c9c47dc683dc104e2623a9198197853e22e2ad395a2b6003023a3d1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622110634, "uuid": "f7897e92-c8de-4138-b098-3bdacdc0c4d0", "value": "CDA4021E3BD5C66BC24512719AFAD33DA7B8BD002E621B037B707BCF7D306A59A00586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622110634, "uuid": "71b90abc-9dab-47a3-8fbb-6359503d8c84", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622110634, "uuid": "c38892f3-50c0-4bf7-a0f0-753a5eb1313b", "value": "6144:XQqJj1bFkJdR7oh0UnsHpadMHg5iqFQUCCP4KkxiQ3wutDWyUMxnc2TSXHx:/p2zRER2padZv9Bkz3w1qxIXHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622110634, "uuid": "0e1ccaec-62a5-4dca-984d-1f4ffece7d79", "value": 458898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622110634, "uuid": "10c7f61f-53d2-47e7-b47a-2d411cc99f96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622110634, "uuid": "13ab48a2-3d1a-4d79-bec8-5ec9865a7657", "value": "PO_0065-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be36cc31-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1622141573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141573, "uuid": "f238396c-b0b4-4345-ac86-5631dfbc2b72", "comment": "Malware payload (CryptBot)", "value": "3d0e5373aca6a5886729b695dbbd85d8", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141573, "uuid": "f050a83e-f03c-42b5-8a05-5b3fd53b1775", "comment": "Malware payload (CryptBot)", "value": "4b21de4f5c03de8e7e85bbdc317bd1050ba7bce099c1ba1cafb949ccadff90a2", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141573, "uuid": "f44891f3-f5f0-4add-9d5e-d8d88d5a2fab", "comment": "Malware payload (CryptBot)", "value": "5d60a1fc7918a1b692d339dfaa9580c80a885ba4", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141573, "uuid": "e2dd3c4f-541c-4948-8e5f-9b4e2efd9e31", "comment": "Malware payload (CryptBot)", "value": "95ba32cddc1463108a8b702fa8c185c05cf5856ae48036fcf31e0bcdf0f1dbe0e38fb49f2b16e75925dadb2272e51ab6", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141573, "uuid": "099576cb-baaa-4222-8476-9c8a4021d14b", "value": "2DF4E030A7A1C034F0B716B849B68279A53A7DA1A73780CFB2D53BEA56345E5DC30B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141573, "uuid": "a85e8338-6b80-44ea-8c74-0a2b5c808b1a", "value": "cb971fcf399235e4e9a69622d3809fcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141573, "uuid": "2c9512a3-6e01-4fe3-9def-f1c10d54919a", "value": "12288:mdB/iaaV8z7UyCQm2FeIALaLmZ84eEmsV0VVvQGs5TfgbQHkuNvb980wCDTZHFqa:mdBNaVPCeIAGLmZ8pM0VVYGs50bQPNRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141573, "uuid": "de75e2f1-9cd6-46d0-b9c9-7468e7ee35e4", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141573, "uuid": "51e6ac10-acc6-4160-bdcb-6f96dca4be7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141573, "uuid": "c5310f0f-0c45-4c3f-bbc7-2b12ca527fea", "value": "3d0e5373aca6a5886729b695dbbd85d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdeac505-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1622141599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141599, "uuid": "52741aef-901b-4453-9a22-64cfd1f4b104", "comment": "Malware payload (NetWire)", "value": "b22d935b3a03752f85d65b6e5d57d80f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141599, "uuid": "3ff6a3c4-3e7f-45ec-a85f-7fbc7a87487d", "comment": "Malware payload (NetWire)", "value": "4bb5887d12b822628da418c65c8999b402dd262a58f4ee133a51f00a0c9e7881", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141599, "uuid": "f5d68fee-0fd3-4f55-b84e-dac25bd5f00a", "comment": "Malware payload (NetWire)", "value": "8bbff31f56028c52f80a71e32db592f649719dde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141599, "uuid": "63f4306a-2109-4e4d-8425-43a9e46e21b8", "comment": "Malware payload (NetWire)", "value": "d32f91bda19081f7ac2253337a649dde1a367fd87e16a60582e03335417f3cf4e9a1494b44f00cf197ff1ac24bd18200", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141599, "uuid": "75338ad0-26e6-430d-844b-08dbbe506eba", "value": "81E49E22F2D105F6D05A5E385C1B96549978BEB03D246CAA37F43D48AEBE3803D2D9D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141599, "uuid": "8ad91f3b-3e18-4ef4-a9d1-d120626d6f44", "value": "3e7272567bf6719a2a90dbca5f3a4b3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141599, "uuid": "48f46abd-6fb2-4c84-bf12-7227124c881b", "value": "12288:wuxGeRhWzrlZe7q6OWA50P3TaD8vVKlWFn+yGMBNyE:wyHWzrsOWxjQfEbyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141599, "uuid": "e9357a6e-26ca-44de-84a3-e1d951c3be58", "value": 721368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141599, "uuid": "f76318ae-b0b1-4465-ba98-d7e462512727", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141599, "uuid": "de7dfb9b-9718-46ea-8d5e-fd5220f34385", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2e0049-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141487, "uuid": "7832652c-d144-4b02-bcca-90daefe61ea1", "comment": "Malware payload (RaccoonStealer)", "value": "153159eac53e654ae1bdb6bc31c9a0f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141487, "uuid": "2cfd0d25-42be-4600-ba99-ac2c1e1bb323", "comment": "Malware payload (RaccoonStealer)", "value": "4d05969ac846a1469caa6f9f83853bae9090b6aaeafe030075873fc7f1519a1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141487, "uuid": "925993ec-3388-4f82-80ef-3a230e110361", "comment": "Malware payload (RaccoonStealer)", "value": "ec73d9af5c37647ed0873883cdf5c63e447afa84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141487, "uuid": "494344d9-8f5b-4380-bad0-32e8f6aef264", "comment": "Malware payload (RaccoonStealer)", "value": "a60660bbb2cd6a181fb74063eca35e11b1b6b6b8162b9887d191fc7a5a4e8b1e3a08c250f366cd2f65db319b1656819f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141487, "uuid": "c2a7af9d-2215-4b6a-ab9d-c7eb210e9b65", "value": "0AC4DF20A6E1D034E0F756F445B68274693A7DB2AB3480CF62D637EE76346E4AC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141487, "uuid": "024ce71a-a5a3-4faa-8cce-b672a7186056", "value": "556bc424bd608c9e064a122699e67eca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141487, "uuid": "9d7cb91b-b170-4351-8a54-e991c0d96d34", "value": "12288:8S4TQ1YUJxrM+vdiD8M6og3k6MVrf+OrwmIBVE5y1VT2G24M:ATExxADOj3IVrVIBVEsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141487, "uuid": "89ced4e9-b9b6-408b-bf81-4997029ab645", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141487, "uuid": "98ed1244-8d0a-4a26-a026-f6979887708b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141487, "uuid": "df3b0623-3496-421d-8180-36575725b4d0", "value": "153159eac53e654ae1bdb6bc31c9a0f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749afc1c-bf1f-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1622142738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142738, "uuid": "f024005e-bd34-40f5-aafb-0ad29d8c1db8", "comment": "Malware payload (DanaBot)", "value": "ad165f0bf3103c7e7dc72c6550111e88", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142738, "uuid": "e28f7619-ffc1-460d-b1c4-cb8e07af1065", "comment": "Malware payload (DanaBot)", "value": "4d34fa5e98a0ad7ddf5604a31286b984c8e368a67b05f979dfd6c824481bbe5f", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142738, "uuid": "fce9e0ed-a9f1-4cb2-b1f2-b7e24e247b18", "comment": "Malware payload (DanaBot)", "value": "a74a0f3bfa4965073266da34c8795fdd4f743e84", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142738, "uuid": "468ffae8-6c72-4bdb-ae23-fad574e40627", "comment": "Malware payload (DanaBot)", "value": "d0deebb4c95e51b5627afe76c75c30fe25d3d9da99582a51436aa32fc44cd792ea5ce774129f127037c4e59a0158a357", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142738, "uuid": "8ae04aaa-43e0-4373-be82-c6a18da99443", "value": "55563305EA708039F4BEA5F445379734953E7AA1C73810EF53D869ED02B4AF0EA72726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142738, "uuid": "48278e22-8546-444d-8265-25bff545d81f", "value": "f648f82da86c29e8b6c0971365e00e98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142738, "uuid": "4db800cf-c6ee-4497-a560-c741fac37677", "value": "98304:Ckq2OEjlytv0/v3zUcQYyTxRrzDnxjTYIxJHa6j1KXTq3Yxr3egiO0QpuhHUBTl5:CLLEprvYaWxNzzNT7HTl3yr3DM4T+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622142738, "uuid": "9fafc2c0-afdd-4e51-b726-6a07dbccdcd9", "value": 6297600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622142738, "uuid": "1076a8ba-0d80-4ea1-ac20-10a73b64a942", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142738, "uuid": "b0881c73-5545-42a3-a9d8-a4ef2e8eecf3", "value": "ad165f0bf3103c7e7dc72c6550111e88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6ec66a-bf1e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622142540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142540, "uuid": "408045bf-de86-4f68-bbe1-a3acd60408d8", "comment": "Malware payload (Formbook)", "value": "784ccc0d4f51c007c20f6ffce2847ac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142540, "uuid": "19b3b9f6-abdb-4744-9357-6e711d3b0cf2", "comment": "Malware payload (Formbook)", "value": "4d90c368dbb4c085f00a9d323996a1c6235acd5afadcbcf935d0b56a432a3410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142540, "uuid": "dd347fac-0690-427b-9ec1-eb2370883561", "comment": "Malware payload (Formbook)", "value": "f7e9ccf81375616ee16e79d782e782e68bbe2bf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142540, "uuid": "a051fd80-d62e-4439-ab59-cae014e584d7", "comment": "Malware payload (Formbook)", "value": "e510749524429f441855904d28e36e607d9512e0bc614d480a15d1347065a06e5ce4d74d9afa58d814b0ba8ec4271f69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142540, "uuid": "915beda4-fba4-4ad6-8a1e-637a3a594596", "value": "24441218FAC08CF7E827143069FB823BE6F79A161159E813A7B44FBD59250B3DD13689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142540, "uuid": "9a780438-18b8-4c42-b19f-499b53be71c5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142540, "uuid": "1012ba6d-b5ac-4d4a-b058-549269447fa8", "value": "6144:DQq1UoUf+ZAMdwgpC6fIjLd9hX23ukxWBZCy3m1nM:DUd++MdwGC9vDhXIukxW0y3YnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622142540, "uuid": "91499083-f990-4e4b-adea-bf1bae36082a", "value": 258272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622142540, "uuid": "1075e204-9f2c-428f-961e-b99c7ee903c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142540, "uuid": "1b7e6404-30b2-429d-b7db-f6adfde5577e", "value": "Payment Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21bcec6-befa-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622127004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127004, "uuid": "0d09d13b-35a3-4bc7-aee9-b7fed602c5ba", "comment": "Malware payload (Quakbot)", "value": "1ff818459a5c124575b79f10926957c0", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127004, "uuid": "38f8b790-e099-4586-a289-bd8e62cd8e20", "comment": "Malware payload (Quakbot)", "value": "4e05579ea18b3e0279e96a2638def039d6015f5a54574eaa04dbefef4bd26b94", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127004, "uuid": "c3d51448-7337-468e-a539-898a6af3ba13", "comment": "Malware payload (Quakbot)", "value": "b5c5226e7fcbc173d5f0eb6c77a7e586fcb173dd", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127004, "uuid": "5a0fad3c-9f7d-4312-9af8-3c1fc8d1ac67", "comment": "Malware payload (Quakbot)", "value": "e2af1cfead8661a19b4e7c1d777bb8daeb523ba0e227e3c65aae84ad940dfaa687d13acc36b0ee9baa4a46f367f37c25", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127004, "uuid": "be0ff7ca-b411-454f-ba26-802c9bf07942", "value": "CA7412BFE2C129F4C3358A3FD6809191C265F0E440A7B32D47DD3529A35329FA9992DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127004, "uuid": "a67d4bdb-e444-4f0b-9203-8e7284e19731", "value": "6144:cVfdRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZN6:ElRMmEv2Bc/nvm8IKABfsYOmauFdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622127004, "uuid": "d0043485-86f1-4309-8250-3ec9945c3947", "value": 337801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622127004, "uuid": "8c1bbf1c-dac8-4826-b54d-6bfe32c3b9e7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127004, "uuid": "a670edea-d82e-4cdb-9335-f04d2a2011c2", "value": "212703974905262021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e99540-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622141581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141581, "uuid": "d398ccae-e3b3-4c3f-a673-1bdef014263f", "comment": "Malware payload (Loki)", "value": "bdc5b9b1cd95fb24e2cbfa9047dd03df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141581, "uuid": "8d76e29a-f9f3-42b7-ab03-01316832cc70", "comment": "Malware payload (Loki)", "value": "4eec9ac382b6fcbf861641137d9a597a04a891a47983252137a7b0fdbbeb842b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141581, "uuid": "49ddcdbd-58cf-4763-9c57-3640324804d9", "comment": "Malware payload (Loki)", "value": "7d15d73f1e705b86c7d4556bd07117716e8dfcdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141581, "uuid": "ab4893a5-08ed-414a-b5f4-4dd237d40f89", "comment": "Malware payload (Loki)", "value": "765c098b36c21a147f961b306b8a4e2e563017dc6498c43ea48277cd0c01b8ad6c4d699b28a35b1586d959c67face785", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141581, "uuid": "9f054c69-3a2e-41a5-a33a-84f8e95a7ea5", "value": "13F48C31A2E104B6C16A1F386C1B56548CA4BE703E24586637F96D4CAFBF3813D2E5E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141581, "uuid": "8ab33871-9f55-4206-88bd-4e19db70aedf", "value": "3e7272567bf6719a2a90dbca5f3a4b3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141581, "uuid": "cc3fb722-79f3-46a5-89ac-42bed06532f0", "value": "12288:huxGeRhWzrlZe7q6OWA50P3TaD8vVKlWFn+yGMRNy:hyHWzrsOWxjQfELy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141581, "uuid": "a5eb0e87-b3a9-450e-a85e-05343b743e8f", "value": 738928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141581, "uuid": "80bbab67-818f-4f49-b0e9-357285287935", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141581, "uuid": "aff1f1cb-a637-4c8a-a286-c2a134018037", "value": "c1d25edc-2df8-449b-abe2-5185c1b9b0eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68985313-beb3-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622096332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096332, "uuid": "3961b5e0-ef2f-401b-a1d6-c1cca09f50be", "comment": "Malware payload (RedLineStealer)", "value": "e79511486f15a4f50b215af8440f25f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096332, "uuid": "f3f7eb7f-aa69-4146-9558-115c325ea983", "comment": "Malware payload (RedLineStealer)", "value": "4f297cb7c7f3ee019f7f2e99592fa5c9a5238b4bd9ebcf67545873216fd80eea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096332, "uuid": "84138ada-3b8a-49b6-a545-01a95876d26f", "comment": "Malware payload (RedLineStealer)", "value": "f6e81ceeba0cd00c53532e0b678e76587066ed2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096332, "uuid": "00f48df6-63ab-4238-80f3-00e6a7c3972b", "comment": "Malware payload (RedLineStealer)", "value": "53671653f6b5da732aaff1a8e95f5a5e75f1cd66edde0fbeafca95a2b7971a4212510bdc64829d3e2cd2336d9e978fc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096332, "uuid": "02e6183e-c162-4c52-9f67-107580e6292a", "value": "E0454A513454C9D9D726673ADE9A10F023BC8E41D141D22B78AC3F983BF2B16253BFA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096332, "uuid": "028ab46c-41cd-4ac7-be8c-c87e77432aee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096332, "uuid": "f1f06569-f8ec-48d4-8e2e-9b5b433d6557", "value": "24576:cdsPwHXaYltY3bjCKKmiqkcW0sVyoVqQnx:qbXlt0CKKmiqkcW08VL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622096332, "uuid": "f8a73942-125e-4c0f-b8e2-bc8e32753549", "value": 1166200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622096332, "uuid": "15e8e555-c234-41fb-a502-6a576f21aa45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096332, "uuid": "467a77aa-5e7e-4e28-a844-02949d765855", "value": "e79511486f15a4f50b215af8440f25f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3ba805-becb-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622106677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106677, "uuid": "c9e19bd2-f456-449f-bf93-6db15f3438c3", "comment": "Malware payload (Formbook)", "value": "71e9940228c0c26a2f46a5bfcc92bea8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106677, "uuid": "6e724a5c-b83d-42be-b56d-f98e3f7bbd3e", "comment": "Malware payload (Formbook)", "value": "50fb163dd8e037bd8380f0704f7163161e2a1b292d5726c18ebe1b47a5c3c7c0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106677, "uuid": "d22ae866-ff17-48c3-8b9f-1dea528ebbe9", "comment": "Malware payload (Formbook)", "value": "7e80d7c325ef6b1920ee3359f6deece572f0175b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106677, "uuid": "5b0c4d75-1876-45a4-8cc8-36e9308371fa", "comment": "Malware payload (Formbook)", "value": "ead699d4fd9df1d5b4dea0b0b0876dfcc56d5967ef1ea23ac6f533416807b29aee37368be229db72465e144c9bb9eb34", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106677, "uuid": "173bda9f-33d7-4274-99a4-3b054e5a4270", "value": "3BC4AC2231695C93C43906F40026AA81F3F16E66785EE7C81ED3A3EE1ED8BC15B47677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106677, "uuid": "71a6a1c2-34fe-473a-a42b-bd3bb12039f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106677, "uuid": "d3a3d392-0950-4f54-9bfc-15c5c1abed92", "value": "6144:aFRGgBT1SIE8lVQUJwJBt+6S1Z4vHfwkqMTqWSULfD0X0FwRjPBciuFlcjt3s2Hs:gRGgBT1SiVxKSjWqomjJcFicQQL1CpE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622106677, "uuid": "7fc89412-c70b-44b3-9c9a-325e7607a710", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622106677, "uuid": "07ab640c-5ac3-48fe-a6e4-a041cf5ab674", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106677, "uuid": "44b3a00a-86c9-4a4b-b283-fa164f297c4f", "value": "\u041a\u043e\u043f\u0438\u0458\u0430 \u0440\u0430\u0447\u0443\u043d\u0430 \u043e\u0434\u043e\u0431\u0440\u0435\u043d\u0430 5.25.21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c17f82-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622141587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141587, "uuid": "0fb3fa4f-db4a-4fe1-adb3-b21d71164ce3", "comment": "Malware payload (RedLineStealer)", "value": "bda8cdf19e0500789a291ccaa999eb11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141587, "uuid": "0104b1a8-c202-4cb1-ae77-9a5e46c221e4", "comment": "Malware payload (RedLineStealer)", "value": "528f7331c41f0572de4c7df5e091f79212f84e5389cb7f34790e90cca43ffcd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141587, "uuid": "f02ea7d0-2e48-462a-b4e0-6bf8bdc14ec0", "comment": "Malware payload (RedLineStealer)", "value": "dbbeba291e19196186c6157f0730789ba0360fe5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141587, "uuid": "09f5d826-4bcc-437b-9584-1ece1ad0f9a3", "comment": "Malware payload (RedLineStealer)", "value": "fe1d1180fd9ab04a93ef416554f9281037a2553e13b9af91e6825d275ba8abee5be80345bb3b6bc6576092fb572b435a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141587, "uuid": "9b8b587f-7305-42a9-8258-46279079ad77", "value": "F4E49CD97EC98DC1D5A6F2F0A04A83A107351D1AE98943C50AF9B8BA4D712F7DD1A03F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141587, "uuid": "00ea6635-0785-4938-b689-d6dfeb833cd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141587, "uuid": "3ff77a9b-b988-4862-b744-fa4b09f12bee", "value": "12288:i4Q/TbS6t5rtPkzxWA/4yncclOENVVCcrWdOGJpQ0Lfz:67bS6brtczxN/4yJlhVVu4UpNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141587, "uuid": "f3e2a640-a4d3-4bf8-b064-28b0c68fe3bb", "value": 661768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141587, "uuid": "01034bc4-aa15-41fd-b0ef-62af51ca101b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141587, "uuid": "45fd27ce-67d8-4075-aaa4-6db66a3acb07", "value": "bda8cdf19e0500789a291ccaa999eb11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5e30d6-bf03-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622130834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622130834, "uuid": "fb37532a-0e54-4e5a-8ba8-bca56bb27025", "comment": "Malware payload (AgentTesla)", "value": "d89653cd715534fe056f3e76b59a07f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622130834, "uuid": "d61fa4fc-d2df-495c-8091-cdb83658ffc1", "comment": "Malware payload (AgentTesla)", "value": "52ba1ee0127f7e08782c90c60546db6ecc075f09ceb0fce4f250d8b96494bf20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622130834, "uuid": "84eac8bd-4379-4234-b762-d8ce86a130fc", "comment": "Malware payload (AgentTesla)", "value": "c3f5e9dab2cbef0d6441002d8105d9e37f85656f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622130834, "uuid": "c16ba310-b34f-4aca-9a0f-16f5f5c16d6a", "comment": "Malware payload (AgentTesla)", "value": "e13be29b82b93c24e826babaacc0b97d594369de3561fb778bd14a0a3211b5345f07d65d21d0859f1a26dd1e6881bea0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622130834, "uuid": "e54059d6-1cfb-487e-b2ec-4aa361c8ebc4", "value": "17057D2E66E45626D339C3F8CDD0950393A1A1276152ABECA9C1C3B40BE16C63DD73BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622130834, "uuid": "37da37ba-16c9-485e-9cc4-8f5b87f25ef5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622130834, "uuid": "90f6a2b3-6c08-41d5-a2dd-2db21f2f7f9d", "value": "12288:MgLd520xLirYh3QU44LfMhoDFFRcBECx6nUN:r520BHW4LfM+7SEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622130834, "uuid": "cd5dfaac-c146-4b01-9118-bcb5a0716009", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622130834, "uuid": "79dd0a98-0f1f-49cc-b7b9-5da20fff10a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622130834, "uuid": "ef2ce850-bb8a-49a8-9579-50c9c1499914", "value": "TT Copy 27052021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7df9af-bf1f-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1622142832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142832, "uuid": "decd74df-c495-44fa-b681-9fd35144209f", "comment": "Malware payload (RemcosRAT)", "value": "f1edff3e861165902fb3cf3785b20773", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142832, "uuid": "d897f629-9675-45fd-87a8-c6000ec868d3", "comment": "Malware payload (RemcosRAT)", "value": "52f5c04e0016562d2c876881addeb28f44f14f861e044ee97614aaec5f7cb14f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142832, "uuid": "d9247877-707b-4c64-bf2e-d3554fe136c8", "comment": "Malware payload (RemcosRAT)", "value": "2d3338c4d9c161625d9c07cfe922219642c11ae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142832, "uuid": "eebf59b5-68a4-4d76-862b-5a253de7daf2", "comment": "Malware payload (RemcosRAT)", "value": "385ae5298f3bd96454e6c9d0047c2da7cde8c2c592b67b2c8f42de4163cf14e9b2f93c843c24d66109b0a354f7dc16cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142832, "uuid": "b0669e52-e84d-4b44-b282-47ddddcc7bf6", "value": "3415AE3E16542A1AD17CC3FEC9C09413D765E917B063EDE898D213A847D2BD674822BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142832, "uuid": "c8bcaa17-bc1b-48a0-b59b-8dc27dec755d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142832, "uuid": "12d08c8b-ee2d-4f47-a7a7-f7a4f73e8db4", "value": "12288:t7QlQMhuAedIoMEHDCWgaX/huoyg9wYYnPYZGNL16PCUlYpJ0M1MJzK8Q4mMvgWq:tvqsL+Wga17BZoymgtAMvgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622142832, "uuid": "4743b15c-4498-46d9-a677-621946c0d7d9", "value": 934912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622142832, "uuid": "fa58f0b6-44a1-4c59-96c7-d1f44528e013", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142832, "uuid": "373bb5b0-3928-4107-8bde-9a814bd52519", "value": "f1edff3e861165902fb3cf3785b20773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73e209f-be93-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622082720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622082720, "uuid": "f128b192-b1d6-48f8-b559-21e7148f8ac7", "comment": "Malware payload", "value": "117f1b6c921da971d17daeafedc0de9a", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622082720, "uuid": "4073cb86-cdba-4bca-9824-caef38735c16", "comment": "Malware payload", "value": "5343a3bdf8f441962b6efe0aeb15aab6194e5de346fd17622afbbf6ff1237d45", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622082720, "uuid": "bec63cc6-eecf-4f65-b1d5-09b40c70f3a8", "comment": "Malware payload", "value": "0a5f858b7438c9c7dfe5c238c5ef330438049fa0", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622082720, "uuid": "ffe055d5-4dd0-49b8-8735-dad2597debe7", "comment": "Malware payload", "value": "ce41a7e16ecdbd6f92e9d289044e4c428f55936940e149fae06f7b942f382489af18f0d45f2db6a11c618340683ce8ef", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622082720, "uuid": "91852686-7e52-4625-b2c1-c01c4c7e939c", "value": "E6119E30834461910D2013E6F615B896F101002B8DF17E6473CE9ADBDEA968D6BB4EA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622082720, "uuid": "c9ad270e-1331-4218-a963-9f4271c951c5", "value": "12:zH/yDLTuP2rEBf79F7cOFsZna/4dgo/V8a6mZE8OO0JQxutzxeomdWXbR8sys1y3:mDPu+re79x2ZamgomaiRJ48mdWXFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622082720, "uuid": "5abb078f-72b6-4025-bc90-f084e94d93f2", "value": 950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622082720, "uuid": "90fd453d-6324-4c37-b5b6-53178b609f36", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622082720, "uuid": "29172798-ee74-41b0-8401-ca2f6305ab42", "value": "q2y3S56x.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887d3228-beb2-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1622095956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095956, "uuid": "67b38f4e-e11b-4857-bb88-0e4941c78b53", "comment": "Malware payload (RemcosRAT)", "value": "9ab7e4503f534ec07d77e00f380bdb97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095956, "uuid": "993f29df-91dc-4ab2-beaa-fb904bc8f4b3", "comment": "Malware payload (RemcosRAT)", "value": "537268ad03c2239537872a77687f834d16c5b9d94633c709516d18eae979c99b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095956, "uuid": "a1490a74-95f0-4640-8a66-b6cc9128f362", "comment": "Malware payload (RemcosRAT)", "value": "931ffe9a5bc4defe4775d132a2463c5fd565bf83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095956, "uuid": "d5118402-a534-4fb7-8d82-443e36234b8b", "comment": "Malware payload (RemcosRAT)", "value": "cda2f24a7e0e3144a3739a93f37108ee26717cdb68d385b05547e722b190691b6274f43ee6d78a3b03510fbd7dacf963", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095956, "uuid": "7673272e-0616-42f1-98fe-a0df93dd3e7f", "value": "1486E0227349553ED85B0737847BA6389D3EBF606613896B63F43C4C9F35A81392A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095956, "uuid": "7956347a-0b00-4cdb-a54b-4343027e6866", "value": "999164020f9752b210e52af051fd54e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095956, "uuid": "c3d2f28e-6127-409d-bc6f-12f8503c45a0", "value": "98304:IrgVpgAYBapoeXSnXOt5T0dFmDXdZL4KXvdPDb3Up361xKhZX4cvlSUHRV/2:INAVSBdkDHflD7a3DDlv1HW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622095956, "uuid": "06a7d184-a4e4-4eb5-afd4-c7bd66f2884d", "value": 8238360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622095956, "uuid": "ce110cec-42ee-473b-9d79-c78ebbf9d075", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095956, "uuid": "3a5f0856-f480-4fd8-9d73-356ff1fb8c1a", "value": "OBLIGACIONES TRIBUTARIAS VENCIDAS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619e06f8-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622141418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141418, "uuid": "06b58642-3d89-40ac-a4cb-c21b9b2c3da2", "comment": "Malware payload (RedLineStealer)", "value": "d75f766038942d5ad9827fe9f87151ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141418, "uuid": "5ad27711-b26f-40cf-89bf-bb8c8ee82902", "comment": "Malware payload (RedLineStealer)", "value": "542bb14d2ceec30c45ece43b1d282076ed64872c06b86e7d9fc660b054812dfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141418, "uuid": "473501c5-f4bf-47f5-a720-09a456024a17", "comment": "Malware payload (RedLineStealer)", "value": "751453336b5ec922c75f0a350f4c79a48768b72e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141418, "uuid": "7512ca4c-3004-4dde-a969-543735cedec8", "comment": "Malware payload (RedLineStealer)", "value": "5bf4051364d84984a8e4c377b8b45c3de31df19cece45b6ecb54f53104e9530728260900115ff842a8931245d92fefc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141418, "uuid": "1b17b514-91c0-4cea-8be7-7a3659ecbac4", "value": "84E53300BDC2A872D576053658B95B182A79FD106F31CF6F63A0BA1D9A710D0FB31B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141418, "uuid": "48413888-c530-472b-bd68-4a995732a544", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141418, "uuid": "2a99c8f0-a45e-49f5-97ab-ce32f9c1fce9", "value": "49152:UbA30BAfa9rnDeAw2gtkrLsDztoNCe2PPKKgUO7VFJmOk4n3zb3NjjapGk9:UbFAQDex2vgDpTElViOkeZGD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141418, "uuid": "626dca25-ac85-4f94-9855-d77e68b9cbdc", "value": 3252903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141418, "uuid": "74fc0b06-bc90-4cd0-bf8a-ed01bd9b5000", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141418, "uuid": "d9433fd1-5110-49d1-a129-7523d167880b", "value": "D75F766038942D5AD9827FE9F87151BA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d6d182-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141485, "uuid": "1be454b8-9261-4178-af91-e334c257a8e5", "comment": "Malware payload (Stop)", "value": "5fbcf9d9677fc211c29c536741f0b470", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141485, "uuid": "adabc155-59e1-49fc-9d23-c56b2c583113", "comment": "Malware payload (Stop)", "value": "54e7038687482bd2a5a1aa55a0afb82a66fd3672acd6a223a6b889ec600e102b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141485, "uuid": "79f48f15-7d9f-4273-8625-fdacc810b859", "comment": "Malware payload (Stop)", "value": "74bccfdbfed65d07e379d6267f0c45824753b887", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141485, "uuid": "23ea59c0-67ba-4856-ae13-2c5799644a03", "comment": "Malware payload (Stop)", "value": "8010ec9c2e5275e05b9f0d1e050fedf856e8c4a01e3b005acd7afe8b2464235ffd2ed0f12f6f9b5f0d3d535f9b298d35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141485, "uuid": "d8f92cee-7ece-4760-a0b6-341c06299942", "value": "1605013067E1E034F1F31EB448B592B6E93A7DA2677480CF62C426EA96317D4AE31753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141485, "uuid": "77b5b9f0-3622-41a3-906e-b59abb295611", "value": "bca4c139115857ba195befba3c3bfd5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141485, "uuid": "9701e022-6806-4b77-ba17-9ca234b76da4", "value": "12288:6Dh/Q9kyOruxoa5n/64qCTNNEIzOmmQ7lHH4lGJH5Th9ppUJRn10WPxIjK15U:i/FrSh/6HENNTSmPV40hH21Rqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141485, "uuid": "f712acbf-603a-4450-8492-d962cef6e051", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141485, "uuid": "a608051c-509c-432b-8289-e87b27a24b74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141485, "uuid": "e5758c83-653e-4c74-9551-455a1e9b589d", "value": "5fbcf9d9677fc211c29c536741f0b470.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa753ca8-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141540, "uuid": "bb5c1379-3b07-42c0-a10a-8497735300e0", "comment": "Malware payload (RaccoonStealer)", "value": "ce75037e138d10403d71403b36201bc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141540, "uuid": "ad1d00ed-2ddc-4dfc-a77b-3f37ab4230e7", "comment": "Malware payload (RaccoonStealer)", "value": "54fd2d3eff97caa7dff88d9f1b8c79d650a88c4d7e64a99656ead19db5946b1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141540, "uuid": "4e7c91f9-1211-44d2-ae16-53b718bb6429", "comment": "Malware payload (RaccoonStealer)", "value": "5bc0d8cf265da5cfe6240b9b7863ae0f820f9f99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141540, "uuid": "7320f522-68d1-4347-b379-c7f49d05d0d9", "comment": "Malware payload (RaccoonStealer)", "value": "7cc207c9462bf462fe55d72b4f34ca64002c0b44123c78ec414e8b5ca47d6f7402a79911477c7ead6b61c40485aac03c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141540, "uuid": "4d2670bc-cbfd-4fe7-b724-8f101d4a21ad", "value": "D2C4D030A2A1C034F1F6D2F549B68275A53A7DB1AB3880CF62E42FFA16745E5AC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141540, "uuid": "409f70e6-fbbb-49a5-96d8-e221e35889f3", "value": "cb971fcf399235e4e9a69622d3809fcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141540, "uuid": "09afa4d5-34ec-42ac-9c74-a2656379cb93", "value": "12288:PxB/mMBsnl1550bz2pSXAUCphMa1S4ks6tDQGwzER4/W/d:PxBnBtC61CphDo4+DQH/W/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141540, "uuid": "c37bbf0f-58e3-4ad4-8372-5ba4bf9c0338", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141540, "uuid": "050d4e1a-989e-42c8-a37d-6007ee47d64a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141540, "uuid": "a8a5c1ab-0caa-41c1-86e5-d9b8244d251b", "value": "ce75037e138d10403d71403b36201bc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25e6783-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1622141553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141553, "uuid": "aaa27447-43ae-4c13-94aa-9e2ce1ddd5d2", "comment": "Malware payload (njrat)", "value": "74fcf387e0ef186e0db6d75c64e97fc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141553, "uuid": "2e65e244-fa40-489d-8fea-7b00639a900a", "comment": "Malware payload (njrat)", "value": "5551ff330b4df6990dd1f8566320b3db46367a80bb0d8d6cf8d5a7752b35cbc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141553, "uuid": "fb469ea4-4c91-4473-af6a-909377271203", "comment": "Malware payload (njrat)", "value": "71a4dd67e0dfeb7de70b71e4d1f5b00726787c14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141553, "uuid": "10779e8e-c3a7-46ff-91ec-12a2a781dd26", "comment": "Malware payload (njrat)", "value": "90030f5741363cba73566ee7690be2733178cdd4be8003f64c03672b1b3477577846e88ffd6bc35d15dd926940658a69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141553, "uuid": "25967f65-f9b1-43e2-a695-8510d0d224bd", "value": "0913E149D6E11178C17D1B7286F7DA1283BEFE10162BEF2B8AD0909A753BA270C53235", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141553, "uuid": "dbb4f304-fc82-4524-8af2-dc65fb452af4", "value": "768:TLP88d2TL//N1x0YSFzJ++lUHs726CA83txWkRR2QrZX1a9nCBxuMzNtevKrhhBj:Tr2f9PuFN+Ls726CA6qkTvZXFxfNsKVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141553, "uuid": "5227bd88-ab3f-4b41-9675-3dc44fb76595", "value": 44600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141553, "uuid": "071bc039-afb2-4e22-bca9-fae16dd08fa0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141553, "uuid": "5818422f-b38f-4825-96b4-ade83012f910", "value": "5551FF330B4DF6990DD1F8566320B3DB46367A80BB0D8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3b7258-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141493, "uuid": "d4f342ab-e5be-4202-8fb2-cd66f87821dc", "comment": "Malware payload (Stop)", "value": "e512b507ee6ccc868374cdd76cf53ed8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141493, "uuid": "120f9f69-c93c-4489-9aa0-8aeedc1a543b", "comment": "Malware payload (Stop)", "value": "55c133a827801ff7dc34094d6c6c2ad709f5a5e55b16d64f6574dc671d97fd06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141493, "uuid": "36e855c5-8f26-492a-9fc4-047f5b61bae0", "comment": "Malware payload (Stop)", "value": "3067a9c499924c049cf57fe146e9a8c1b8c00e7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141493, "uuid": "d19a76d1-a80a-48a8-96f8-a5eaededdadc", "comment": "Malware payload (Stop)", "value": "2a341cd7a801c966b1b46717db89604b6f3c5622593cd828c5934e2e3e2fd1fe5876c9e74d4ffa2bf58edc60f62a1d6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141493, "uuid": "9549e3b9-8e1c-41c0-a756-6b3bf02e1132", "value": "3E05F12067A1C034E7F312B449B58278A53A7DB26F6751CF62DD3BEA16349E0AC3075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141493, "uuid": "c25ad32b-88ab-4115-8fb6-ab840da2907b", "value": "556bc424bd608c9e064a122699e67eca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141493, "uuid": "21142055-2235-4de8-9391-92885e958686", "value": "24576:uFT+t5iRMaaIXeo5NQoxq7oLkw8pz6Jo4:jitLtLjgeJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141493, "uuid": "1d8a6abb-0017-4cd9-a776-941d050d0176", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141493, "uuid": "5ca4e86f-8df7-4290-9d40-6a61049a5845", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141493, "uuid": "5e7cdcf1-54ae-42fe-9513-2e6aab0c3d10", "value": "e512b507ee6ccc868374cdd76cf53ed8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f792cc5-bead-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622093713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093713, "uuid": "e230bdf8-44e0-40cf-be61-bf9920f435d4", "comment": "Malware payload (AgentTesla)", "value": "27691275d1d8d91df8feaf4cd0e74913", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093713, "uuid": "6de2a5a3-579b-4889-aee0-286e58761554", "comment": "Malware payload (AgentTesla)", "value": "561216f97efc76eeb6600d7faf1e8942192bdb5b259998da4318882151c24dc3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093713, "uuid": "127f8431-75f6-432d-b843-e5531bb41784", "comment": "Malware payload (AgentTesla)", "value": "7d138d52348eeaa8fc3fd1912fdcd5cddd44948f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093713, "uuid": "c8763c79-3654-40cc-9a18-787f08a0fc80", "comment": "Malware payload (AgentTesla)", "value": "cab116aa45c2de5ece39158ee62c167b811d766642ee4f576d6f233f6fde314e674c922a18028f497bec59731331150f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093713, "uuid": "173a578b-8802-4068-bcfa-919f8efa5448", "value": "F39423492B386388C5E90A798560911893F3F60B7B2DD7884FD861BE1D73BD08499B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093713, "uuid": "a8890ac8-9d9e-40fc-b709-db42515df91a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093713, "uuid": "369b1ed8-6810-4456-bb4c-523c49eb5444", "value": "12288:0n0ihICw5ldAcQbYNnqhfgAPq0z17zUlvRDZV6L2LXH3bIwc:0n0sILycPQhLPxqvPdbXbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093713, "uuid": "7f190fc1-c25b-4c55-9631-e6ca9f69a92a", "value": 438784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093713, "uuid": "0835a5b2-8896-448b-a1d4-1f7ac4d62ffa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093713, "uuid": "b7b416a9-3148-42ff-9164-b62d8f217b24", "value": "quotes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a989b824-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141538, "uuid": "09728dc2-5ef4-4ffe-9494-2f9cb2000685", "comment": "Malware payload (Stop)", "value": "d891aaaf2c5769a64abe5e49258f6a43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141538, "uuid": "73b95494-81d7-45e6-afe1-04958f43cc17", "comment": "Malware payload (Stop)", "value": "5634f2119e6a87940fad1e415373715e06c74208ed8176886a7a9a952f365292", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141538, "uuid": "3488ab46-d20f-49e0-bf4c-f1eab4cfdde7", "comment": "Malware payload (Stop)", "value": "1ed441bcb259280c628cf763f80af024de1dcead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141538, "uuid": "cfa10aad-7fb8-422f-85d0-e3691a6bac27", "comment": "Malware payload (Stop)", "value": "ca43b222acd8022893f973782fccf6e530a375b5d87176b59ff19f9c4bbf4c2085c13cc2f4635555f2696ab7c99fc447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141538, "uuid": "56adbd7e-30c5-4399-97c4-15fe04a876c2", "value": "A705F120AAA1C034E0F727B44AB982B8753A7DA257F482CF72D12BDA57755E4BC30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141538, "uuid": "9eeab315-0ca1-4d2b-89d4-a41768661391", "value": "cb971fcf399235e4e9a69622d3809fcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141538, "uuid": "6deea5d2-fdde-45a3-aacf-43885ab469e6", "value": "24576:9QBrOf8PhQ9tnkLWkWnGlj+OsdFGWB1W6:GBphtLWkWnGlj8Jq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141538, "uuid": "d2d73a96-d8d5-421f-a9c5-00421b4752d7", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141538, "uuid": "7de17d52-0d89-4e8c-9833-737b4be83a3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141538, "uuid": "05df54b4-d698-4ef1-b2d2-6024cc5322c1", "value": "d891aaaf2c5769a64abe5e49258f6a43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e898f16b-becc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622107284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107284, "uuid": "55d91c0a-dc83-4a1e-ac10-a53bd9f9a014", "comment": "Malware payload (AgentTesla)", "value": "c14a267dd32eba9d3f2c8c52a19a8af0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107284, "uuid": "f0393c95-3940-4031-b3fd-8658a7ca3037", "comment": "Malware payload (AgentTesla)", "value": "5884075f24cbec4b86469c9e202a02d38c497c1b4b5ead5f94600e117130c1f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107284, "uuid": "6aad3692-cbc4-46cd-8d88-8f077f44dba8", "comment": "Malware payload (AgentTesla)", "value": "a261334e180f25e12e6ad3a42cc0a8aa6b764ef1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107284, "uuid": "2de67b64-55cd-4b63-bd4b-710967dc2d62", "comment": "Malware payload (AgentTesla)", "value": "214b8d6d8e11ca0c101dc4e22c86004eb239ae7f904ca52acb90c762374e325afc96036c18232562b04682a15ff6b9b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107284, "uuid": "cdb58dea-0aa4-4002-b990-2e0386267149", "value": "AD4422BD30EAC9A3EA561A7246F3D67EC77DDB0114520E9797901F7A0A28303D6207DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107284, "uuid": "ccd93748-1bf8-4b46-bcac-f974c9b33c07", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107284, "uuid": "930c8637-eb99-4de6-8b48-cedf6ca1a3f3", "value": "6144:8sB0IVeR82zidTRH7ofg3VoGQJBONJgXxBucfkBrQBy:F0IVEs8fLGQ2vgxBucfkBrKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622107284, "uuid": "c2177ca9-c751-4dee-bffa-e4aa4f2288db", "value": 276841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622107284, "uuid": "fcd0e186-5956-4167-8481-45af8095c5e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107284, "uuid": "99af13b1-3cb7-4c6d-adda-79fb736e7cda", "value": "updated statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62f5f80-beac-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622093429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093429, "uuid": "d3e45fe8-7699-4d87-af72-562a167b132b", "comment": "Malware payload (Formbook)", "value": "60479648110ffc8b5e4d0aa32855a289", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093429, "uuid": "ec2638f3-ce21-4eb6-bd4c-82863a66bb69", "comment": "Malware payload (Formbook)", "value": "58b7fa527ab5cff6d5465f2e751854e6708ef4d0070587883ca1fd8739359d6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093429, "uuid": "39740614-ed9d-47e2-8182-13fdbd7233db", "comment": "Malware payload (Formbook)", "value": "d7afa17e39cb605fd19c61b2cbface58706b884b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093429, "uuid": "9cef04b9-d86a-4d6a-824a-a87a9e827efa", "comment": "Malware payload (Formbook)", "value": "96b67379f6f219af0d8d4b09698fbcdf1fa5feebaf755f8c16e0095123341b75eaa52a5b1e6bc2bfcc71fc9a2f20e6e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093429, "uuid": "526d4140-d34c-4d83-8c37-8c2911a5475b", "value": "93F47C1C25688227E5A8D2B49DD5D82FD260E9377112FFE8E8D703B90B07A53798217F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093429, "uuid": "c3b44bc8-29fb-41b7-accc-c7b578fa9861", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093429, "uuid": "fba1cddc-5097-4541-9a78-21dc9b011b89", "value": "12288:9CDUsds8SmyBrYnAWAcHj2XoNY71yay4bpRYbUb:9YdsnYlAcHjXYgf4bI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093429, "uuid": "62e4981e-4caa-44ab-96e3-07242252fd8b", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093429, "uuid": "44bf3b6a-5e13-4cb8-a2a4-bb61e2a7b0ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093429, "uuid": "52180604-49a3-47ac-b169-029730ec3b43", "value": "ORDER LIST.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8ab2ef-bedc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622113871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622113871, "uuid": "22626533-2da1-4922-9eae-aad088e3ef68", "comment": "Malware payload (AgentTesla)", "value": "05b6746ac6c3d5ebfa27d07c8d3b928f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622113871, "uuid": "c5ca8d6e-8bae-4235-a52b-33007eb8845f", "comment": "Malware payload (AgentTesla)", "value": "593c306179214d859a2bd9ca03a93f27235eccf424f518def2fd7e1d3903851e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622113871, "uuid": "b9088cb0-d603-4537-a0ca-e1b6d9e457c6", "comment": "Malware payload (AgentTesla)", "value": "cfc1a844e8794cf65b61f2fbed11811b6170d119", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622113871, "uuid": "933c75f6-1313-4724-bb11-f6d4957a0fc8", "comment": "Malware payload (AgentTesla)", "value": "f7f2589e5961d8391b04e3fe9ba7334ad609d5185abe45a85c0dde1c7c3a10761f9667c600e576aa91423009f8c5643f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622113871, "uuid": "d46bf2af-5a5a-4e04-abc8-76d5c7266308", "value": "BB55D63577A407A5E4B3463546F8623787B37CBA3720E98D2C6133358AB65811E2DF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622113871, "uuid": "88c1712e-d40d-4e2c-ae78-47207920ac06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622113871, "uuid": "1958e68c-6b56-4f3a-8101-71156ccb0938", "value": "12288:21dVB5/ClIjWpMpo1bxTOfVnwQEr/KpV+9nSGLWUmE9HNc5/uEg/or/:2pqbxTswQi6V+9rLb57c5/uEg/M/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622113871, "uuid": "4d65f6eb-443a-458a-bed9-910380670da6", "value": 1309184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622113871, "uuid": "dc289122-90b2-41a9-91ad-55a2bd2f02f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622113871, "uuid": "e6e6506a-e5ee-4ffb-b83c-c1671637d6b4", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a22ad3-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141470, "uuid": "2e3136c0-956b-4f90-9462-453d12dd19b0", "comment": "Malware payload (RaccoonStealer)", "value": "23db5e5bb2833ca236bcb0522c7c2efe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141470, "uuid": "0e798d9e-6f5f-48d7-802c-747bcb3b545d", "comment": "Malware payload (RaccoonStealer)", "value": "59562a7c28d4e461070e0cdd8d242981067cc646a23be65c137f19589579055e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141470, "uuid": "cff689ac-a040-4b92-9f43-dd94ce457b8b", "comment": "Malware payload (RaccoonStealer)", "value": "b456d60771612c57f90caeee5216d163bf00c092", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141470, "uuid": "3ce54f3f-630f-4cfd-975b-89d8c307a5ef", "comment": "Malware payload (RaccoonStealer)", "value": "9d66ee82de0a3108df2cb1216009aacf930eaee6dbb816404dc0619e3a8f072a8d8702a4069a7e3ab2abbf8168f129a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141470, "uuid": "7de56e6b-e6bb-4b64-97b8-855e39edca19", "value": "A3C4DF3066E1C036E0B35AB486B582B5BC3A7DF35B2450CF22D53AEE56706E4AD3075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141470, "uuid": "516648be-9dd6-4595-9591-7ac497eda138", "value": "491e594dd178e0e1cc881884afe309e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141470, "uuid": "994afac4-7c57-422e-a54c-e3608fc8aaeb", "value": "12288:it6IjRXm/tdWAiYFAZW7yaEIvg2wpCk/TVsO9Q+X38Zxd:vIjadOYFAA7pE0g2wAk7F9HXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141470, "uuid": "7b0c372e-56be-4a96-96a1-14fb00624917", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141470, "uuid": "f9823779-3f58-4fa3-b687-5fbb9a288812", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141470, "uuid": "352f271e-123d-44a5-aba1-dbb3fae15669", "value": "23db5e5bb2833ca236bcb0522c7c2efe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e105b35-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1622141412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141412, "uuid": "db8e4a3e-9bc7-43c1-b09d-9ba76b6bbb9f", "comment": "Malware payload (Adware.FileTour)", "value": "825cf844a194beb6519c69d1f3687c51", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141412, "uuid": "49c9f9a9-858e-404e-80ef-57bb73cd0254", "comment": "Malware payload (Adware.FileTour)", "value": "59c98f1846f03efaa1a594b76b320e3f35ecd53e9ed640bb360bdcf0a41f3c2d", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141412, "uuid": "f49d066d-995c-4e74-9790-008e08b8983b", "comment": "Malware payload (Adware.FileTour)", "value": "358c87603cea6a0acd8935abca646bbd5e31332e", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141412, "uuid": "1de3cd59-a0e7-44bb-9197-ca5a170aa1c7", "comment": "Malware payload (Adware.FileTour)", "value": "f377ba258da690bd98d262b7be7674670756f813c3da7d851049984a5102f6a42485cb13b439a4c58ac66f633eb898fd", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141412, "uuid": "eff84cff-f3db-435c-9ee4-ced5adbf3c7b", "value": "121633C497519097ECE187B49808BBF32E9F0D781580DAB4EBF016DBA69B9E25708346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141412, "uuid": "5dcd5bd6-ae01-4538-875a-2429f7eaf0b8", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141412, "uuid": "4e850f18-068f-432e-87f8-b8ae76b09db5", "value": "98304:JOsZi396HjeeFquGKJ97i6viWMP1DZVWITwoyu4z0jARrfepzkYop:JOX9Gqe8Bk9RtMP1DHWIgubYrfQZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141412, "uuid": "7adf1471-bc06-4594-b413-5a93f9410dc5", "value": 4202412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141412, "uuid": "8395c17d-0a2c-495b-b273-cd5a728709f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141412, "uuid": "597cb793-f6c1-41fb-9f6e-d6f97566b2cd", "value": "825CF844A194BEB6519C69D1F3687C51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48cb02c-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141530, "uuid": "c623fd05-fb35-497e-a4b7-1fe31c6f7da3", "comment": "Malware payload (Stop)", "value": "a47b89d7802b7d8526f6cc743cbef993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141530, "uuid": "ca1df7f0-e244-4cdc-9545-f801d61677f6", "comment": "Malware payload (Stop)", "value": "5ad7a8bf388c3cfda0194dfb70a448b7a6e8389e6ca9804bed72db8668b5b63d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141530, "uuid": "e40814a4-f5b5-4136-ae75-c0dc861f85c9", "comment": "Malware payload (Stop)", "value": "0f7e020d2e14d802b11649958010c4d2b202973b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141530, "uuid": "2998c7a8-3532-4ed2-8cf6-e043e9bf82fa", "comment": "Malware payload (Stop)", "value": "95396bb55df507e3b3bc30e3edc812029772fae5b11509384ab501607fb683f5908da8faa12f1c7a5a73fc2cf9ab7f25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141530, "uuid": "4333bba5-7215-46dc-818e-8e6f093482cc", "value": "7805E020A2A1C034E0F712B8F9BEC279A4397DA16B7490CF62C52BED6A345E5DD30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141530, "uuid": "709478f9-3cec-472e-8494-f75a50743442", "value": "a26f0e6bd2952037425bd22d2a7efb64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141530, "uuid": "0db0a18c-81a4-41a9-89c9-c3043d18e740", "value": "24576:2pxE3WgRlyZzT3sjvSGRmX2NMfrqL4D+6pP:2cRlE33evS2NMe4D1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141530, "uuid": "b77d3155-0e23-49d5-8ed9-63861c1eb590", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141530, "uuid": "b91033f8-d4a0-41ba-8be9-fc273be15750", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141530, "uuid": "d91d09f3-c540-4ee2-a8fd-7a43cd32cbc1", "value": "a47b89d7802b7d8526f6cc743cbef993.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba845b77-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1622141567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141567, "uuid": "4dc568ee-5e5f-406b-92bd-00c244c854db", "comment": "Malware payload (CryptBot)", "value": "e260d16f617dde31e0e98a8aa85ffb51", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141567, "uuid": "b2d2c721-0c84-4238-96b0-59364dc0333d", "comment": "Malware payload (CryptBot)", "value": "5ae264a5e12c7eb4d1ff850aba54812c279b9a6eaceb66635db25adaf05b9c09", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141567, "uuid": "6fbc2c8a-b9c4-4b41-ba58-71885260daf1", "comment": "Malware payload (CryptBot)", "value": "4b7e5a4d7f7d5652c3a410736c91629ac4bd9560", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141567, "uuid": "40ef49f9-66a8-4772-a3c5-8fa07657cafa", "comment": "Malware payload (CryptBot)", "value": "150c863200638462d5fb50b48b871e6b89766dd2422831dc608033c3e2b1ecc4fb18e4c217873ebb508cc95a11d49870", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141567, "uuid": "f09cca87-c6f9-4aa7-a04c-0de5f636696b", "value": "57F4F1206693D034E0F61AB45AB5C3B9653A7DA1673411CF62D83AFE5A386E4EC33713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141567, "uuid": "df586623-5a3e-46d4-acbd-15a9b8acde80", "value": "b0ea5360984cd75edf9d1528f542b372", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141567, "uuid": "ca4d46ff-d58f-415b-a748-fcd970ef6f3b", "value": "12288:Fnmev1oz1ByAVBIaxHrBM/K/WOxjmBsHhmfTEcM2guIlYm5DdE+NnAv24l:YevgjcoHVf/ABsHcU/zl7xNn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141567, "uuid": "e7d6ead5-8746-412f-9a12-0dfe4f4e4958", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141567, "uuid": "6703c05f-687d-4044-9120-23f6dcbd0848", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141567, "uuid": "ff618193-6c49-49e9-871f-59297b39c761", "value": "5ae264a5e12c7eb4d1ff850aba54812c279b9a6eaceb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89177b49-beea-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622120009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120009, "uuid": "607432a7-a739-4b16-a511-5f98fad08580", "comment": "Malware payload (RaccoonStealer)", "value": "70ce33d53443863eb3d38decd57ce4e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120009, "uuid": "d9482438-83c1-49ec-95d1-b70e015ab871", "comment": "Malware payload (RaccoonStealer)", "value": "5aeac4b469cfbf8a4d9cf90d0fbd008772e7bf03d9114f7d0bbe7914062589c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120009, "uuid": "a6890d93-a782-442e-8f0d-5785de057160", "comment": "Malware payload (RaccoonStealer)", "value": "615a6ffc5f4c2d6f9bb0cbc6432eff70deba50f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120009, "uuid": "13e68b1f-1e4b-482f-b1d6-3f129fabcaac", "comment": "Malware payload (RaccoonStealer)", "value": "cd353ee050b8dbaba6a0ad1d41c6c93db095fbfdb1f563e309913c5e1ccf2b1783ed6e5d8b8ac77d865ce0cd872b88cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120009, "uuid": "5116297f-b0dc-47c1-8fea-680752e87f16", "value": "8E050131B7D0C034F0B756F449B692B8B53A7EB26B6480CF62E42BEA5534AE49C31753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120009, "uuid": "6aa8fb89-9bed-4f28-b7ea-dad0775fa180", "value": "556bc424bd608c9e064a122699e67eca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120009, "uuid": "3e079632-765e-4ac2-b90f-6c52ec042f48", "value": "12288:p9pTVveHHtIISRBVgrcZ6gExzpU6ZhosLMC6QJ6Ry5dA6y9VpAY+bDqgNBBrK8ee:BTwtaAmExzpPPosM3Qwx6y9MND53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622120009, "uuid": "858642b9-60a7-4d70-b4a6-0855009e620a", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622120009, "uuid": "97e1ca7c-edbb-46b9-9cf5-4b0f39e9567a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120009, "uuid": "9230874e-6937-43b8-9c0c-b3067271c262", "value": "70ce33d53443863eb3d38decd57ce4e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d090c5-bf0d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622135029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622135029, "uuid": "e7fcfd83-4d20-4c4f-bf35-c2b133283030", "comment": "Malware payload", "value": "fe69dc9aedee6fc81b422327bcfe5a12", "object_relation": "md5", "Tag": [ { "name": "cih", "colour": "#1136E1", "exportable": true, "hide_tag": false }, { "name": "Win9x", "colour": "#378144", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622135029, "uuid": "0d4b6b08-b5d7-47e4-b793-9a14952b4354", "comment": "Malware payload", "value": "5af6ac5ec9dd8ca20cf7cd75ee65645c41a04b744bfd597c9c914e465a30d729", "object_relation": "sha256", "Tag": [ { "name": "cih", "colour": "#1136E1", "exportable": true, "hide_tag": false }, { "name": "Win9x", "colour": "#378144", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622135029, "uuid": "1567ae0b-bfb0-4c09-a517-c6e09f97a958", "comment": "Malware payload", "value": "f326e0b93b27efa85c88ea6aeec0cd701860b14b", "object_relation": "sha1", "Tag": [ { "name": "cih", "colour": "#1136E1", "exportable": true, "hide_tag": false }, { "name": "Win9x", "colour": "#378144", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622135029, "uuid": "e2842c93-45ef-41d5-bfe8-5c72d0825425", "comment": "Malware payload", "value": "8aab030d60abb123cf69b94b378346187a888347c0426e137ac0c98df3418635c300c41ec6eefbe6d4d9384c0e34585e", "object_relation": "sha3-384", "Tag": [ { "name": "cih", "colour": "#1136E1", "exportable": true, "hide_tag": false }, { "name": "Win9x", "colour": "#378144", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622135029, "uuid": "eade7fe5-635c-444c-836f-ddb5d9033dca", "value": "35149D1276E4C8B3D6E15A700DF69B75A3B5FC708D33C547A390DF2D1C32A92662A326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622135029, "uuid": "25f0258d-ba89-43d1-b932-9d36bfda1e4f", "value": "386551ed9cfafa8e773b4ba771749513", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622135029, "uuid": "aa60b480-2359-4e53-a32b-6da413e32f9b", "value": "3072:HTUNx8grg+BhlCPUN3g3ioZWOKaC/yqeC2f+LqL7+5akX6rmRyOmL9jg2LSwny:HTWQ+XlyUNCTKaC/yqeC2WyDkOmwOyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622135029, "uuid": "be9d4b65-c850-4567-8a91-3a75951bd453", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622135029, "uuid": "d6932b14-b5b9-46c5-864f-9ac5c713fb14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622135029, "uuid": "f57c0fb3-7123-4195-8233-70f74be1c78a", "value": "lv4qo96kq.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bdfeba-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622141606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141606, "uuid": "3e3c70a4-7e07-40e2-8871-bd874b2bedc9", "comment": "Malware payload (Quakbot)", "value": "8a28166f6fa5a200395bebff13272792", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141606, "uuid": "f86c15fb-4ed4-4134-966f-b4a3dd49fec6", "comment": "Malware payload (Quakbot)", "value": "5b79b62d158feec31129db57d9a766a52a7d28c476dcc716478c766d4c21d9ad", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141606, "uuid": "b7c626d7-c8d6-4bff-8549-19268ab25ff2", "comment": "Malware payload (Quakbot)", "value": "8de9bd7e2bc48ce41eb511359bab6ddc3423f247", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141606, "uuid": "d9f6f346-9202-4164-9197-ee2ac3e77ff2", "comment": "Malware payload (Quakbot)", "value": "d95002749c121ddf9cfccef8f54414c4d319eb4b73c98fdc2e2e324f31ea432c30667503868dba63508c44e602eb35e8", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141606, "uuid": "abe99d5c-c42a-4130-9fb7-f6f586c1d4e3", "value": "DC74127FE28559F4C3398D3FD680E1908265F1E04167B32D47DD3928A34329FA95E2EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141606, "uuid": "1a7aa0c6-e322-4127-a193-7cc90a20333d", "value": "6144:lRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNh:lRMmEv2Bc/nvm8IKABfsYOmauFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141606, "uuid": "9ee6fbd5-08bd-4a9c-8a69-adae28042711", "value": 339491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141606, "uuid": "e8df7302-791b-4734-be5e-816a76c25a8e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141606, "uuid": "1d78c993-1305-463b-80fc-9e07d4aadee5", "value": "Rebate148771054505272021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a811e652-bec8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622105458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622105458, "uuid": "465fea76-4053-4b1c-aad1-10c6b33ab66c", "comment": "Malware payload (AgentTesla)", "value": "f5e903a7c8b8741db56eaf82b8bda607", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622105458, "uuid": "7a0aa731-6bb0-4c5f-aad1-1a2eaff6b2cb", "comment": "Malware payload (AgentTesla)", "value": "5b9ababf081e749bc0800dec788895f4bf650c01d9e2432877a729ddfed7acbf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622105458, "uuid": "9e42022e-8dd7-43ae-bbbc-c32495085670", "comment": "Malware payload (AgentTesla)", "value": "65ae8e98ab033a03056a7fef2fa72a4abc548abf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622105458, "uuid": "df835f19-e0ee-4da3-a2b5-651f4d149b29", "comment": "Malware payload (AgentTesla)", "value": "ab12083995d48580e660312c681aef606a4f1e6b3c0d70855a5130d08e04ec955649b68e82e16d1e425229b679e062a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622105458, "uuid": "0ba69484-7d91-4a7b-97cf-7d3101ee3350", "value": "1F359D243DEAD039F173DE7D8AF8A596AD1EF263260EE49D90D002494213BC2FD9653D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622105458, "uuid": "ed3ebe10-e0bf-4d45-af5c-0441538b29ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622105458, "uuid": "52b32e6c-48cf-4fc0-9a20-03f790b39761", "value": "12288:lOH+6mX1LofUQUtmkjRrA869XFJXIKzYmE8fdGr+MXga9cZ726m+dzbC8jeCbnw5:yMX15tVAtXbY7J2A8ICw/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622105458, "uuid": "f93615fa-370d-4920-be70-7dda5382fa8a", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622105458, "uuid": "5b91e86e-7f8a-4ddf-b3dc-7913886e5412", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622105458, "uuid": "a2402d42-25e0-4b36-b726-f92946f6995c", "value": "Product Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc645f0-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141522, "uuid": "dddbab0b-ec15-456f-a552-7c95cd82d108", "comment": "Malware payload (Stop)", "value": "7f3f0bd304307efb2a331a44eeafb8b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141522, "uuid": "c7a9bf13-ce6d-4c98-8a2e-56e33e88dd9a", "comment": "Malware payload (Stop)", "value": "5bb3a5ae8f461d4e2dca57fbbcbc075f0d1c898b99f432bc4cf6fc2bc3ac1091", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141522, "uuid": "748e0287-36f8-4662-9af2-df7749ef809e", "comment": "Malware payload (Stop)", "value": "75ada999943ad8ea048ac3cef7c7e6a410253a46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141522, "uuid": "ecd9ca46-875f-426b-90ec-366c4c437361", "comment": "Malware payload (Stop)", "value": "4e95720f4a0f26e4a2cb68480c3db7a416a9090e38b4fb56f0a166f0916700d9e3065ea9d950fe2beb01a863ee789486", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141522, "uuid": "c656e12d-1616-4770-84a8-207f49a3ac74", "value": "D9050230A791C030F4B716B445B586BEA43A7DA15B3490CFA2D0EAEA7A346E5DC30F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141522, "uuid": "021da17b-01a7-446a-8614-9f36f1c73513", "value": "a26f0e6bd2952037425bd22d2a7efb64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141522, "uuid": "70f271ae-8741-4302-8883-4cc4d3c65a6f", "value": "12288:Jp70XENnWDeGxf2EpEO4q2mqTxvVQmF7xOokkvkKGy0cTVXAXj+pk8j7FlP:Jp6ENfvMXivt1OzkvGy0cbk8dlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141522, "uuid": "bd5cbd5c-e622-4ec0-8eb8-b8e07b87f748", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141522, "uuid": "90297db6-7fc0-4430-9a59-e96b3e3498d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141522, "uuid": "ad3a6370-f6eb-47fb-b53d-4f3f1ced4a81", "value": "7f3f0bd304307efb2a331a44eeafb8b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f15bf5-bec2-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1622102767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622102767, "uuid": "27b70c94-617b-4655-b205-364a2630f870", "comment": "Malware payload (Gafgyt)", "value": "5da0c362f8a9f0ef34abada9f8f28bb9", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622102767, "uuid": "dc4f6caa-f747-409c-90e8-e282bdbe8a93", "comment": "Malware payload (Gafgyt)", "value": "5be79fc560e5b498afc50911355bd03b61e0cdbaa592289dac3d41bff21b96ff", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622102767, "uuid": "27f8bfd3-af9c-49dd-8beb-4aaedb729ea5", "comment": "Malware payload (Gafgyt)", "value": "e7d51138147d5ceba1d5a25e09eaca214bdffa15", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622102767, "uuid": "36d01e6d-e841-4335-82cc-8d6fba724200", "comment": "Malware payload (Gafgyt)", "value": "e902c2e77b962944208b0d11477f872842e97d56e0a91e478a6d51638249b4399e42b81147568fcc21356db25b318f31", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622102767, "uuid": "8b04caa1-de15-4586-91ba-733ed628cdcc", "value": "20A3842A3E21EFFFE568863107F35E7097D5629226A19386F25CEB181F6128C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622102767, "uuid": "a496d815-ca29-4f30-a702-94e2a2289463", "value": "1536:S7j+1TfCq+LzIfK2rKIfmaHy6rfV2D3neD2bS1jxlrimW+zWBSirHzai:VR/fymd2D322bS19pimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622102767, "uuid": "371d466a-b82d-43eb-aa8b-cd3d1caadf67", "value": 104712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622102767, "uuid": "353d5ad8-6ea3-4da0-b453-f0e59943182a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622102767, "uuid": "6c4c9328-7890-466c-bee7-2dba7619bd85", "value": "Demon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe7fb51-bf2b-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622148065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622148065, "uuid": "9fe8e45f-feca-46bc-9e1c-2445fab75355", "comment": "Malware payload (RaccoonStealer)", "value": "1e8f7e97829a667ea6e11f1be8aed9c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622148065, "uuid": "1dcaeaa5-b5e1-4e8d-b485-aef625a3c514", "comment": "Malware payload (RaccoonStealer)", "value": "5fce415ea8596e0aa332b961dd62c1e39ddfbe593d577b91ff32aba9d9767cdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622148065, "uuid": "b1ee6ada-478e-4476-b8a7-0fc3624b9006", "comment": "Malware payload (RaccoonStealer)", "value": "527f7fe8e5ff4a39fb33ef27b0e5d5569a84c071", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622148065, "uuid": "e31e0858-69a1-4fce-8dd5-2f261bf6c991", "comment": "Malware payload (RaccoonStealer)", "value": "f506a09048a104abd18c6dec91c8c8afe416b2e1e5bad32bbeb87b7df10251fc980c61279c5805857ab50f70dc10f640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622148065, "uuid": "dc8f865c-d876-48d1-a49f-3bded167d0d2", "value": "334633B3B4819077F6B309704A8B9327B63FBA302E6E65DFF1DC052D5D179890399289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622148065, "uuid": "8b74cd01-40eb-488c-bc02-098fa1749474", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622148065, "uuid": "8573a88b-e4b1-494e-8f93-2b4a0837b517", "value": "98304:pAI+8AloWZZyNeCm14ZU3mAg/ceHwoR1arA236A6DB/R8EqLNjlvqRIZLVRWTwZQ:itvocZy7ZRv1M33r6D387mRIZTW0ZDCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622148065, "uuid": "6459b1b5-6f00-4735-805d-9d34f390d0e2", "value": 5771371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622148065, "uuid": "776fd138-0660-44d0-b1f5-a5246a039837", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622148065, "uuid": "5fbd9efc-a67d-4d6b-b67f-f7d48b7a6b53", "value": "1E8F7E97829A667EA6E11F1BE8AED9C5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047ceb7e-beeb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622120216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120216, "uuid": "c2dd86ed-ca83-49cf-8205-c9fe9a7b84c6", "comment": "Malware payload (AgentTesla)", "value": "f09ef2a2a2bdb1bb0af3d31220c25925", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120216, "uuid": "e02817ff-ac44-4c8b-99ef-008f86b4ce66", "comment": "Malware payload (AgentTesla)", "value": "5ff5ff8c1ad2973809fa18ce1454a731f41ce5d5ec3329dfe004d13a52ca6fb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120216, "uuid": "67038bf1-9b7d-45b0-a1fd-57d7762b906e", "comment": "Malware payload (AgentTesla)", "value": "9cdaf1bf0b5262043eb2b40a320b5c4dae30d57d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120216, "uuid": "3e369192-d762-4662-9a3b-b4d690071fe7", "comment": "Malware payload (AgentTesla)", "value": "d116993a2e7a94c90c7aa2e98c34d4b344ecdb3ddc15b55c66860fc53e11acbbaa9096152b6f3b439c98bfcd42bc0290", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120216, "uuid": "80cea288-1c83-4c71-9cee-3ef5e0719c80", "value": "4BA4F151B6A44620D4765BB4703F7E6E07B2AD276921E6080D9F77FA2F723C08109FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120216, "uuid": "6772a915-a48a-4b0d-adde-75922d33706b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120216, "uuid": "95d2ec2d-a140-451a-acbf-433c0d4b6105", "value": "12288:SR2Lcetn+LvIYdBq3ZSkc3FqFTgp1jPppngfwvGuFRqo:HLcKn+bIQgJSkc3FECBvGuFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622120216, "uuid": "e72a0aef-1372-4c68-a922-63c4c7fabb06", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622120216, "uuid": "1eb66fc9-b1be-49e9-bc66-14d2e17549b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120216, "uuid": "7e30a747-d4c3-466e-aa01-189eeb0341ad", "value": "PKO Bank Polski_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a170ddf2-beb2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622095998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095998, "uuid": "700bac07-be5b-4ff7-858f-bd67d6d472e8", "comment": "Malware payload (AgentTesla)", "value": "75e433372b21155178b5ce0950c451eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095998, "uuid": "c7b82eb2-f44a-44ca-a2cd-1ae9eeeb3173", "comment": "Malware payload (AgentTesla)", "value": "6013e3caddf97dac75bf9ed3596deecf54ad0150f0346326d1d6a6d077a62c6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095998, "uuid": "a1d26383-6633-446b-a149-9b004bcff953", "comment": "Malware payload (AgentTesla)", "value": "754a3bef7f1ca9dc6d66fc26fb63341f6a9a170d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095998, "uuid": "b14ee6a3-8fe2-479b-a106-7f926ed3beb7", "comment": "Malware payload (AgentTesla)", "value": "9b01ac8c5f46f935df70506b1a4bf6474551bc445d96d6a41ed2858641853194786c1c46e85ca8a1c26544de70aa0296", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095998, "uuid": "d48a8457-02c0-40fe-9859-a04c226ebc4e", "value": "3EF48E1C2168C226D5A8D3B48DD5E86FE520E9377112BFE4A8E707B94B07A437D8217F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095998, "uuid": "13aa00fa-0068-4a51-bbbe-c8a3d5cacbb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095998, "uuid": "84f4d5d1-08ed-4b47-b783-fbb8e047c2c3", "value": "12288:k1lOVdPKZJ6wiOSnlsGAYEbI1v/4hdbCncunEQnAtGgQuJ46vEpFej+:k1GdoTBQSmEW4WcunBgvJREa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622095998, "uuid": "cba1c784-4c7c-4ff6-b89b-471707996e9d", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622095998, "uuid": "e6dd865a-0bda-4c78-9b36-c7bedaa57b85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095998, "uuid": "ef41ce16-32eb-401f-921a-63c5c71c2f86", "value": "Purchase_Order20210525837289283292823.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5183237-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622141558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141558, "uuid": "499b8482-313a-474e-a5a5-75827c508f20", "comment": "Malware payload (NanoCore)", "value": "5bcb9ac769b8c069e202b42b16773af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141558, "uuid": "80d8441a-c217-4316-8da8-a9531b6db497", "comment": "Malware payload (NanoCore)", "value": "63293e2c954c974e685dcb975d009448838d0ed659719d29340b587cc89c203f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141558, "uuid": "76d1d678-67c0-4f68-9f9d-87941e6c22c2", "comment": "Malware payload (NanoCore)", "value": "e8c9dc0c933e24b6b0a1d92ff87d7f307fbb783f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141558, "uuid": "0b4a2d5a-2437-4189-9f3b-39b848a3ebae", "comment": "Malware payload (NanoCore)", "value": "1068c85112208f0175f477e1fe04c675f26577046b0ce89265164874336e7135409bc4efbcc590a456b8f8d8bf61a435", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141558, "uuid": "7c948209-f384-4157-a976-3b3a03cee7e0", "value": "7C658CAD325072EFC867CDB68A681C64EB50706B430BD243A46316ED9E8D9DBDF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141558, "uuid": "4fd63fa6-f1ec-4e71-b818-7cf72a060186", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141558, "uuid": "5224ead7-8cee-48f4-88fd-dafb4853d87e", "value": "24576:POgEh3PniveXZtwGoeI/r2RB3IGmZiAe4G1y+9inUO8KtYVvuulhj:J8PnyAOV2RBpkiAe4G1b9y8tuuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141558, "uuid": "b84a9ea1-8018-4847-a4f2-548e9c00bac5", "value": 1494528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141558, "uuid": "81c0a917-9d3e-4a8d-9de6-e5403b69f0dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141558, "uuid": "fa4bc8f8-e906-4786-8cea-222bbf31aa27", "value": "5bcb9ac769b8c069e202b42b16773af7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84feaab8-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141477, "uuid": "9726103d-ba60-4835-9892-80d0515034c9", "comment": "Malware payload (RaccoonStealer)", "value": "009f52060f96a31fb59d59c6e04e3ab2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141477, "uuid": "0c86c17f-f0f0-42d7-b9ed-8a36d864f1a4", "comment": "Malware payload (RaccoonStealer)", "value": "63c23f97de981999a831703aa177faca731dcaee30d18652a1d3fce730f2e40e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141477, "uuid": "75ebf863-f668-4a15-b7ce-72b9c42db5f2", "comment": "Malware payload (RaccoonStealer)", "value": "1e5e981e9ca0a89f4daebe4e22d8b1199650ac08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141477, "uuid": "1d8aa4d5-1414-49d2-8999-2943f5724a23", "comment": "Malware payload (RaccoonStealer)", "value": "0dd69f46e9267542321e733d536cdebe1154a0554edf96471658df7c94c64bdc1749cca51fdb7d80754e2d656e2984d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141477, "uuid": "440f45bf-870c-491f-9054-983b8d6f02f5", "value": "04C4DF206690C038F1B7E6B54874C2B9A72A7DB2F73480CF62D537EA56346E4AD30767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141477, "uuid": "d9f35215-5f69-4ccd-b6d4-b090ab9ccb82", "value": "bca4c139115857ba195befba3c3bfd5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141477, "uuid": "079ce6c9-faf1-41bf-88e6-606cc9f8f059", "value": "12288:WzQ/UVZdRHBQsAdxkXZatdEVQwQZj3yUit+8Gq:H/0HodGktdEOwIby5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141477, "uuid": "3e026e69-e75c-454f-98fa-eb7040178e1f", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141477, "uuid": "830480ed-5b34-480e-b884-a38a4da63786", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141477, "uuid": "9041b99e-f19c-4404-95c0-44630fea6d74", "value": "009f52060f96a31fb59d59c6e04e3ab2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71434146-becf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622108373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108373, "uuid": "084bf6c7-c290-49bf-812f-167ead35d4ae", "comment": "Malware payload", "value": "88af65ad6b23ee2f9745ddacff604748", "object_relation": "md5", "Tag": [ { "name": ".mo2", "colour": "#83CB3B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108373, "uuid": "c8fed65c-9ba1-4c93-98d5-9609c41cf4e4", "comment": "Malware payload", "value": "641156d7dcbfa28f469a4df5e49c46efd4af299d418324cf108aa50aa7d7f2b0", "object_relation": "sha256", "Tag": [ { "name": ".mo2", "colour": "#83CB3B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108373, "uuid": "e6a3ad11-61d0-4210-8c4a-8befcb0d42bf", "comment": "Malware payload", "value": "7636ea6f26c50379256b2507b7c21ecf45ad1d80", "object_relation": "sha1", "Tag": [ { "name": ".mo2", "colour": "#83CB3B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108373, "uuid": "0793f352-a910-4ce7-9b7b-033958516ada", "comment": "Malware payload", "value": "01afc23df79c1c9f4a78544f4eafa2e05c76c1e53d06a98f3dd5ada88b9428346fbed53b520357dd5fb3e93973a3133c", "object_relation": "sha3-384", "Tag": [ { "name": ".mo2", "colour": "#83CB3B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108373, "uuid": "73d62d93-2a52-47e8-aba4-6c1ad9c068db", "value": "81B5AE2EB249603ED86A7A3A5D76D340593B7B51FA37EE170BF0494E8F258005F3A607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108373, "uuid": "4f895040-dcd2-456b-baa8-d5d1d6f7f5a7", "value": "478a34656a534fbe7cf15c441e714c1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108373, "uuid": "bd718738-2860-48d3-85fd-043f8f3f3036", "value": "24576:29hQ8C9v6GzcSVh+fSXCi/Q5ZAi2JXbAa5PVtFqDaujMhPl6mfWIqvgVT6ppT:UqweDaaimr95XcDaujydPWIqoVT6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622108373, "uuid": "e9a3cc59-cdec-4927-9e39-cdc26673bde9", "value": 2339328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622108373, "uuid": "831417dc-d36a-4ff7-b2f1-64adad72dffa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108373, "uuid": "448371b1-ec1b-4355-a381-818099ccce64", "value": "641156d7dcbfa28f469a4df5e49c46efd4af299d418324cf108aa50aa7d7f2b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79dbe3ad-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141458, "uuid": "e3798523-5511-403b-a22b-00602d843e2b", "comment": "Malware payload (RaccoonStealer)", "value": "2ef9b7b5c62441ff5e0fbea7ca942d58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141458, "uuid": "be30f5c3-e213-4f7c-ad75-e80f327cb03e", "comment": "Malware payload (RaccoonStealer)", "value": "64235e51086213450cae9ce6d0bba737e14366085d97114e5c5765bcbdc7ca39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141458, "uuid": "3df81f8e-ae8f-49de-bffc-514b84e26adc", "comment": "Malware payload (RaccoonStealer)", "value": "0a9d3c1353fc03e218764b948afa013137a8b284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141458, "uuid": "b5a993a1-bd1e-4078-ad73-01bf455a9110", "comment": "Malware payload (RaccoonStealer)", "value": "20afcbc87b739a939d04bd5f39f0b0a6e68b59f57cfcb783f95ed03773de15cd4a1cfe22837c9b2f7b3d5a802b142365", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141458, "uuid": "2b08f276-0555-4d7d-a9bf-b7a84fb2c41a", "value": "37C4DF21A6E0C034F5F316F449B992B9A53E7DB2A77440CF62D077EA46356E4AC30B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141458, "uuid": "9e2cc9e5-045f-4694-85b1-0c88cecbe917", "value": "556bc424bd608c9e064a122699e67eca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141458, "uuid": "d85fd9d5-7834-4d02-abe8-39df52b3aa16", "value": "12288:AXTTNnK/F9AAxQitm8Dv0MsN1DQmNOtVPJxzT3nM:CTG9kitloN1OtVBxfnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141458, "uuid": "d3075346-7f60-454c-a0ac-fe40ffca9715", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141458, "uuid": "a9ec47a6-9fdf-4193-9b5a-1618709f6b7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141458, "uuid": "2e6590d8-3865-4c5f-811d-3f3277e6cc54", "value": "2ef9b7b5c62441ff5e0fbea7ca942d58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6c3564-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141542, "uuid": "c74736fb-4086-4c96-afea-602e0fda30c5", "comment": "Malware payload (RaccoonStealer)", "value": "0ecc502fbc08507870426a87cbf6c24d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141542, "uuid": "819be963-570f-416c-99a0-7baa87be155a", "comment": "Malware payload (RaccoonStealer)", "value": "653d9d0ae06efd8ebb84a079bb7024cd5d2faa497c780ecc2b642f4c3b782cd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141542, "uuid": "0b91137b-70ef-46ca-b9d6-d5e5f1873d1a", "comment": "Malware payload (RaccoonStealer)", "value": "57d4e118930bd2aa61eed73aeb71c268f8996707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141542, "uuid": "edde0575-0435-4549-a8c1-34122e231285", "comment": "Malware payload (RaccoonStealer)", "value": "c38bb51f6db98fb4aa5fdc0d6562d3f055386de9169c2018bdec34a34376b9343a26aaabe437f83ac741350cbf461146", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141542, "uuid": "28c6f655-079e-448b-a438-4c877991b33a", "value": "9CC4D0307AA1C035F0F792BC4A7A82B4A53A7EB1E734C0CFA2D52AD956759E49C34707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141542, "uuid": "fe6f9369-e310-4572-bf0a-d4c05c041627", "value": "cb971fcf399235e4e9a69622d3809fcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141542, "uuid": "beb45db2-7217-4e65-8274-6ac62cf4f367", "value": "12288:n5B/4BLs0xfe8uD+UNzyLxIWpDREJVgjmd/975pO:n5BYLwLNIxIWYJV+EnpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141542, "uuid": "e9638ede-754c-42eb-85e8-ea9606e0bea5", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141542, "uuid": "2928afed-d044-4b19-bbcd-3b3611069419", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141542, "uuid": "cae67250-5d52-44c4-bc7a-2d99b49f6342", "value": "0ecc502fbc08507870426a87cbf6c24d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2995a50-be93-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622082766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622082766, "uuid": "ecb6c83c-f57d-457a-9150-589cc948bafc", "comment": "Malware payload", "value": "20e294550d8ecb2fd0d35bbf6699270f", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622082766, "uuid": "c8ab1ada-bb92-479d-abff-37ea13a40723", "comment": "Malware payload", "value": "655aacbfffcf86da4ba43425afdbb312448103ea4b07aa95ade459a4dcc4ace8", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622082766, "uuid": "8c2c9536-d73f-4b13-9f27-941310c4b6ac", "comment": "Malware payload", "value": "3b7fa6d98b876d60014a421b2e20e8233934ddf0", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622082766, "uuid": "6f663864-dd8e-4fb7-9090-da404aefc6c0", "comment": "Malware payload", "value": "30490458cb1a479cc575d19ae98d45822c8eb86d8581ecc9fce2ffecfb7a2d4d481e08e6487e10328de36f7116f14cd1", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622082766, "uuid": "71ce250f-7889-48ca-89ae-30c7913a9d1e", "value": "F9F059341290EBD1415482C9F2B99C02E044814825F7F4FD53FDCCAFF04E9496494D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622082766, "uuid": "adb1865f-8701-4995-9672-e5630deaa989", "value": "12:NyDvqpxuP2rFqLQaf79VoyF+aCTPGeTzvuDvG:oDvoxu+rFX479uoadzuTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622082766, "uuid": "da36a80b-e67f-42ec-ba2f-66214728c8a3", "value": 500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622082766, "uuid": "1ed93aec-617b-4189-b277-08dc1c7cb5a8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622082766, "uuid": "23e697fc-55f8-4716-9b4a-4521dcbf7e96", "value": "wfRDBs78.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860c16a7-befb-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622127305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127305, "uuid": "5bb1da35-159e-4727-a357-5430236793ae", "comment": "Malware payload (NanoCore)", "value": "556a1d40236b48bd1a3fc6727ede4126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127305, "uuid": "36c3d992-973b-422a-9696-dfa32b67cc3e", "comment": "Malware payload (NanoCore)", "value": "6770e6c3653abbf8fe799204370675eef66e04f52712ae83cdba1df508755351", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127305, "uuid": "5a5e1ba8-11e5-4a43-ab7c-3aca6a7899cb", "comment": "Malware payload (NanoCore)", "value": "47296cdb993ed8e571ac74483c182063627828a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127305, "uuid": "3c0b4591-85c4-49ef-b7d3-f1e0b36ed961", "comment": "Malware payload (NanoCore)", "value": "947e50d9df3cbf6ee1be5a1161ccc0197b16f56efdaafee3d006e1c5e3b157b2df60c6b40aa50b387749190111b05a45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127305, "uuid": "98b652b9-1dd7-4224-8f99-13b73a6607ec", "value": "DB15E026CE858EB9C0C819708531275A3FA76EC19973D6CDC9C9F87D2837398A27917C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127305, "uuid": "d1be7c6e-83eb-4fde-8639-521fc0fc018e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127305, "uuid": "be216b62-0904-4188-a667-17bd4cc4f0c9", "value": "24576:x074FFFlONmjSfOHIXig/gqTNCrGrWJSh3n:C74FrUNmaOvgeyH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622127305, "uuid": "8dd01a50-0a16-40cf-a468-c1cda4d9c8c9", "value": 935936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622127305, "uuid": "5cc9d885-0bfa-419d-9420-fafe26492668", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127305, "uuid": "85156b84-f8d4-43d4-bf25-04cc54dbda31", "value": "Payment Advice Reference No SWT005262021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd6233a-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1622141415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141415, "uuid": "9e7b0781-5824-4127-a05d-f4a77815c1a8", "comment": "Malware payload (Adware.FileTour)", "value": "a7cb4a676cab7532471fd9dacfa5778c", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141415, "uuid": "3bac1665-221a-4674-8c6b-eb7edf4efb84", "comment": "Malware payload (Adware.FileTour)", "value": "679d4240ec3562404c1222d91bb2594cb90843b5aec479ce75bd47d4a4e8b780", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141415, "uuid": "c872ef7f-cec1-4a06-a846-fe3a6a72a045", "comment": "Malware payload (Adware.FileTour)", "value": "c67ab56c6d851e3feae04261cbbd31c667448079", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141415, "uuid": "9907449b-3cc1-47de-8be5-082b6a54c047", "comment": "Malware payload (Adware.FileTour)", "value": "94c648bd59d1d760f8905707b938ee6b77bc506e8c613c749e27de4f65b539345e5771c7bbb471b5c6c3f3292e6e0c9e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141415, "uuid": "77ba3d47-f2e2-47ec-8a80-b4c38c0545df", "value": "C1F5335132F284F6EA91057139442F7295FDC3D997308AABB3A4D40E5F7AC43723A68E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141415, "uuid": "98faefaf-584d-4b40-9701-4e31e8d40722", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141415, "uuid": "967d190e-b3ae-475e-acb3-2e77fbf1348c", "value": "98304:xyCvLUBsgqEPkbbFt5YVI7+5EpXLzYE4O1LJR9nqv3Y:xDLUCgqkm30I7IO1lso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141415, "uuid": "06ebd281-927f-4f50-826c-de3c656d5011", "value": 3384269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141415, "uuid": "66f6cacf-1cc3-4b76-9864-19cb2d6e8c74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141415, "uuid": "8a935af0-d984-4b59-861b-904735559191", "value": "a7cb4a676cab7532471fd9dacfa5778c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666cff23-bec5-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622104060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622104060, "uuid": "e3ff9137-2175-4c87-921d-6a53d1628f36", "comment": "Malware payload (SnakeKeylogger)", "value": "9211f3a0c96486c6e2aff73c41b978f0", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622104060, "uuid": "cdda0fc1-06f0-46c3-bfb6-442d1287a0c9", "comment": "Malware payload (SnakeKeylogger)", "value": "6c19d8013e570ec3f08e019844ddfc64f1aa1a7f03baba9bc04850a2e10b6c2e", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622104060, "uuid": "3b07d6a4-b2df-47af-998f-e809f25be086", "comment": "Malware payload (SnakeKeylogger)", "value": "e8f99a92499eecb5d0920871a10e1328f95518b2", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622104060, "uuid": "830d80ae-8fd1-4bf3-b169-ab5b2b2accb4", "comment": "Malware payload (SnakeKeylogger)", "value": "572f4f45d59e166e8a39ebd602e8fd831a34acc2559fa8f7c9d3957bd0e13f0235e5154d8c1adc161fda9b1e2ee1b799", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622104060, "uuid": "2b742e60-00cc-4594-bfe4-37ec63f82ce2", "value": "6B15AE2C652EF512D2ACC27E86C5402BE690D7337072BE2AECD7179C5719E817D8227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622104060, "uuid": "cd004c08-dd4b-4f8c-bd87-c9d6fa3bf839", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622104060, "uuid": "44dcc4bf-3a89-46fa-8116-0bf4f958e48d", "value": "12288:+gp1WHMDLq3zpFCvN+9HcreBxFIsT0DE2MSc+nTwt+kWuy9h1w9/xOMZeqUd:peMDs+v6H+elIsAo2TdTwh5wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622104060, "uuid": "c4f691d6-6560-42b6-b7a6-42c278abd228", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622104060, "uuid": "03e7556c-305b-44e9-ac98-befed49271ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622104060, "uuid": "a29dd70b-6ba0-4d3f-982d-c8352027f4f5", "value": "j1eDrO8nClIkdBK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b035e0fa-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1622141550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141550, "uuid": "07618e79-6545-42d6-acd3-875f7c29c1d7", "comment": "Malware payload (BitRAT)", "value": "b36ee35c3ddd854fbf837224e7c5d39b", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141550, "uuid": "aed9c580-2dc9-4004-ae6c-c444f63f80d3", "comment": "Malware payload (BitRAT)", "value": "6cd85d78caec047483007ee54b8f4cea13d29c648b7f4bd500ce199f360f1518", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141550, "uuid": "549b1811-9192-47fc-98cc-88d167cc09c9", "comment": "Malware payload (BitRAT)", "value": "59f051e35043c95c2f9bdbc30ef063a429fb0556", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141550, "uuid": "aa604f90-41cc-4d88-9957-c6236cbc2312", "comment": "Malware payload (BitRAT)", "value": "b5d9a3499360131a32a0ebd0bbac2baa4c881a58df179b1004299974a8b0b22c66ad27def81e6b4129dc37976bbeba26", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141550, "uuid": "292bdedf-bcd0-4854-a09e-f58fdb6880ca", "value": "1136E017BC4C7D8DF992BAB62C8976196810FC34F628079B34C1B919E4783A7B177329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141550, "uuid": "2f4360bc-4cb0-42bd-afa7-4324894205fe", "value": "eaf850221ebb92188ccb4c061d41387b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141550, "uuid": "4c542a4c-e1d1-4db1-97ca-ecf6041930ac", "value": "98304:kuhltpKoekgG3MrkuiWgAPjD8fe9wK9f7yL5:kuhluwcrk2P0W7xyL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141550, "uuid": "103ab2e0-8587-4366-af43-3d679455c464", "value": 4933833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141550, "uuid": "2e67c3b0-2883-4d95-bdd4-7073ccdbf6fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141550, "uuid": "c62cd45f-1720-4236-b478-a03fe8e865fd", "value": "B36EE35C3DDD854FBF837224E7C5D39B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6530c2-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141543, "uuid": "b4473af4-a84b-4ae9-899e-821732fad613", "comment": "Malware payload (Stop)", "value": "da986f2250c0062dd68fba7b48ab2fd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141543, "uuid": "7fc00e87-b19c-47af-bb4c-ba92c7650ca5", "comment": "Malware payload (Stop)", "value": "6f5acfb8f190613df4d40c040feb6969db6f30f58f2bf9e41e777a5a88230022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141543, "uuid": "0ffb477e-c162-4c4b-aad0-1c6e44e84c73", "comment": "Malware payload (Stop)", "value": "f6da0bfb5364976d19df1eaa4448516235615f3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141543, "uuid": "c20d7514-fe33-47cf-b892-75581d4ff884", "comment": "Malware payload (Stop)", "value": "9a10090fb423c4a8065e558c92c8989013f5ba88126980833764690d521653d4e4e1b20f11937b256a6e43b170777ca2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141543, "uuid": "25ce77aa-253d-4ef0-95d0-7f4058ef1a29", "value": "4105F130E7A1D43DF0B712B449B682F969367EB1973880CF62D53AEA16346E4AC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141543, "uuid": "3075dbd8-7dc0-4068-a706-e46b83702b8d", "value": "cb971fcf399235e4e9a69622d3809fcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141543, "uuid": "1af5323e-58f5-4172-8fba-56322cb9bae6", "value": "12288:KrB/OPxsRL6oMCVCec+OzQ3wHu8iZtJ8R6qG0hk3F/48fJBt+IiFfVBq:KrBUxWpc+FYzBR6F0+5NfJ/wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141543, "uuid": "45a58bc9-3b37-4e27-b42b-618cbcb24bea", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141543, "uuid": "42b69f6a-4943-4ac6-bfb3-d53a34b51889", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141543, "uuid": "57209692-e062-4109-8e28-cc7c14915cbf", "value": "da986f2250c0062dd68fba7b48ab2fd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca66668-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1622141570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141570, "uuid": "3abe94e9-a43f-4a1c-bac9-e0d4aa315c8b", "comment": "Malware payload (CryptBot)", "value": "92eeeb6da1f2a89c5bc01e361e401aed", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141570, "uuid": "d3d3916d-c1db-4c41-859f-0249b5d5b3f2", "comment": "Malware payload (CryptBot)", "value": "6f8ce60168331070f8ca906c9c5e4d53e22b9b72a57c6e0c65bf6f83979d310f", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141570, "uuid": "0961436b-dce2-46dc-a434-f3ab1e0dab98", "comment": "Malware payload (CryptBot)", "value": "613f0eb70143fde27f3911c467e1cd8f6c80767a", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141570, "uuid": "a8a6a727-853c-4476-ba9d-5303f2be7ec7", "comment": "Malware payload (CryptBot)", "value": "b1737bee42f64960b96566cea3ca1149b838264da556c3837c1f037e37f6db0eff7290eaaf5035022db9e9f1ccfe884a", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141570, "uuid": "fee5b88f-3e62-44e9-969d-bd5c4922d5d4", "value": "34F4F130A6A1C034F4F312F459B68278B93ABEE16B7480CF52D236FA56345E5AC31B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141570, "uuid": "cc25e796-e68a-4587-947b-443aa0610e2c", "value": "a26f0e6bd2952037425bd22d2a7efb64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141570, "uuid": "0fec6b4f-33e6-4b72-90cf-0566d47d01af", "value": "12288:jp7D2EJneXC4qviIi2wOeyqObbiApaYhuEUzzCeyNrkZGlwXfE8gkdxCKqo:jpGEJMD3O1npo9CZIZswM80F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141570, "uuid": "88fefc34-f045-4680-8cd6-f2977488e1e2", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141570, "uuid": "2d5ebf36-c0d0-4b5d-8f01-0811109dfb65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141570, "uuid": "475e5f5e-842d-42be-bf1c-86296e53f7b6", "value": "92eeeb6da1f2a89c5bc01e361e401aed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8132a08b-beea-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622119996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119996, "uuid": "0d737ebf-9909-4934-b0e9-7cbf9067ade8", "comment": "Malware payload (RaccoonStealer)", "value": "67259d94f72d8dfc13272733bac0b5a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119996, "uuid": "f46cf6da-2986-47f5-a93c-0bb076373f6b", "comment": "Malware payload (RaccoonStealer)", "value": "713b5945d12292a726db22b9b96c5affa7278ad4a11a473ba217444fac7443d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119996, "uuid": "a6bd41f5-f84d-4038-ac03-0430dfc43369", "comment": "Malware payload (RaccoonStealer)", "value": "483d959aec534a4abd675788867e57462a8647c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119996, "uuid": "4d00243e-8684-44e9-903e-289f4699bba5", "comment": "Malware payload (RaccoonStealer)", "value": "64220389396e7bfd69dc0b72854586f669f8cea17db73c1e49c64432f4110b211eaf0275b29cec06250ced12a9d162c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119996, "uuid": "c7801fac-b023-4ce9-8a09-7d55260fe6e1", "value": "BCC4D030A6A8C0F4F4F326F549B582B8A53A7EB2572460CF72D527FA56346E4AC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119996, "uuid": "d378c19d-1266-4330-bd1e-6d4761c3a9bb", "value": "556bc424bd608c9e064a122699e67eca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119996, "uuid": "12604ee5-f5ea-4614-acc6-736a5ae87a94", "value": "12288:4rTTtnZfA9gAqNy/YSqIhOd50JqtkqlR4BpdUFq:STU9q6Y3IhxYKqj4Bpmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119996, "uuid": "cb9121a6-706a-460c-ad62-b0579ab2fffc", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119996, "uuid": "87479fdf-437f-481a-983f-592cf728258a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119996, "uuid": "dd604030-90f6-4c11-94e1-1f394400acc9", "value": "67259d94f72d8dfc13272733bac0b5a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f07145d-befb-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1622127321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127321, "uuid": "c3f56758-22bd-4cd3-9033-7cfc858517ab", "comment": "Malware payload (IcedID)", "value": "7722dca00b9dedccb241e833632d0b50", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127321, "uuid": "8fabab4d-1393-4374-8c70-aad463192f44", "comment": "Malware payload (IcedID)", "value": "71bc262977cf6112541d871c3946ab6112d64297ef5f88593a3eb0f8658a985b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127321, "uuid": "273f5fbf-08fd-4524-b34b-1f139948e619", "comment": "Malware payload (IcedID)", "value": "98d646419c927f2eccacabdb2d63f8d60add5eda", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127321, "uuid": "be98f95c-8f5b-4865-af5a-21d5022e9506", "comment": "Malware payload (IcedID)", "value": "6a35a35beb18e0139ae242702b9c445dabaa7db39e38024774fba5aeaca13b7e088b2100de46aadfa76ef3ba156d59eb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127321, "uuid": "3777370f-dcc1-44fe-b775-e0ea75d2a904", "value": "FD033A94EE5E4F72F81BC9B58135BDBAF8712F223B00017D316EAA860914276DF9152F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127321, "uuid": "fd3f5213-8184-4d0c-b7b7-f7f133061465", "value": "768:jN2tSDk4s1dmpiTD5w9CwGiBkHsmiKIyxHO6/UvHACqrn8V6HhX:DDk4s1dWiJwswbkH2VyFO6/Bn8V6H1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622127321, "uuid": "19861e0b-02ce-4486-9850-4da0e8c0aed1", "value": 38527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622127321, "uuid": "a27bbe08-2d5b-4e99-9ca3-7f11ec87d9de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127321, "uuid": "17a0efc1-cff7-4a64-9ae5-d85dd36558f3", "value": "71bc262977cf6112541d871c3946ab6112d64297ef5f8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0bc7a2-bead-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622093707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093707, "uuid": "11dc8983-4fb5-4f62-8180-440ad77deb0d", "comment": "Malware payload (AgentTesla)", "value": "acd4a06396d031d73aff974262089d28", "object_relation": "md5", "Tag": [ { "name": "ra", "colour": "#1E0C4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093707, "uuid": "bdccf47b-4c8f-492e-879f-c163b91af27b", "comment": "Malware payload (AgentTesla)", "value": "724967fff3f1afd19cf882ca221e29d8be21e91eef06835ac2dc9718cb0f548e", "object_relation": "sha256", "Tag": [ { "name": "ra", "colour": "#1E0C4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093707, "uuid": "d5f5a8b3-83b1-43f6-b452-a696a2f4b0ff", "comment": "Malware payload (AgentTesla)", "value": "01da9154be41fde1cb22c2db7eb1b79709e335c7", "object_relation": "sha1", "Tag": [ { "name": "ra", "colour": "#1E0C4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093707, "uuid": "14a9c847-2b79-4a13-961d-354b184348de", "comment": "Malware payload (AgentTesla)", "value": "3eb8f7ef1e53a7e3f63de32674a82b57c0713f2f29dd4f36095236dfb4e394e687c59af7a93af50a535aec83ea6e5e41", "object_relation": "sha3-384", "Tag": [ { "name": "ra", "colour": "#1E0C4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093707, "uuid": "707b442e-b68a-4902-bc29-91581765b592", "value": "3594236E5A9EDF2F500BEC261FB94B4A4D5963F1CAD4E38CC4C4861D3A952069CEC327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093707, "uuid": "3e5448c7-b7f2-4aab-ac0f-4ed07eb8bf7e", "value": "12288:u0+lvX1XqLp3jpXvfXGPFY69NMrmXw/BfrV:yqUP9XMzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093707, "uuid": "4dfd38b4-fcbc-4a93-bd5c-e150fc1cefc8", "value": 415054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093707, "uuid": "fb10e5ce-7238-4bc4-9522-9972e4acf06b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093707, "uuid": "46ff6377-dfdc-44ee-a0a4-ba4be0c32b5b", "value": "quotes.ra", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924add3c-bee9-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622119595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119595, "uuid": "dd3025cd-58ef-4234-9eab-637f7042af44", "comment": "Malware payload (RaccoonStealer)", "value": "cb1823cb85c473874a46736b526b472c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119595, "uuid": "e0b36ee3-0777-47e0-b1c8-ef5ea8472f84", "comment": "Malware payload (RaccoonStealer)", "value": "728147c5bff90b21c7aa0b213108ac3a1dbd8a059c129103b35a206ff9be56bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119595, "uuid": "595aa110-9724-425f-9ff2-5f3af04dc8a5", "comment": "Malware payload (RaccoonStealer)", "value": "a4f47724f3a5648538863111c8cd007a6c54b317", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119595, "uuid": "8cb666db-14ae-4129-95a3-f6cae3d669d8", "comment": "Malware payload (RaccoonStealer)", "value": "0eb9c267b549c00c7d79edb224fc671c5aa6d71a6fc92ffe9ac0f27e3d868e0a4fe6f805c48a9346239e748493d60dd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119595, "uuid": "f193b999-2fd7-4858-9dfa-d00bef7cebf5", "value": "D8C4D030AFA1C034E0F6D6F449B68279E53A7DB1673490CF61D02AEA97345E49C3AB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119595, "uuid": "4b0417e4-7168-48ab-b7d5-bbb3091b522f", "value": "0693a6a9ad49d4475fdba0f7412d435d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119595, "uuid": "c29f1700-9ef1-40e8-83d2-1d3b07d7fc36", "value": "12288:rvCvaL1ghBgy16byzsLCRvm9h7gkagT2F8jlf:rvjL1JQoCCxgkjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119595, "uuid": "c21e501a-4e87-48bf-ae86-9a7b3e2bb497", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119595, "uuid": "64aadf4c-e780-46c3-aaeb-d7af52a5e1cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119595, "uuid": "b352a14c-9d77-484e-b2c6-2cc5bf7bdc33", "value": "cb1823cb85c473874a46736b526b472c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b54fa0-beea-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622119785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119785, "uuid": "492445e0-33c1-4fa9-928e-1ed5a72e51fe", "comment": "Malware payload (AgentTesla)", "value": "bf07176e5f6df10c7ce89d09f5932271", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119785, "uuid": "9f015fb2-0e9c-49c1-87ed-c6b337393d34", "comment": "Malware payload (AgentTesla)", "value": "7298df351a841a547a7decd0dbf6580db3b3cbc5d4eb4958d34d4a0dbbed15a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119785, "uuid": "a2a06bb6-3ed7-4ca9-84c6-d4d5bb9a81b1", "comment": "Malware payload (AgentTesla)", "value": "35831913791e5eab9a5d7e99c3a6067cd8aa2d1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119785, "uuid": "5348313b-3afc-4dbe-9e1d-e35c76591cc1", "comment": "Malware payload (AgentTesla)", "value": "25c893240994f6196aec732bdd3eb14a61fa9b66647be2bc260fb3ace31a53c1e1ca02c799cfd264351767311f3673b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119785, "uuid": "bd921f34-53c3-4ca3-abb8-948f5233376c", "value": "6D850791B1DEA44A3273BB0B4BF81520DE4F3ED1807E718FE6698967DA05E5910F0B78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119785, "uuid": "ba1ab0d1-b172-4cef-8bc3-6220fccff2fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119785, "uuid": "88fe63d3-a8cb-4d69-b4a5-4510c566fbe4", "value": "1536:IjWUOM0L28987Up7HQ8eL5e+ubYlEKGJE7IEyvwtEdE1E18EvHK6xYwSFrElb6Z/:gWUOM0i6CUeS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119785, "uuid": "ad6d0897-8afd-4bd6-a95a-2d669963d391", "value": 1849040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119785, "uuid": "914319c7-02f7-4554-8de3-aa89d512d729", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119785, "uuid": "7644711f-2915-41fa-819d-6f2d57887c11", "value": "bf07176e5f6df10c7ce89d09f5932271.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5d2240-befb-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1622127316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127316, "uuid": "e7abb686-a1b9-44ce-a06f-2aac3b8effa1", "comment": "Malware payload (IcedID)", "value": "12dbad057ef151f9f814185f54a89abc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127316, "uuid": "bd5a9ad1-e28e-4fa3-a77d-d1d96563abfc", "comment": "Malware payload (IcedID)", "value": "72c8db337dc04e4bdb1c840e81a4ecee5b1bacd328bbbcb049ffdda8ea3a22ce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127316, "uuid": "2110faf6-e30c-49e1-9ba1-0f3f97ccd4c6", "comment": "Malware payload (IcedID)", "value": "33cd525479d198933fa06ac885ac676e0a07cf1b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127316, "uuid": "b3183fe8-1e61-4ad4-b3d1-881829fb73f5", "comment": "Malware payload (IcedID)", "value": "8dabb24aacd17cc6ef7d660bf23776cdad8c9f752d817ffc10d24b9e1317abdcd846b853279596a72cd985d581c63ed1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127316, "uuid": "b896f644-c52a-4cf9-adae-ffee726b60e1", "value": "D0033A94EE5E4F72F81BC9B58135BDBAF8712F223B00017D316EAA860914276DF9152F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127316, "uuid": "f3c47ccc-7f88-4aa9-bb91-a2a1387aa315", "value": "768:jN2tSDk4s1dmpiTD5w9CwGiBkHsmiKIyxHO6/UvHACqrn8V6HwX:DDk4s1dWiJwswbkH2VyFO6/Bn8V6Ho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622127316, "uuid": "c1f1772a-cf85-4180-87fc-3c18b576e2c8", "value": 38527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622127316, "uuid": "c1a49e51-04d8-4771-85e7-f2b677475a4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127316, "uuid": "2fde5c7b-d294-44bb-abe3-2055f058ea96", "value": "72c8db337dc04e4bdb1c840e81a4ecee5b1bacd328bbb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7df8610-bec1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622102559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622102559, "uuid": "953b903c-f343-4550-9184-da84b5e03095", "comment": "Malware payload", "value": "d9a7eca4e2a66f9712d3b22be7c3d526", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622102559, "uuid": "7f2f3a47-06e1-44b5-8e62-9ee4b17577e3", "comment": "Malware payload", "value": "73c87250c77cdd1b25c4cd3df3d76324a6ac972c67583b5fb2c004f28ef13568", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622102559, "uuid": "d336aa60-9ae7-4eac-a735-c1aa8bd5896b", "comment": "Malware payload", "value": "e09aa154d75640cdb6c598f18417d6176dbc98d1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622102559, "uuid": "005521f7-aba8-4350-a78e-2fe1923c180f", "comment": "Malware payload", "value": "51953073c367bb90cb5a83fa96ff753ecd187999a7517c791b90bc0ea1209dd347e1c86afb2f453fffd8d0ac2646db9e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622102559, "uuid": "7615d7ce-3b1f-4604-b89d-d258103c8aa3", "value": "BCD3189BFC91DE6946C0277BFE2E418A331327B4D1DF71139D041F28B68A94F0E6A652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622102559, "uuid": "db2c3777-28c8-4268-b5d6-51f7760a572d", "value": "3072:T2s/ITo7WCkybotgsJ913DhrbW4UYSx7QpUiB5IQggEuaJhn2:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622102559, "uuid": "52e5d32a-c205-49bf-806e-a435db3fa603", "value": 131180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622102559, "uuid": "5ab5c802-6e0a-452b-8b4d-bb770836131e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622102559, "uuid": "95082694-6541-4c73-beed-63b365d76c2f", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df0d339-becc-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622107132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107132, "uuid": "4ac30050-f44e-4dde-aec6-4b96dbacf79e", "comment": "Malware payload (Loki)", "value": "cbde459de35369990f9226c78b91a5bc", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107132, "uuid": "2decf98b-8163-4540-bf17-f11131c4b297", "comment": "Malware payload (Loki)", "value": "74b2e947d4d5f2322822c5cbbdff0356bad9ce9ea1bd60abae0cc33b78398bee", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107132, "uuid": "ee80c5ab-3772-4c97-ac9e-d074d155faad", "comment": "Malware payload (Loki)", "value": "cf59cc0c4c4bde4b40149cb181a1ae26b282520a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107132, "uuid": "9c518f3d-de75-43ff-81fc-db0068ae3c0e", "comment": "Malware payload (Loki)", "value": "143fa1cdf16654e5eebe282db5427a405e96ac3cb73be876257e2bc823a8f5b79f419e5cc6f325a14e5553fe5827d2d3", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107132, "uuid": "ba60fb31-ecc3-43b8-b75b-e9e2b37a4288", "value": "09F3019F64D098A7F49B8A720977DF2BE3B3FB1422384347AB6C0FBE09211C79515285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107132, "uuid": "ca5dec3a-7594-4355-8d42-231b19c96a8f", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107132, "uuid": "497d061e-3b4f-4523-a30b-dc01612ee3b6", "value": "3072:8QIURTXJyMNE3SE4DRTeaYCVOoOszJvDJebXGTlORFJkX:8shNE3SE+TeaNoozzNDsbWTlO/JkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622107132, "uuid": "a3ce2e91-8869-4fad-9696-7804fef898cb", "value": 164057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622107132, "uuid": "0b3428d4-3528-4371-a0b9-449a359331f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107132, "uuid": "99140436-33a0-4e70-a308-ea7a5e92c52f", "value": "dar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db13929-befb-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1622127318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127318, "uuid": "26b9be61-0895-4b51-a973-6fb33a7554c4", "comment": "Malware payload (IcedID)", "value": "17aa0c643e4b55855f1ff1ed626e2271", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127318, "uuid": "59f30429-e46f-4ed6-ac32-60f2623416e6", "comment": "Malware payload (IcedID)", "value": "75b228968195fe08af23cefc88ec6d35a33347c4774acf38d41bc38d61f9f32a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127318, "uuid": "5e20b6c0-b87d-4c9d-a20f-82889e3a6846", "comment": "Malware payload (IcedID)", "value": "1302db39a5d381f0a47560abaa8bb71285a77e4d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127318, "uuid": "584a2fcf-7e7c-40d6-a64b-070d3a18b25c", "comment": "Malware payload (IcedID)", "value": "4c54824cc6b7cb7ba4eadd7e768d17ae856f72336e555807a48fedfa6ad9d15f3111ada40f965a2a275f913e1d27a3c4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127318, "uuid": "dd08b524-9326-4269-acbc-6f63756c03c1", "value": "23033B94EE5E4F72F81BC9B58135BDBAF8712F223B00017D316EA9860914276DF9152F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127318, "uuid": "1582cc7d-76ac-4cd1-a748-e4b215338c12", "value": "768:jN2tSDk4s1dmpiTD5w9CwGiBkHsmiKIyxHO6/UvHACqrn8V6HrX:DDk4s1dWiJwswbkH2VyFO6/Bn8V6Hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622127318, "uuid": "37fa402b-c794-48c9-97d6-740e0d49a33f", "value": 38527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622127318, "uuid": "0fe920df-1052-4f76-9ec8-b42e9e107482", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127318, "uuid": "3ef63f4c-c421-4837-bfd0-5ed464cb4d73", "value": "75b228968195fe08af23cefc88ec6d35a33347c4774ac.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34606d3-beea-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622120053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120053, "uuid": "13d892a5-fd28-4904-a420-1764bc36ab12", "comment": "Malware payload (AgentTesla)", "value": "6f7dab2799b7f32da668e6725f38f3f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120053, "uuid": "7bc9a30c-6fa0-41c0-89e1-820d9f11a3bf", "comment": "Malware payload (AgentTesla)", "value": "76c62f1e40aeb26bd5bbcf40f7f73894316433e9bb7c577ced6c266d9ff72344", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120053, "uuid": "1007f26c-0fc9-4414-85cc-2a1ed2a5b89d", "comment": "Malware payload (AgentTesla)", "value": "f2437530a0ba10310bf4a28e8f987e09d2150179", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120053, "uuid": "b2764d5c-fa38-4fe9-b8f0-fedb5d031b63", "comment": "Malware payload (AgentTesla)", "value": "92ed116a322d09204a1b91b77b0c7c83fd987ef792f2f5ba93bfe0e75072730d5599cf7592ecb54731f1143d9a096a47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120053, "uuid": "ed7b8fed-a251-4d50-be21-f555ba28e821", "value": "12F48C3D26A5472AC179C2B8CDD194236221ED2B7452FE9894D2377A2B73747398233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120053, "uuid": "b5ad188a-a7ae-4bda-a9cb-56a763a6ecb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120053, "uuid": "34a4cb89-76e8-474c-a41c-0b3b79ab4b7e", "value": "12288:SKqggeneB3Rtd6WdBc2Yun97YxTMGCzEl4zE3kXuWVjPQpcwHo/aG/+89vLA0gau:1eB3RtoWdBc2z9UMGCIceejPQpcxJA0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622120053, "uuid": "b4440ae5-8a81-4d49-82ce-ac2be17bb419", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622120053, "uuid": "14256eea-310e-43b8-8f85-868a6e06f610", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120053, "uuid": "6a65cbbb-5638-4335-a59f-8d5137d425fa", "value": "6f7dab2799b7f32da668e6725f38f3f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8228467b-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141472, "uuid": "b8576565-79db-43ac-8218-6956e7f0b194", "comment": "Malware payload (RaccoonStealer)", "value": "f9003a4991f68b4b07e73ac1e89cf374", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141472, "uuid": "58d3c76d-4bda-4501-b427-d2e2d2afc105", "comment": "Malware payload (RaccoonStealer)", "value": "7725783b9c6ee597f0b1017861d4adcc0470de26d10bfe1757145bd44776ea54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141472, "uuid": "3bb4bc6b-b29e-4549-ad4b-1b3d562eb800", "comment": "Malware payload (RaccoonStealer)", "value": "a06abc37c93cd6adb84da3044dd933c3e3e63118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141472, "uuid": "2fb81970-2803-4faa-ae7a-e7dcba8791bb", "comment": "Malware payload (RaccoonStealer)", "value": "88bd9ae43aabeb00643aff01442e729243dd157c4dd2924fe807a0f5b26d693c4a45e526ceff5ac7252ad88af3c85068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141472, "uuid": "42054435-1274-41c4-9dfc-cd74fde3fcf6", "value": "EDD4D13176A0C035F4F711F405B592B8AB3A7DA1AB3450CF52E43AEE46346E4AD32B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141472, "uuid": "a221e776-8c7a-436b-8832-02dfb147b3c7", "value": "928ce6a1c3ed4dc8c4db0816d5ad1440", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141472, "uuid": "f29b7524-08bb-46f3-bd13-efb1de52dce5", "value": "12288:jUdFkl4VCSgNDZ+QkXiTRL4Tlu3oYVolV2VJLCYyU3ZGPY:Ekv0QkyTRL4TlmtogJ5pGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141472, "uuid": "0abfc34c-a332-4b31-a54a-d276868d76a7", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141472, "uuid": "a6ee4ea9-6146-41b3-bd51-434413fe29c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141472, "uuid": "c454074c-5264-44e5-a442-61f1e7653cb6", "value": "f9003a4991f68b4b07e73ac1e89cf374.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f18057-befb-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622127332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127332, "uuid": "f9035299-aca2-4ab2-a87b-9c08c8d29763", "comment": "Malware payload (Quakbot)", "value": "914cd41e0828cb1fd618063110524af5", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127332, "uuid": "f0cf2817-c2a2-4512-8d6a-8e33972f87e6", "comment": "Malware payload (Quakbot)", "value": "77996e15c4943bb27dce0c859f911546d1649602a83d565f6b310fd99575563e", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127332, "uuid": "ea8a528c-1ff4-447a-bec2-21ec439ee119", "comment": "Malware payload (Quakbot)", "value": "da7eec4cb7821386594aee09ea16a3da891028e6", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127332, "uuid": "67e6b4e2-41ed-4c88-99e8-f148f23a23a1", "comment": "Malware payload (Quakbot)", "value": "67e33633a24a0e8f237bd5d9527fc228fe23c6b34841618f5ce8344e54acfbb99e26029c24dda95def022e017a2da673", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127332, "uuid": "5a3572a0-62a9-4f0b-940d-f3f9e8822401", "value": "1F7422BFE28169F4C3358A3FD6809191C264F0E44167732D47DE3528A35329FA99D2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127332, "uuid": "c1fa7900-284f-4f4c-b920-280055d6cafd", "value": "6144:tfMRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNV/:tERMmEv2Bc/nvm8IKABfsYOmauFx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622127332, "uuid": "2a22e5bb-9d58-4a81-bc2f-f3079651a6c4", "value": 337809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622127332, "uuid": "241b23bc-ca12-4eeb-89c4-d3f00228232c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127332, "uuid": "6b27d292-3239-48e4-b58e-b9e0ed8fa37c", "value": "Decline11506288405262021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a315a6-bece-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622108003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108003, "uuid": "d127081a-bbd1-432f-b8cc-e5dc706e02c7", "comment": "Malware payload (SnakeKeylogger)", "value": "224d0b554919d06c6307a62e8a7ba812", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108003, "uuid": "d1162df5-4aa2-4f14-a9e3-3f3ac06036c7", "comment": "Malware payload (SnakeKeylogger)", "value": "782f81875dd8679b6b6385164239eea4de4a1c2353ab7941a640813fac2fa0e3", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108003, "uuid": "e1cd0bcb-c70e-4601-8616-71b80792545c", "comment": "Malware payload (SnakeKeylogger)", "value": "4018caad1ef62bb30b453783c5ea7b8a67a282d9", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108003, "uuid": "ef373a83-df51-4bf6-88e9-287cce768240", "comment": "Malware payload (SnakeKeylogger)", "value": "a3197113f2b8a7ce9ab1175ef6fd8846894d95a5dc7ba906b15d8f7c5a2ba55cd993508bacd8c2ddeb9ccd3f37439e9b", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108003, "uuid": "638e9fed-e493-42fc-b251-b46be75fb628", "value": "10B423D7F916C9E78021F4E19A5836C7CB73892329F50A0079BD25FE56E3B17A0C3662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108003, "uuid": "8d17d820-2fa5-455c-a686-585f406932bf", "value": "12288:7DzcIxAqi2RdEdZMj8a99vN6NaQXekEFPgw9DUnxhqx:IIq2R6kj19vvQOlFYw9DUnv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622108003, "uuid": "8351b962-601f-4caf-8361-583c7c45a952", "value": 516481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622108003, "uuid": "07fc8713-ffee-44ff-a35d-d34c8a62061b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108003, "uuid": "4da6fd7e-9a9d-43af-a05c-9761bfc83576", "value": "Swift-Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5210e252-bece-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622107891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107891, "uuid": "c265b06c-066a-47d0-8210-5c1d1e0d871c", "comment": "Malware payload (Formbook)", "value": "39ec4073836600acee4d25216f358b42", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107891, "uuid": "2dcd0027-d754-49bd-8d48-d9a831002293", "comment": "Malware payload (Formbook)", "value": "788d26d24e830328ddb8538a8125af334df8ac92aedc2801af8df7ed0ba90fe8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107891, "uuid": "38112a96-60c8-48fd-adba-aa9b40879b7b", "comment": "Malware payload (Formbook)", "value": "1eebc2b791c6947c6546dc0f0723c810e82cccba", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107891, "uuid": "bed2d932-fcc2-4ea8-825a-d1cbbbd08234", "comment": "Malware payload (Formbook)", "value": "e2f9a32d3eb259fb1d8a71abefb11d4527c5931dde1c72ed7d28af8d705ade089b36ca2c35ea855a244cb956a881a268", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107891, "uuid": "ac58ddc3-2acf-4bef-b57e-1d868849f26e", "value": "32B423B573825B53AFF6ED339F0B710F469F02ABA552B21510768A3EAE7C53905E81C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107891, "uuid": "8499c9cc-f116-4318-8475-30254ace9ab2", "value": "12288:o5kbWJ/Sc2lMRKZgpRHu9vncUP+nc5d1zaY2AKLeg6:JbWJoWgiuhceJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622107891, "uuid": "9c8f2003-16b6-4a94-8b46-ea3d05af6ae6", "value": 526965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622107891, "uuid": "7efdd0aa-abc4-4897-9132-1bc19f0eac36", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107891, "uuid": "df67be90-db1c-4396-a931-7a9cf6fba6a1", "value": "Pdf Scen Invoice 17INV06003.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d87d4c-bf3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622155144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622155144, "uuid": "bc2a0633-01ad-46c0-bb72-34f98ceda66c", "comment": "Malware payload (Quakbot)", "value": "007f5e3e8d7603261670116fe055de8d", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622155144, "uuid": "216ad87a-f3dd-4474-be36-dc9280fee91a", "comment": "Malware payload (Quakbot)", "value": "78a4834de71628d98384d15811fb92a608f8359e71c329b50c37c0ac45612dc7", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622155144, "uuid": "2a71418f-bc3b-4d0b-9137-77d9f1650bbc", "comment": "Malware payload (Quakbot)", "value": "bf59e6c33c3c7c218a415bace61a5bc9df824d41", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622155144, "uuid": "5d0e08a1-5fff-4835-8f64-641093da61df", "comment": "Malware payload (Quakbot)", "value": "122418cdcf728bd922881a6e113081d041801707a533fe645cd3693ee62a53e92990560f654b51d4ff81743fecc4590e", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622155144, "uuid": "91521f3a-aa22-4e40-9dde-f65a4119e5c9", "value": "7D74127EE2C169F4C3398D3FD680D29082A5F1E041A7732D47DD3928A35325FA95D2EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622155144, "uuid": "097dafeb-ec2a-4943-87ff-59c62878239b", "value": "6144:1wRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNP:1wRMmEv2Bc/nvm8IKABfsYOmauFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622155144, "uuid": "6ec0b4e0-9192-4a75-9431-ebdf3524fbf5", "value": 339474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622155144, "uuid": "c6f9cf48-ba6b-417a-bea8-829a51971bcd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622155144, "uuid": "f6351f3a-b362-4fdf-afe3-fb0b54e391f6", "value": "SecuriteInfo.com.Heur.13775.20323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8776cf69-bf30-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622150071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622150071, "uuid": "42ca9f91-3cd7-4529-89a9-0a9f3e01ed67", "comment": "Malware payload", "value": "c7a7e39812759c47905d1e3b9f0e7fda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622150071, "uuid": "ba7b3749-d9fe-4cf1-9491-412879b67da4", "comment": "Malware payload", "value": "78aa25ab94b4131859051344fed4ba950f47b29dea9123e6b3dbbce8ff9bc453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622150071, "uuid": "b76863b2-c288-4f2c-b594-4ec2a5d26b6f", "comment": "Malware payload", "value": "4a1ac052b57a0e9744f80057ceac70503c4c7ad4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622150071, "uuid": "22f8da51-fcfe-4a71-9962-dc73b8accdd3", "comment": "Malware payload", "value": "5e358334b29cf5cfee176d1f377574b0bc9fdbf417f0c385223b900aa27e9f4166ef7eca14ae26088a95a40de7f455b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622150071, "uuid": "905a4516-0744-4e53-a37e-28ac1cabc6e0", "value": "57A2080ABBB58A15C5FD47BC98B3134447B691878632D74F2CCC14CE5A66EE40263FE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622150071, "uuid": "0c1edabe-9d6e-4dcf-ac19-4db6f9f668e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622150071, "uuid": "4a2ec1a5-0bac-4a6d-8f98-756c1b244f0f", "value": "384:jxLbF4q/x12RjZL5ydhEKrtOMmP++3a5bElszjXuELhnuD:pbFnxYX1yPTj++bSELED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622150071, "uuid": "13249b89-9f4a-4371-8291-4331b1fdc5b1", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622150071, "uuid": "653a5854-2a56-485e-82c0-092621089a0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622150071, "uuid": "6c01c514-ef88-47d7-a49f-cd80a7edb181", "value": "vnAqPYC5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e567f6e4-bee9-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622119735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119735, "uuid": "3a937131-561d-472a-8793-192c110f498e", "comment": "Malware payload (NanoCore)", "value": "5c50e8132488b5392d2f11656c2c3745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119735, "uuid": "ab7df902-f832-4d3a-9573-73a7c1764466", "comment": "Malware payload (NanoCore)", "value": "7a13232aa6568a9f5e4aa0bbc83ff8123517abd0e69b5cbd174ca23fd290f117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119735, "uuid": "81bcf8c6-920d-46c3-8b99-4ab0e07bdef3", "comment": "Malware payload (NanoCore)", "value": "dc7bb10d2510bc9a778ec77a80fd4272fd4f8f78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119735, "uuid": "b2e236fb-e23f-47ed-9176-37b95d7aa690", "comment": "Malware payload (NanoCore)", "value": "df7c24ded2a8ef9fe0852e165084fb1045067ddbe9f1c46147a11975a055b2dd2fc5ee288cbd3d1534b617277bbc2eb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119735, "uuid": "43a87633-4840-419e-a922-942d15bba6d1", "value": "F045CEAE3240F59FD867C9718AA82D70E760B976830BE303645385ADDE4D5A7DF210F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119735, "uuid": "c60e7e0f-3515-4480-970c-5eea6c0abeef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119735, "uuid": "02ac49d1-dc97-41b1-a12b-5ac3a2dd3b54", "value": "24576:koWFdNAkVBWuS4O6IyRfr3hmRaBMbJKmEscQFfDbhlzMeWn:7WFXzs1vBy13cPbJ/lcQF7bhlzMln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119735, "uuid": "f1b44819-a619-49e0-bdeb-febcc9408e43", "value": 1212928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119735, "uuid": "5608edc2-f2da-4332-8426-1019c3ff3b7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119735, "uuid": "a5dfe099-ae59-4bac-a43c-4d0baa612c57", "value": "5c50e8132488b5392d2f11656c2c3745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8347acd6-bedb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1622113557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622113557, "uuid": "a4073757-a262-43db-8006-81367c80020f", "comment": "Malware payload (Mirai)", "value": "50f43047a55ec975696fbaf499f02c6e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622113557, "uuid": "17ce9c8b-3808-430d-8b65-bf8d8f6c2884", "comment": "Malware payload (Mirai)", "value": "7c5771ebfd36078e4db3e00462c44d5009ad25060ebad52a5598836ad2ab4eec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622113557, "uuid": "71fb93a3-663b-4c3a-b483-03f7bf7757c6", "comment": "Malware payload (Mirai)", "value": "594fc081a5f07929b9a34dc87aa2f9c042f27ab5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622113557, "uuid": "e590f453-4926-4b81-a619-546ae5e322f0", "comment": "Malware payload (Mirai)", "value": "6b124f394ab506a715d80b8c005d1b1cf3420526a3ebf99c9a15d799805f6712d4685c8437f93e0e28d01e267815bf29", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622113557, "uuid": "7e8affe6-a48c-4068-b819-143095c7067a", "value": "E3432925AD792E26C0D8B57E11F7C724F2E2220E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622113557, "uuid": "c7ddfc69-e6bc-4055-83ca-b283404b186c", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCD3:eL0AxvSHfymp0xgunvCkV6vTMDauQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622113557, "uuid": "ec5ab97f-d199-448c-a3bf-c7bd9976e32d", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622113557, "uuid": "d245dc5c-b8de-45b4-bd2a-cd100122e205", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622113557, "uuid": "d2d1b5fc-9aa3-4730-839f-c76ad7326fbd", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62e5ade-bf38-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622153693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622153693, "uuid": "d213d6d5-16bd-44ae-9dad-be2e5cf842b3", "comment": "Malware payload", "value": "4e352db622ba84c96ef4b175fca6f676", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622153693, "uuid": "5037332d-7228-4d13-96ae-7778ca52e386", "comment": "Malware payload", "value": "7d058ca16d5d4078964a59ad219820b260ffa903db41d97b071b3bfde3d67ccd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622153693, "uuid": "0eb3c093-dc56-4fda-9c5a-1d23ecce5eda", "comment": "Malware payload", "value": "50ad78bee4a38cea4cd8fcfaf9db4ba81555d17c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622153693, "uuid": "fd210922-7b53-4e52-bf9f-c8badf620a8f", "comment": "Malware payload", "value": "08f170bfce0d54976a823ae9029a507b37f72c21454e52f6df0cb905b05c8fc9acac370bd767e36107a04de8ff6eebed", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622153693, "uuid": "a9ae0ef5-90e7-4882-a224-3698c7e6a324", "value": "7C44CFD076E18162E0795C3F4935925823267B38DA2FED7F6380AC3C4A2A1D64F539A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622153693, "uuid": "98f55f70-26be-4222-9c6c-ccef182532a4", "value": "f13c78282d305eea2a0f07b09834f1c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622153693, "uuid": "8dd4f808-3c3f-44a7-999d-cbaddb894410", "value": "6144:6kBJf5TaRYafgroFq5IJedkAaq+kfC1cX/+fxi:lhKb7qqJeiAlDfC18+pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622153693, "uuid": "7ca926e9-3285-4ef0-bf09-ff2c3a7e82d1", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622153693, "uuid": "3fef15f6-675c-4ccd-86bb-53c61dd8d7e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622153693, "uuid": "8d827f9c-c09e-44f2-8c18-24675bdcdaa2", "value": "7d058ca16d5d4078964a59ad219820b260ffa903db41d97b071b3bfde3d67ccd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c345eda8-bf1f-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1622142870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142870, "uuid": "d7d27722-e57a-4275-bcff-81b54099c217", "comment": "Malware payload (DanaBot)", "value": "f2edfdaf2a40a84e3ba165ed89b57ccb", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142870, "uuid": "29bd9abf-edc7-432d-9fbc-47180c49fc58", "comment": "Malware payload (DanaBot)", "value": "7e3d9139f86c0df6845784349667de273940b6f47edf998a7c41fe913054cb59", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142870, "uuid": "63b36ee7-dbe6-47ec-81c5-a7e8e2920358", "comment": "Malware payload (DanaBot)", "value": "aa478859d1812e6fd089cebf6635696e71746d2c", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142870, "uuid": "106bd15a-5808-4293-808b-f836a105e467", "comment": "Malware payload (DanaBot)", "value": "ad7851fab587487aa8a1d1419a5267d0f44dd0aa7dfb05f1549b48521ec3ad002c08f6e98b4e7be0cf7fb6b61aff85f9", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142870, "uuid": "de6999c6-61d0-4f6c-857e-5dec40114ff1", "value": "445633306292C03CF4E322FD85BAC37A543A7EA1A77595CB72902BDB52749C9D930F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142870, "uuid": "46f36880-3dd2-4af2-80b2-2722e961313d", "value": "cb971fcf399235e4e9a69622d3809fcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142870, "uuid": "3fb29b31-9027-4b92-81fd-76dbdfbcb0ea", "value": "98304:UK8voss8rfTLfE2ej3plxLWkENgvs+UTwhGCU45zVOkT4QLBNxGe88GE9A9aAng:UKEo2TL8l3FLWFSs7yTzjPNchMMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622142870, "uuid": "a89b7fc1-33ae-40d6-9cba-244c44e600d5", "value": 6311424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622142870, "uuid": "286d8ee8-4fed-4983-9788-d4981c8dcef7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142870, "uuid": "a26feaf5-a957-48e0-b394-b0d566a823e4", "value": "f2edfdaf2a40a84e3ba165ed89b57ccb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49f45b1-bee3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622117183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622117183, "uuid": "7a1bb481-2deb-4e49-aa84-b7707e059267", "comment": "Malware payload", "value": "52f83259d1431c6245536fb415ade74b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622117183, "uuid": "79469377-1bff-4956-a652-c4013b98b5d8", "comment": "Malware payload", "value": "7f3931da1a0ddf0c98b1d57dc630b524af09836ccbdeb0041ea3b94de86e2339", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622117183, "uuid": "22e8f5a5-52f0-4bb5-a349-eef074855b87", "comment": "Malware payload", "value": "27271b6e2f1622321e3ab7858e6ff2bf2de5b6d7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622117183, "uuid": "53d59a52-31d1-40d3-bbb5-831b8cd9c6f6", "comment": "Malware payload", "value": "489a44d2bbadc429a14881f68308c839e66e3ee11d722e047f86d1c7c744705066ad7f12fa6bee4f7b9e7eebbe164baf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622117183, "uuid": "6a7c99a2-b79c-4d2c-abe5-05f32534e3f8", "value": "E5D31322D3130C4FC02579FA7A2BE62A39873E6A24CE449C45F5D66A2FB7084ED71753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622117183, "uuid": "ac079307-b768-42a1-bd8c-5e08a25bf853", "value": "3072:biMYFevw6Yh0b1gKobtCGCmCRlrisfrYm:fYFevwe1gKCYVl2szN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622117183, "uuid": "ebff32bf-da66-4ac8-a7d9-4d8055829484", "value": 137480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622117183, "uuid": "20190433-c645-42c9-96a7-cea9d80dbf3b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622117183, "uuid": "03d7d775-e44b-44a2-8cb2-058fb3f59b90", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002dfa9a-beb5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622097016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622097016, "uuid": "b39918d0-93eb-4510-950d-21ae135f5a1d", "comment": "Malware payload (Formbook)", "value": "2f920a338dc1a855eaa9bcd923f4ded7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622097016, "uuid": "bf90f933-ba9f-4ed3-a514-560ff1471537", "comment": "Malware payload (Formbook)", "value": "7f9805db0143bfc1c9ffa29f7654d44b77317cf0615481b831490b69c8c365d1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622097016, "uuid": "66fd5ea4-3b5e-4b7d-8680-b85b147fa532", "comment": "Malware payload (Formbook)", "value": "b48e2f6d137cff5d8d0167aa1b03d3854ff75f2d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622097016, "uuid": "c15a6920-8301-4921-b033-200a72af3649", "comment": "Malware payload (Formbook)", "value": "d36c32b195660a94cc86aacc74f1871263e7164e8aa53d3c84013cb6ef81b7fd497ae44784824201c20d356af7ca192e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622097016, "uuid": "857a05f9-a63c-4f40-bdfd-ba75d7e12e8b", "value": "4B75BECB34396182D34B99F0AC5F7498E22E74A14CC41555C822CEEE6C62ADAD34FDDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622097016, "uuid": "28f34e20-6610-4331-a677-ea303ae27f72", "value": "1536:Lrhiu4tuUKpppppppppyCppPpWImKaE26dDpWBRouErRWImKaE26dDpppqplpppk:3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622097016, "uuid": "f41d9431-abae-4b85-bb5f-08339a49ca1d", "value": 1555053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622097016, "uuid": "3a3bb166-7541-4203-bd76-13ed28d14cd9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622097016, "uuid": "5b6d9739-652e-4aec-a0d3-caaf78eb4b14", "value": "Ordine no. 20210527.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b5d213-bece-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622107790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107790, "uuid": "219b8eff-b214-4117-8305-d39142d1a75a", "comment": "Malware payload (AgentTesla)", "value": "c860a74a119a235d0c7b67d3bd12cfd0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107790, "uuid": "7d82fe6e-e590-4829-acf8-14ee4f476e9e", "comment": "Malware payload (AgentTesla)", "value": "803dbe4358ea84a8013942e1b5a8b897ac8ce4144740d1a6f7bddb47da4edb7f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107790, "uuid": "afa8f403-0b59-4aeb-b005-006aec417b45", "comment": "Malware payload (AgentTesla)", "value": "df42173bfadde9327b9ca57202e546d891941f11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107790, "uuid": "93939abe-b33d-45f7-ac17-096b3c1abe62", "comment": "Malware payload (AgentTesla)", "value": "d0e45f8c4bfc7955aa766301764c04e1cf3cab0dd90b14ff316624d528f88cc448a049bae171deaa2d8317164f2c1036", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107790, "uuid": "01d7b107-5bf9-4f80-a0ea-db05d20dddbc", "value": "0DE423C3823A5182D6A5F4B658494CC4C8C0B36A7DA46C157F7FD18DD0CBE1B663A877", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107790, "uuid": "c578a60a-756e-4716-9f56-e4f1b1f5aaaa", "value": "12288:23oWj56IxNnwJp9IIA1HBH8RmF3kdhng1S+BFkAXu7ZJ3T8PllO5k6yNKiqvR1xG:8Njr+b9dcHBH8kiHg1S+/X80i5WN2vRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622107790, "uuid": "ffd84259-4902-4dc7-8d76-8ddc93b0cf5e", "value": 672435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622107790, "uuid": "051c2827-aeb8-4696-93f0-94f647136890", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107790, "uuid": "abda30d1-f987-4de7-a402-5b8fc322ca7a", "value": "new po.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23b5aeb-beed-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622121474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622121474, "uuid": "b9155879-3801-44cd-9585-ff2d1a9be64d", "comment": "Malware payload (Loki)", "value": "c6d710400d3e06720f56d8e5ea213b03", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622121474, "uuid": "cb5aed25-c360-4064-8f9a-74a805220a19", "comment": "Malware payload (Loki)", "value": "82d590992a821dadee4added2391eb74db73d4f481c015984a15be08ebdbee03", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622121474, "uuid": "1360120b-0cd7-4836-8d37-aaf1602051d0", "comment": "Malware payload (Loki)", "value": "755a39d3a809a35a04b7673e7c9dfc3f3406020e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622121474, "uuid": "bf6326e7-8027-49a1-bfdc-bd9d925ef2ae", "comment": "Malware payload (Loki)", "value": "bd275808886ad396d38c4d9f163fea8f08e2a765041f491579feb50af93aa54d61e42b86994aca77bc359a8f8ac94c05", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622121474, "uuid": "89e474ef-6d42-492c-b67f-562d425fd354", "value": "2FD4230EC481661C99DE0536A5A4F72F82D3CBBB70AEEFE05274C55D8622F4B4B690C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622121474, "uuid": "f2a05c91-9764-44f8-8b87-38065df480e5", "value": "12288:b6Mh4CuLJb97WECIzpdlHW9Y3txwykSGOlxanC+v0M5BHGVF6/W9ugip:x4Cct97iIzpvWcXwGSC+MM5CFx9ugip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622121474, "uuid": "c289159a-13d7-45ce-97cf-cd1f703234f9", "value": 643252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622121474, "uuid": "9e216392-3ab4-48e2-b67a-1db4f6d91ca3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622121474, "uuid": "054fac8c-3f3b-4b27-8f4e-fed3c4795061", "value": "Proforma_Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3dcda0-bee9-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1622119773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119773, "uuid": "ff5f43be-23d0-4939-aeb6-18b523b10c58", "comment": "Malware payload (CryptBot)", "value": "4381bf0e18b04197e15c187ce3be8675", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119773, "uuid": "b3eb7363-e1b4-4df2-a06f-a27db78b4ba6", "comment": "Malware payload (CryptBot)", "value": "834ccdd87931ab88f011372377befbafda51abccff557c7dd3e01682580716fb", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119773, "uuid": "b06b9d38-0a8c-4a74-92a2-ed0beacb9347", "comment": "Malware payload (CryptBot)", "value": "d9e7c24f3ea4b436b40d05807ca22b4d9ceb1463", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119773, "uuid": "6b521ea3-f325-464f-bb38-7ea144ea46eb", "comment": "Malware payload (CryptBot)", "value": "73a7c58d0e9cd82203acf7df85c31e8fa2a2fd9507bae129ca1023a05c26336d810cbf296e6b2719b1b00cd0ca4efd0f", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119773, "uuid": "88b9cf5e-b897-4d05-bbaf-df44d88d0b47", "value": "CDF4F130AAE1C034F0FB12F448B59279A53A7EB16B7490DF62C436EE56785E89D3074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119773, "uuid": "897f3600-e3e8-4667-9a5e-cedb628e14fe", "value": "a26f0e6bd2952037425bd22d2a7efb64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119773, "uuid": "ba1395ec-66ff-4c70-b2fa-f7d04a1a20c2", "value": "12288:gp78oEfnT9H+BgcAaiUXc87ht8SE8sGXeyEjnOr+868GZnCF/CrUeE+Zi0xPZRY:gpNEfizic8xVGXeyEjnOrNG5o/CzvtxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119773, "uuid": "56ec7f2c-defa-4e79-98aa-985ad938a976", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119773, "uuid": "e4f73d36-dcd4-4af8-ab33-9f5bd1284c62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119773, "uuid": "68838478-87d8-45fd-958c-3ab036f74720", "value": "4381bf0e18b04197e15c187ce3be8675.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d30705-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1622141564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141564, "uuid": "826e507f-1189-4dc4-acf1-303bd5faf429", "comment": "Malware payload (AsyncRAT)", "value": "a80560f536b857595b402c85428301c6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141564, "uuid": "c2eb2d85-89fc-4c96-bb82-0e5e4a94266f", "comment": "Malware payload (AsyncRAT)", "value": "84db202f0831a4502850dd30115dd1338db792c413492b1a0514e7de5a195300", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141564, "uuid": "e84d653a-2c60-429e-a0a1-ccc8009c957d", "comment": "Malware payload (AsyncRAT)", "value": "36eed42b2cd596cbaf8df1733e3c8d78a3f1e7a4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141564, "uuid": "807faadc-1ad1-4b1f-bd8b-d636639a6c3a", "comment": "Malware payload (AsyncRAT)", "value": "4f4feb782b78285b3da3d8dc65cf663ab8d791de636f6eb05cb5c5cea0e498b77eedea08578a961840edc52c261e58f7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141564, "uuid": "8a78b887-b0d7-48a1-8a6d-97848f6e5c32", "value": "92231A0037E8812BE2BE5F78A9F25245867AB2673603D54D2C8451DB5723FC68A436FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141564, "uuid": "a34d3ef8-1110-4315-8ce8-2b40a9690b78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141564, "uuid": "8597a84a-3640-4199-b8ac-775b7bfa1667", "value": "768:Eu1a21T3EiJfWUzuydmo2qzJZb1cQPI8PjbcgX3iYyfnqfPJ0VOBDZTx:Eu1a21T3xN24S87bzXS/fnNSdTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141564, "uuid": "cf765bde-49ce-4dad-bc34-97e76c1f9008", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141564, "uuid": "deb4f801-7335-4a5b-a44d-c0d49995a5c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141564, "uuid": "fedbcae0-82e3-4ef3-bf3c-cb9b662789e2", "value": "a80560f536b857595b402c85428301c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4283918-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1622141583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141583, "uuid": "1b7e2557-3d4f-48c3-933d-92125e465589", "comment": "Malware payload (AsyncRAT)", "value": "8ef8c5a2b4f5ac337344f96770d10de6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141583, "uuid": "58615da7-323e-48e2-8bdf-f9997f32d88f", "comment": "Malware payload (AsyncRAT)", "value": "84f139176900fbf413d74ae46ee5902350d9911a22b44be65e0a9b4dacfd9e32", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141583, "uuid": "84371c12-1d39-4311-b0e6-18be80e8990a", "comment": "Malware payload (AsyncRAT)", "value": "949b697b323d4c611a29ba8d20d15c6901f6c55d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141583, "uuid": "c7b750df-b7ba-4125-b9e9-194704aac36b", "comment": "Malware payload (AsyncRAT)", "value": "54ef06a8477e5abe5212b46855a884de452174c0aa7335ac5c418d42f2170443cca58ffe70c67a56fcaa938e7448ffcf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141583, "uuid": "ddf06dd3-375e-48ab-be25-6976fdf780a7", "value": "1115F74D2644D712D32DD374CAEA54B352E0EC23E201EB8A9CC63BD536B27C7368656E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141583, "uuid": "0814027d-7728-4db3-a0af-7d055d01be36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141583, "uuid": "76f2a3ae-d47f-4dfe-96bc-8676daf62b40", "value": "12288:uEdKRi2o0NSEaXL4EPpBZ5vjGQEEMhZrnfC2zn/nE8XvyiOzvn:t8o0N/aXL4uppvjBEbD7zn/tKiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141583, "uuid": "546613cb-8d36-46f3-990c-4fdeff2a9457", "value": 901632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141583, "uuid": "d28c4939-51ed-4a8e-a269-971b4ba8a67c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141583, "uuid": "ac0001eb-a707-4bd5-96e2-21840790da62", "value": "factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95881eb-beea-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1622120063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120063, "uuid": "1cd8cf5c-fb61-4c71-b6ba-431d3a29fc0b", "comment": "Malware payload (GuLoader)", "value": "b11739b0390d94a1b281885d76d3b124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120063, "uuid": "d774fb0a-3cd2-4ecf-b722-828e0812a6e6", "comment": "Malware payload (GuLoader)", "value": "86a71b90222d2cca00dadf08403fa518224fc6dadc7d3db66a769ae2331ec6aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120063, "uuid": "9be8e65b-6919-41db-8afe-15852442b614", "comment": "Malware payload (GuLoader)", "value": "2a643516ce84b3a4735429c08c4ea0bf7fde90e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120063, "uuid": "1c2ed7bf-7065-441c-9d02-6204f66df746", "comment": "Malware payload (GuLoader)", "value": "06cee66d660f4c0b3956478e400a1527a187f97c1dc15fc7fca16c0d09305ceb90185db27dd0a39d51a942415dffb14c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120063, "uuid": "71f1e218-2cc4-4636-bb8b-f0f0fa5ef964", "value": "7914F972BB49E769F45183B03E81D1FB61323B3345674B07BB802B4AE4652CBBDB0A15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120063, "uuid": "e6be717a-102a-4661-a988-be060de81f44", "value": "1abc0dab2264c6ccb12f07d7e589e0ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120063, "uuid": "27f3d744-eb07-44bc-8435-2f15bbaf7822", "value": "3072:YP8Iet+piSrmTcvB0YlqokgJ4oSPE3PGctdRV:0et+piLw50YlqHgJYPE3RdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622120063, "uuid": "fa08e628-1fe6-47fd-8790-9f4976d80006", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622120063, "uuid": "33f2b3a1-04c1-4975-bcc6-43705565ae7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120063, "uuid": "7fc15f29-10c2-46d5-be1b-1236511d97c2", "value": "b11739b0390d94a1b281885d76d3b124.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f401301-bee6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622118167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622118167, "uuid": "a547890f-d17c-4bb1-8ae1-1a55ca79b83a", "comment": "Malware payload", "value": "0b046b5f2b80fb757fe3c51611aa6e3d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622118167, "uuid": "97a25083-7f3f-420a-84bb-f59548a5feb7", "comment": "Malware payload", "value": "86d53c337b7076d4b34e4c2a724909b7bc3beaf9f47c53231c91aa78056021e7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622118167, "uuid": "d2ede148-8720-4124-a7a0-7126db41b86f", "comment": "Malware payload", "value": "c21adb83ed0958c80e242df91a523fec4331512d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622118167, "uuid": "e12aed5d-ae58-41a7-893d-e8818c313ae8", "comment": "Malware payload", "value": "0081c0d842938edbb49322b9caf2d3f503c76542b6eebb2cb6fff449d29887c5eb28adbda34041a6de69e1d57076ff25", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622118167, "uuid": "36fbfbcb-eaac-407f-acf2-00efda1dfc9b", "value": "B5252360FEE71F9BDB09C8395A178B8C001DBC8E6BA0C0BF4791358B77B97E24696511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622118167, "uuid": "bfe9eac0-936b-42c5-860f-2c94ca5a8d3c", "value": "24576:nE57SiVc8A3QA48kBlPMF7CPz4/72Jgu:nEpSwcxdkvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622118167, "uuid": "3edd4de6-ea12-44c2-8b2a-f2f0988a8bfe", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622118167, "uuid": "e8842d72-f60a-4c7a-9401-1f1f7034bae9", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622118167, "uuid": "cf87b58a-bf97-4844-987d-e5ae9dbdf4b4", "value": "86d53c337b7076d4b34e4c2a724909b7bc3beaf9f47c53231c91aa78056021e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed87823-bf42-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622157895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622157895, "uuid": "ed4704f8-6b1d-4fb7-a8bd-62be98977fa3", "comment": "Malware payload", "value": "40bfdb9c9c1535435fdedc666c34ba20", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622157895, "uuid": "b23e1803-0699-470e-854c-191b6d4c567a", "comment": "Malware payload", "value": "888614bdf13110e3934ff3a852074f6cde2998db6631d443bdee73dec5ecfe30", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622157895, "uuid": "f82d7366-1412-4d4d-9a06-de305a57c8b7", "comment": "Malware payload", "value": "c6e6ebf08508962edcdf5c294aad95de9538e6ca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622157895, "uuid": "515dd497-edd4-4609-870e-442b0ad5ac2b", "comment": "Malware payload", "value": "d191694f472918d4756233baaca7e3e9e93adf6f41206f48b7fa0146cdd7ebedb055ad5e0ac5a2ddbffe5f33da60ecff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622157895, "uuid": "56e38111-6781-492d-850b-ee3c05d61d04", "value": "AFF313453B17EA02E768EC321B794E8A1DB1ED46AB8D8955A3D7334EB07F5D221330E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622157895, "uuid": "a3b4f550-c8a9-427e-9444-257845e6a060", "value": "3072:O1RnOVC1VVURgpj4WSuq+bEPbcUpo9JZPyTAaFNIjzvGHh86TtS4lcHon:O14VMLGgu3Xbuy9NCzeBS4leon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622157895, "uuid": "a94dfa63-c540-46ca-aa07-194211eea8dd", "value": 165893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622157895, "uuid": "75f7f5f2-3863-4711-81f1-e1086c2f0e7a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622157895, "uuid": "49f0c66f-d7e4-40c6-b3d5-a5005510614b", "value": "888614bdf13110e3934ff3a852074f6cde2998db6631d443bdee73dec5ecfe30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1680cffd-beea-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622119817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119817, "uuid": "9b4082e2-655a-458f-a15a-71a5a2b0642c", "comment": "Malware payload (RaccoonStealer)", "value": "623240cf2320445b86c4252e65e10e86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119817, "uuid": "bdd2308d-4fff-4a62-a753-cd4453448120", "comment": "Malware payload (RaccoonStealer)", "value": "8ab138fc55d8eb13c4856e7b1f22a8c368514a7f8e7339e9a0a9a6c1cc719e03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119817, "uuid": "816dd6cd-89ac-4456-8344-e096e1fdfa2e", "comment": "Malware payload (RaccoonStealer)", "value": "de0e1aa6444fde4f832e183154a6ee34ccdf64b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119817, "uuid": "96e5b6cd-c8b5-46d3-84d9-48af8cdc8581", "comment": "Malware payload (RaccoonStealer)", "value": "b43c373f11ddff675ec49d58005b85bdbff96670f11e05082640be8f7c43374eb13d56f4225276ba0cda46a33222855b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119817, "uuid": "e6a542eb-c5e7-4228-b4bb-80e1c4edf8e0", "value": "6F05F120B7A0C039F2B756B444B692B5B53A7EB2AB3840CF52D537EA56307E49C32753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119817, "uuid": "18b12ed1-c772-4691-a50a-17dabe2ec6fc", "value": "dac802e4a8085608765f3bd680d77304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119817, "uuid": "1b105943-4145-4a42-ad17-4a20c5ef5ea4", "value": "24576:E/JbasubC8WNfHpHUtyLEwmZ21symP0va:RsubC8OfZUtMEw4VVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119817, "uuid": "05e5a3c1-5ac3-48d4-bde3-61c330b12c4f", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119817, "uuid": "a2f0f24d-cc7c-4511-8386-9429b2097e0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119817, "uuid": "39b9a751-98eb-4461-bb88-3322261c5810", "value": "623240cf2320445b86c4252e65e10e86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3bdc51-beb0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622094944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622094944, "uuid": "1f1fd633-7ee9-492e-b551-6403f284e8e5", "comment": "Malware payload", "value": "b32d8128bbac5709a1fec4697b976046", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "feberr", "colour": "#06551C", "exportable": true, "hide_tag": false }, { "name": "selfish", "colour": "#2270A7", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622094944, "uuid": "95813ea7-5a85-4ba1-8f22-b7e77abe506d", "comment": "Malware payload", "value": "8c3f43b897209ceeb4b56dbd415d0c7f23089411679a3af6b2a0d0b2aa2f6bc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "feberr", "colour": "#06551C", "exportable": true, "hide_tag": false }, { "name": "selfish", "colour": "#2270A7", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622094944, "uuid": "e5de98fb-05f2-4f37-aef2-7df6f2babf13", "comment": "Malware payload", "value": "bcc890ee3dd60b2f94fd1f6974b5506f9db1b318", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "feberr", "colour": "#06551C", "exportable": true, "hide_tag": false }, { "name": "selfish", "colour": "#2270A7", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622094944, "uuid": "53c01754-1b62-4a79-a5e3-33eb231a615c", "comment": "Malware payload", "value": "d0411f4c3d3ac2ba7694a3d4cf52a703e6d4305e17bfcc84124facb6be90759d8042fe3f264fa767ed506fd3fa9ad6a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "feberr", "colour": "#06551C", "exportable": true, "hide_tag": false }, { "name": "selfish", "colour": "#2270A7", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622094944, "uuid": "1713bc64-2011-489d-a6eb-60a5cd816ae2", "value": "93257C22F6D28833D1731E3C8D5753999A2AFE003D38584A7BF91E4C1E79A8179253E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622094944, "uuid": "71915b61-1024-4284-acb6-96d493d65dfa", "value": "12288:GyPvWO/ZHLyxCGhGjY6YVf6ZNRI4VWtQ4zLNelfcrk85u1a1+FnbfCjb:DW0H9DzwyTRbnzcj5Oi+lfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622094944, "uuid": "d895ccc4-b5d7-4787-af83-4cebce2de9b5", "value": 968712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622094944, "uuid": "0e3409e4-e9c3-4586-a70b-40c6037f7640", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622094944, "uuid": "039704ae-95b1-4bff-839f-8a3cf6e3b515", "value": "slef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5708bf6c-bece-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622107899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107899, "uuid": "2f80f943-a2cc-49f1-81cf-00e4edcc8510", "comment": "Malware payload (Formbook)", "value": "04bd913db8304d2c2efb51e70599e9f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107899, "uuid": "a20bb95b-9486-481c-b5c3-862e542ffa96", "comment": "Malware payload (Formbook)", "value": "8c5c4469e32f3399e57e3f56a78ea3ce8fb52542ffa51c4ccfc42b5680854ab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107899, "uuid": "883b085a-39b3-4c76-86ce-7ff654c704d4", "comment": "Malware payload (Formbook)", "value": "7298e687c7ee6db59fffd7a9197ec99ae5815c7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107899, "uuid": "b9c11de7-858e-487f-8948-9de6642b9fcb", "comment": "Malware payload (Formbook)", "value": "d73429a6c97740b5fc42e7ad6eb652d710d642a35477ca55ec4ebdc024475cb5acdb6394b2c656ce5556162ff94236b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107899, "uuid": "05b16e61-369f-415b-b00d-fe6fe51ea499", "value": "83E47C1C2168C216D5ADD2B49ED5D82FD250E9377112BFE8D8E703BA1B07A4379821BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107899, "uuid": "33fca216-36ed-4ccd-b6c6-cce7043185ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107899, "uuid": "542d56fc-8f75-42a2-a78e-8efa9bffb570", "value": "12288:qQMZGdkNvlqfxsHoarXBsKsWlVAOuRGW0P6l7Y3c:qQdkRlm+I4VvVuAjP6BY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622107899, "uuid": "2143183f-6c57-44fd-8bba-63f9972c6269", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622107899, "uuid": "3633fc74-e32e-4afa-99f5-d1660c5eac42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107899, "uuid": "8b0da20c-7d0d-458f-b5de-4b4b5a1f2dc7", "value": "Pdf Scen Invoice 17INV06003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dac8563-beda-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622112930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622112930, "uuid": "e1d2f8ab-d915-480d-bba8-e334f24889d0", "comment": "Malware payload", "value": "e6bf37af65004c889dbd4959217eb9c8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622112930, "uuid": "9618a885-c132-487c-a9fc-4bea65be92af", "comment": "Malware payload", "value": "8c5e9fada0fd70b66bf054d6eec8210e33260c935a9099ea505e109cc968fb74", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622112930, "uuid": "cfdc69ab-8ecb-41db-9085-edcfbb223a50", "comment": "Malware payload", "value": "879a03a265c1df281ed20587f52fe0a8db6aa8e8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622112930, "uuid": "615e8357-aa08-4795-ae10-e51db7bf6662", "comment": "Malware payload", "value": "9c82616ed7afdd9cb9305e546fbeda3eec9062be2bf96ea77afd958a88b0f67c927bb89397462d29934f08adc0bc241a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622112930, "uuid": "5dfb9801-9818-4102-96ca-27d9f8c13b70", "value": "C86534521B941769F4AC1ECA444B290B21F5D25AF8341788DFF36AEF7C3B8C9B4B0625", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622112930, "uuid": "cf614625-bd76-4a0a-ad62-4dca7a311442", "value": "24576:aJ0Ylpk7WSkdUeiANxE5EnNDyRSCdLkXlS2+xcBtlqJfeV6TFsk21iU+jxmgLhzL:aJ0Ylpk7WSkdUeiANxKEnNDyRSCdLkXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622112930, "uuid": "5e6890a1-782f-4f4b-b209-58d8bb15b17a", "value": 1418695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622112930, "uuid": "d598dac8-d1b7-4fea-a0aa-edc1d34edfe1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622112930, "uuid": "deb8cf7d-0670-4b3b-994c-6b700996deda", "value": "helloworld.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f3f3df-bead-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1622093613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093613, "uuid": "f787321e-649a-4af0-9c92-ee81e412c53f", "comment": "Malware payload (AZORult)", "value": "6e83277751736eaa28b2f2184be7525b", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093613, "uuid": "d4b8ca2a-6dae-4802-ac90-2904ed049298", "comment": "Malware payload (AZORult)", "value": "8d0f251cbbeb43f2a100d232e74837d3e93ddd4531b5c0b7461845b10cca3ce0", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093613, "uuid": "b9f7defa-7209-4a8d-bd02-964fc1aa48da", "comment": "Malware payload (AZORult)", "value": "5ec08417b0b76882a435e804de4ae86418588008", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093613, "uuid": "09c84174-b4aa-4604-8d5e-e171d3c5dd51", "comment": "Malware payload (AZORult)", "value": "0d7f48e5ed023c0d4230ee60712861762fe13e846ccf73bd4e700cb8af4b3b00cc96b0e56abf1afa01918931a80def58", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093613, "uuid": "f3341381-a71d-4b33-85dd-d31e66512ca8", "value": "45E3220DE54E35D921782B1C5A82FD4E0AC5ADA78E4D6D30A8E8728635A53C74CFF00F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093613, "uuid": "2333db53-895c-4fcb-8bdf-4d3a1e08e7fa", "value": "3072:ieLbTcYBemwRhUxY8lEbWO6htYbwWm2qQ5WROxRnkSzpfCQaN:lTzBe5Rl8lMWztYbwWC4Wc3TztCrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093613, "uuid": "7ce21f7a-1120-4b0d-a924-93bce516d1a9", "value": 155206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093613, "uuid": "2f815082-e015-4107-955e-57276ad6738e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093613, "uuid": "fc6c661d-814f-4be7-a2aa-44ddfb0b92ef", "value": "POBKMIN20210000000231PDF.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d15a29c-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141464, "uuid": "b1257ead-24b0-43d5-b097-ce30367657d1", "comment": "Malware payload (RaccoonStealer)", "value": "a8a4f091d01aac29a99e3399bc4aa65a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141464, "uuid": "2a60f263-4e56-44fc-8231-285c68fc5eb6", "comment": "Malware payload (RaccoonStealer)", "value": "8df03421c8ef48462d58ce9282f448938402c3eb7d4b10c982027e3263708bd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141464, "uuid": "c61a1f92-531a-46e5-b0ae-cb687fbf9a87", "comment": "Malware payload (RaccoonStealer)", "value": "3b681f5b893ce31e8b7697a7e318abb2e9970801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141464, "uuid": "2710b4df-47c8-465a-81ad-2c5e94c21df9", "comment": "Malware payload (RaccoonStealer)", "value": "7e9e01dbc1fd4feab69d4c064e68ba2d259b6e9e28714ce109b3a96d61ebb3a3ed265d16275f75da9787a972a42c7d81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141464, "uuid": "828f638a-5894-4cc7-8ef3-e901e4fadefe", "value": "88C4D031A691C035F0B716BC49B68279B43B7EB1E734D0CF62C02AEA56B55E4AC31B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141464, "uuid": "d4d0f220-a15a-49b6-8538-bf461cbb9833", "value": "fdbe3f2aedac4f7a47219085c5785404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141464, "uuid": "b326dab1-8121-4620-afb5-3742720ce6db", "value": "12288:hwQ1QYlSvNu4qvEVd94mjwYzcaPew3AuSJc/jJPb:hwAlSTW8aVynSgjJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141464, "uuid": "838243d8-94f2-4aed-8b94-c1cafafe9e16", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141464, "uuid": "4008bcdf-b041-4eaa-91ab-63752f81dc35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141464, "uuid": "33bf3134-39c7-4f81-80a0-5561d84f1034", "value": "a8a4f091d01aac29a99e3399bc4aa65a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26daf3d9-bf0c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622134447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622134447, "uuid": "19ce4a41-fc27-4f4d-8d83-12085dc347f4", "comment": "Malware payload", "value": "03b7e590603aa2782fe8b1c89e288dcf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622134447, "uuid": "d5566871-950e-44b8-bf96-7a9933d50402", "comment": "Malware payload", "value": "8e5d4ef0cd958a113d82a095214bb0e2ab0c0b57847e481585274f6852bd5271", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622134447, "uuid": "fe23fae6-3a0a-41fb-b773-4a34137bd3cb", "comment": "Malware payload", "value": "0bc8a354f97bb693e7a438aece2227e170ede917", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622134447, "uuid": "026c3c6a-6214-489c-aef5-64419d44cd91", "comment": "Malware payload", "value": "ab05420635f2553a6cb177bfe8e8bc1ff689fbe0b8d25ea509536ae378ff30edb9dd535e543ed7bbd906373117a37feb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622134447, "uuid": "811fb82a-11b4-463c-8ee6-11fb6ac7b37f", "value": "D206E181B662D072DB9100F4796DBBBF583C6E3813209EC3B3C47B6999701E119BA767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622134447, "uuid": "36cf70ea-98ec-4e70-b286-371bb38b204e", "value": "b1aba371179de8a6a8ece1be6deb86a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622134447, "uuid": "8202e1ed-30c7-44eb-a3f3-af810c822b9c", "value": "49152:E4GRhhX1TARhQ0ngVANEf0Rh3kzIzym09Z+Pz8kV/W7:Ethhl0RhQ0ng0E0qIUyTV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622134447, "uuid": "c6e16b05-b4f0-41e7-9d8f-1e3cff37e617", "value": 3941376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622134447, "uuid": "be3f2ffb-0b1c-4753-92e1-c04d64f8daa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622134447, "uuid": "d405e6f6-60be-45af-a17a-807baa2732d0", "value": "ExtrimeCheat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c399c3-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141512, "uuid": "46d26229-2d5d-4ee2-b89e-f4530ba64301", "comment": "Malware payload (RaccoonStealer)", "value": "2cd86de8e19df9ba2d71915368c8bdc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141512, "uuid": "8192fa51-97a2-4288-95e9-db6b700dc09d", "comment": "Malware payload (RaccoonStealer)", "value": "8e98d227ab95b2d3e727ed670d1faa260157f6a595aa1026035606424f4509c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141512, "uuid": "3441c491-e0f1-459b-9447-55c5df149b73", "comment": "Malware payload (RaccoonStealer)", "value": "edfc981d1ecc0aa881d40bfa240beac1f0f5b225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141512, "uuid": "769b877e-a991-4872-9d4c-3d6226cf52b1", "comment": "Malware payload (RaccoonStealer)", "value": "de2bdb91a077ac86ed7618639a5ee5c28d16a94c3002dbe4df14d02b6e01eb5bce65489e5d64b3a03a13c26b6bc6b06e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141512, "uuid": "12841f89-b8cb-44ce-8696-9cff0037ff87", "value": "A8C4D030A6A1C031F4F312F459B582B9693A7DA0973454CFA2C46EEA57376E4AD30BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141512, "uuid": "11879a45-64ac-483e-b451-6ea7a5978b61", "value": "a26f0e6bd2952037425bd22d2a7efb64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141512, "uuid": "3463d694-a3bb-41d7-965a-9f600117b1ff", "value": "12288:Lp7N9EVn8LNOOcSw3Fvz7ul9iKf+pHwIzFsjwgc/sqT:LpTEVmuFvfui4+J9XsqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141512, "uuid": "45aef701-a696-4c95-afe6-34f15a2341c4", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141512, "uuid": "3b8f9baf-3e3a-43a2-a133-77f03090b27a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141512, "uuid": "24d5117d-256a-4552-9b29-ed19ea3a1961", "value": "2cd86de8e19df9ba2d71915368c8bdc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dea8c8d-bec9-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622105763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622105763, "uuid": "12fbc8a5-de66-4716-83ec-a39e9c19ea65", "comment": "Malware payload (NanoCore)", "value": "856f70d72c8c5b353d71e2b19234d235", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622105763, "uuid": "1c407903-65fc-4f38-86b8-fffc17f3964a", "comment": "Malware payload (NanoCore)", "value": "8f11c104b0459fe6380790945b6682b6632c4ca94179e4549b75bd77a1e598d4", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622105763, "uuid": "24e6d2ba-380f-443c-839d-d8be50e6f9fc", "comment": "Malware payload (NanoCore)", "value": "36fd9573392c1dae9fcee9a15e266ee7f7a28351", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622105763, "uuid": "c1bc52d2-0857-4d72-846e-0f2266b60aba", "comment": "Malware payload (NanoCore)", "value": "da2dceaac60d6917cab1c32ee7204ed557cb519e54499e7106d291d793f14607cf4110a4acf33fb6104d9d8c852776f5", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622105763, "uuid": "85a53c06-a50f-4198-adc2-1db218c56984", "value": "7625362F116AE222C068C27D06D4742BED91DFF36130AD25ACD73F985634E4C799E26E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622105763, "uuid": "7160bff3-00eb-4538-899b-b9d2172b78f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622105763, "uuid": "0fe041d6-2168-4836-9df9-7de51e2ba1ab", "value": "12288:3+0uzeOn7fPh9oowToSNUglxheAI4U9rCuBD1f4gNhvrSEcpUz4XAQdg84Cctm:6eirh9oiV6UAI4U92uvNjL549dxZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622105763, "uuid": "a62a1bbb-27a6-4aa9-af17-3046b9c152f0", "value": 1036800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622105763, "uuid": "adacf90b-e763-47a3-9de4-d32d17089e3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622105763, "uuid": "c4937597-2ffb-4baa-90fc-02b214e215f9", "value": "ORDER#INQUIRY000111.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816d7e4b-bef5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622124721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622124721, "uuid": "6ef9acb9-07b2-4bc9-afc2-698fd02f8b80", "comment": "Malware payload (AgentTesla)", "value": "13215bb52ebd7d3e1dc93d731fc72fcd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622124721, "uuid": "483503f2-8263-4717-befe-a873bff4137c", "comment": "Malware payload (AgentTesla)", "value": "9006710b53672d56ba7549b52ac3896e74eb11e640561ca14527924e0a38bd3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622124721, "uuid": "fad00379-11b8-4803-a6c6-bfa5e1ed3e1d", "comment": "Malware payload (AgentTesla)", "value": "8f977dabf39059538bb3505d3b682b3b5ada69d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622124721, "uuid": "1c0592dd-989e-4e1f-8a0b-9e557695da03", "comment": "Malware payload (AgentTesla)", "value": "e4c6b11e31267562a43122c638146728ba51700f061917ad7747a71eed391b2f49bc6998de331f5c3526a77f6769acb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622124721, "uuid": "35d8c2ef-2dba-4621-87df-f4463ec23e02", "value": "4305CE917154F886C966DE393A9CC548E6ABBD61BBA19F837D80736F10F33801F45329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622124721, "uuid": "0a54d5ea-7971-41fd-844e-8a53863607ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622124721, "uuid": "2152d932-78ec-4627-b847-017fed56876b", "value": "12288:n/fzFvmHfZHbox3+IjGu4vSJqL0lBJ/amAh/4H444hT:/hvm/ap+IjGu4BYfkh/4H444hT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622124721, "uuid": "ec058f2f-43c3-44fe-ae2a-5f0104b9fdbb", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622124721, "uuid": "792f1605-ba40-4508-bd45-ea633bcebcf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622124721, "uuid": "a7326cf8-b45c-4b87-99b7-0f70e23bc781", "value": "Shipment Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859c49d5-bee1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622116138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116138, "uuid": "74841d3a-0ca1-4a80-a3a3-a4e0b7c1266e", "comment": "Malware payload (AgentTesla)", "value": "3625fabc31cab3d0926676c2bb4bf938", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116138, "uuid": "929995c9-6b76-4b2b-82cf-a718c7d73ccf", "comment": "Malware payload (AgentTesla)", "value": "905a4577d8dad6ea199879c9a764f4a52542629c07e2c336d2ec5f7a53282123", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116138, "uuid": "baee93cf-c2bb-44f4-a9b3-07115728796e", "comment": "Malware payload (AgentTesla)", "value": "8319e52277522c60eba56790e07372e8a285237d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116138, "uuid": "5ffec062-5377-40f5-9f63-a3ffdfc591df", "comment": "Malware payload (AgentTesla)", "value": "d89fc09a8cb0268740d957a85d01447f7da61b395043af02890f7a34882fada9cd64b159a27c4fbd44f86a89b6977443", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116138, "uuid": "43cd7dc5-73e7-4ec9-a744-2f68983bbe01", "value": "02E46C2D16A50217C279C2BC89D1D433A210ED277513BF9999D22FB73B63A46399233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116138, "uuid": "e7854da0-77f4-4903-a0f0-a3049ab092af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116138, "uuid": "ca53d9f3-9b03-4131-8b5a-e284860ce9d4", "value": "12288:QVFtOmPVTTqlITuMU459dmE1trYASzKig+PI7SW7vR3STkiPE9xC/+z:QtTTqlITZ590EXtVd+PGSkvR3GP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622116138, "uuid": "a29dd344-af26-4bdb-a670-01c6471c4fed", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622116138, "uuid": "30107766-d633-4728-a9ce-6fb4bff39a4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116138, "uuid": "841555db-c54e-4950-b7cc-3a17610b3cbb", "value": "905a4577d8dad6ea199879c9a764f4a52542629c07e2c336d2ec5f7a53282123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83778b86-beb2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622095948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095948, "uuid": "5b0dbfea-b968-4ea9-96a0-19eda1c6e297", "comment": "Malware payload (AgentTesla)", "value": "a847808c0cd429ec7c97ae7ff202149b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095948, "uuid": "d45a9d6d-b1fc-4ff9-aac7-86981a9d7c49", "comment": "Malware payload (AgentTesla)", "value": "917553614d4ebd8375a43db2c188134b7f3d57c2bfb809d6122ea26e0aedb81f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095948, "uuid": "628b9203-065b-42e2-b434-8a2b1ff52b91", "comment": "Malware payload (AgentTesla)", "value": "0a4c249a89502a6bc2a9d38a00fcac100857169d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095948, "uuid": "0adbbbd3-71ae-40e1-910d-399e44fc4cbd", "comment": "Malware payload (AgentTesla)", "value": "7ab3ad6d6a820276681a299aa0bd665a1960fc0a45e3a7ea1010709535d6ddd7561a57d9ebf25a87367cafa4d56e0b87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095948, "uuid": "421fd278-156c-43d3-8665-3e10566a79a5", "value": "A4B4F1A2B780CA71E8091F748176992817FFAF32A5B1D66C698CB1381F3375E5047973", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095948, "uuid": "eac0609e-ba24-409d-8965-f9d5e4bc3589", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095948, "uuid": "15ae19d8-e421-4a19-a5a3-431b775b4678", "value": "6144:f6oo61pds3LMxFWI9+hRfynkJ4JJmoxcxNTjIk7vBI26T0THxbnG4/LuPSDWLD:f6o1pyba9HkJaBcbDv6SxTGoLuKD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622095948, "uuid": "288a9abb-d103-4bcc-b0b3-e52d1e09c490", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622095948, "uuid": "2412d0e2-ea65-424e-97c5-72fa7e2189c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095948, "uuid": "3443bc88-aa60-4549-9064-6d814d5d927b", "value": "INV BL Shipment Document Packing List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94632f56-beea-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1622120028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120028, "uuid": "33cf071d-548d-4ce2-9794-3c28f1f18237", "comment": "Malware payload (Dridex)", "value": "f1fcca46fd7af3f90aa67654250e7a05", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120028, "uuid": "5cbb6fcb-83ac-4829-abad-73aa86e1fefd", "comment": "Malware payload (Dridex)", "value": "92894a7ae51b0554b666fed9634f3a34f490c27b9ad1ec9b85e9ef91fe0a0bc2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120028, "uuid": "09dea21d-e23a-44ee-821a-67f7f3328b7c", "comment": "Malware payload (Dridex)", "value": "140fc6994e408cd4fe1579e388c03d8f5ef283ea", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120028, "uuid": "88f98f15-f000-4d25-9f8f-6d03743bb74c", "comment": "Malware payload (Dridex)", "value": "ea92e46109f98dbc95b025e69dbe2d448b48e7645e6794343db4e2566111a9051e6755de358aacb5001de803c1e98532", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120028, "uuid": "38a382a6-f14a-483e-b897-02f7fe54f4c3", "value": "E7D4E0A0FAC59526CD5B16379C61EAD2233CEE819B110367B3F9734E5E767C8C222B11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120028, "uuid": "a5aa303a-40a6-4688-bcce-f414bfef049d", "value": "12288:sspCOElpb+2pUpkNX6taKIt0nnuvzAIGtQZXZPSIy:s5pjNq0Vt0n+Wt+oIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622120028, "uuid": "745af197-9c91-4f5c-81a5-9eaa6f67af84", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622120028, "uuid": "211ba9cc-270a-430c-9140-0713f13dd079", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120028, "uuid": "18aa1ea0-54ea-44b1-93d6-a1198302f4e6", "value": "f1fcca46fd7af3f90aa67654250e7a05.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eda4a94-bece-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622107859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107859, "uuid": "a39b4841-6490-4bc4-8a83-d8a8242346f5", "comment": "Malware payload (AgentTesla)", "value": "c571503d8c0af02d0a942feaf1fb8d63", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107859, "uuid": "b4fb5dbe-bd2a-4987-b62e-da2e680a3675", "comment": "Malware payload (AgentTesla)", "value": "93ce66cb00a4916fb0949235dd4b009a54d7f1e261652e5f67242f407f5a245c", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107859, "uuid": "256bfd5f-66f8-4927-9e36-449b135d4cd4", "comment": "Malware payload (AgentTesla)", "value": "08413eb55d7c5ab2a5aba34dcd93aacbde60cb33", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107859, "uuid": "543901fe-2fd0-4503-ad11-f6570f1bab6c", "comment": "Malware payload (AgentTesla)", "value": "02936534b4d47804bf228c2459dbe8b2e67fe14dc6dd5cbdfb9bd6df7d755f0566a93824bd19c63abee639acd2a38dfd", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107859, "uuid": "b0a37970-793a-431a-81cb-f0f69b3f73dd", "value": "13542362703D0A91EDBB463167BB8A47B7A68C1B351EF334F2416DA9255801C2D8FC9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107859, "uuid": "a3f31427-0ef2-4ddd-9d02-f862533fa951", "value": "6144:YU9b3cUEHDOXkRgXOxBPSaCnIsBjihNslfIVDLk7cKxFG:JbMUE3CXESaFNSaLkwKxFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622107859, "uuid": "dccc153e-09cd-4838-8f4e-5436ed220929", "value": 283668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622107859, "uuid": "7c2f7486-e7c6-4b20-824d-9d5398d60255", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107859, "uuid": "cc2cf299-6572-49a5-8ade-f151045c81a8", "value": "ROZ MARINE - OUTSENDING.pdf.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81931f84-bf26-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622145766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622145766, "uuid": "8b78e131-8bbb-46a3-ab73-e21bdb4361fd", "comment": "Malware payload", "value": "0d8e4e4cb77789e49da24d653e7103cc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622145766, "uuid": "10273419-0a39-413b-adf3-ea81c02914de", "comment": "Malware payload", "value": "94f79b0dc581cd2d6248d127b414a902eec500e5264053b4c0ee40387b5a8fe0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622145766, "uuid": "8f7d04dd-0206-4b1e-9808-1f94acccf317", "comment": "Malware payload", "value": "724b3f9d74962bf122aecf236a773723991a7b1b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622145766, "uuid": "8ad093d1-290e-4060-9838-884e4af7b0df", "comment": "Malware payload", "value": "3156cc726760212c69ba93eff6bc157f3b24b66087eed07f1682aa53c56fcc18e4cf1a3f5d0c3828f4b4c8c04ee7d3fa", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622145766, "uuid": "c2f47306-e9ca-4019-85fa-29fcee01815e", "value": "34733A64CCC64665ED2EA4FE7423AE5160B0361B72B89B2F339EC4641A17F5819FF10E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622145766, "uuid": "b6e56398-344a-4d75-994f-099308e5c1ce", "value": "5d221dc60554fcc9da5be93f6cfc6794", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622145766, "uuid": "d9b01ea6-75ac-4e18-ab49-a59858fd1083", "value": "1536:f7KPOZ9PjBt4yuY01WpbNB3Ta3a4vmx2lJy39hXH9mRecA2Xrn1WHxQkYpSYA7L9:2WT7bWD4RzDi9uxocNpdg1tb126/kFZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622145766, "uuid": "cc71304b-023b-4ce2-a471-904f6a399d8d", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622145766, "uuid": "52da1ed6-4d54-456c-941c-8541129d42de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622145766, "uuid": "2c735f2a-217f-4685-be29-0d538cd44569", "value": "94f79b0dc581cd2d6248d127b414a902eec500e5264053b4c0ee40387b5a8fe0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb49a786-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622141595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141595, "uuid": "fe8100b4-f0d6-4b3a-a450-b6805f45c189", "comment": "Malware payload (RedLineStealer)", "value": "aaf9045fb6ac75c776ce6ed8c50447eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141595, "uuid": "f2e09dc0-3bce-458f-a15e-b4006f53369e", "comment": "Malware payload (RedLineStealer)", "value": "9521b61a783dfe09bdebb6f5ab1c138b5db8fba276aeacc17370c70ed9513ca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141595, "uuid": "454e0dd7-048b-438a-b2a7-0183f48ed71b", "comment": "Malware payload (RedLineStealer)", "value": "6ae5d0646d35d8fb4e15e19f88aa9d909c156014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141595, "uuid": "831b6e25-02d2-440f-b47a-099dc4739665", "comment": "Malware payload (RedLineStealer)", "value": "2a08867bd1c6e73155aaf2608a2ce2246ff9067499899f03e61fb1c66df80a5bd7524d1415c8a10fb6006dfc044f7d18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141595, "uuid": "83a78f07-9a31-4db7-8a3b-763789a79a2f", "value": "2424850DAB6E647AC5BF8FB10411F05E87F94593A8C5C6DE48D19CC5A781AFAD380B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141595, "uuid": "59e8e502-73b7-4ef2-8d48-1435566cdf39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141595, "uuid": "9029d8cd-0698-4149-8696-fbec93d2b8e0", "value": "3072:XKwmS8VU9hdQ1F+4GlRO9/bJGML1kTxbFJjvHcDtnchdGU/StRHFCDUWSd:6wmSgU9o1F+4Gl49/FYwM/UkDUWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141595, "uuid": "6b9e0cb9-3d76-4172-877c-fdf18aa609b4", "value": 214904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141595, "uuid": "3e9b1275-eedc-45c3-9b0e-fa4388384f19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141595, "uuid": "d92899b5-8207-490a-952a-5fa2b4d311cb", "value": "aaf9045fb6ac75c776ce6ed8c50447eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6ccd8e-befb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622127425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127425, "uuid": "a785f597-1a29-4a15-b212-4a4938c50dd7", "comment": "Malware payload (AgentTesla)", "value": "10b98f0ba9d035865d3cd513417a92c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127425, "uuid": "164476d6-507a-4e2b-8d9c-8e72f21c5b2b", "comment": "Malware payload (AgentTesla)", "value": "96d0811b5266193176882515669140eca93225f36654f09fadb760a66a66f8d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127425, "uuid": "83a64957-5495-4b67-9339-7d9415f5c3fc", "comment": "Malware payload (AgentTesla)", "value": "8b1935c8b2b501d229366c9d63588b17b9785cda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127425, "uuid": "aa3abe1b-d161-49f5-a0dd-93a2fbd75893", "comment": "Malware payload (AgentTesla)", "value": "5fc73fc5c80cb0891977fb19b5bb09014166327d237148908d209343a3ad07cfe9f1b6b69ad7646df224d2f26bbeae0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127425, "uuid": "b2e26965-2eba-4a1f-b895-b0e43beda476", "value": "9755238966D60F6BD27B8C704605DC3A85399F0D62079C123B7E769D85BE37283CE22D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127425, "uuid": "ef43fd46-9d7c-43cc-a7b0-ae34d5e781f9", "value": "24576:lSZUtx+IVRgkdpAiVUMh0bGB8vVEcbD2j/529Kv5Xfk+baHn1IDkL1sE7Zn:lSZsVRgkdphDWEcPI529Kv1fk+bamDkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622127425, "uuid": "08c65b11-6f38-44a7-be15-d0b83dabb4ad", "value": 1373696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622127425, "uuid": "1171e773-830f-4b68-b374-c746ac0c39b2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127425, "uuid": "b57f5403-1ee7-4023-ab43-a7f5bace3cef", "value": "Company profile and new order details.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39427c3-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622141555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141555, "uuid": "dfc76113-2c4d-4210-b876-41704d053dc9", "comment": "Malware payload (NanoCore)", "value": "d5170569ff3c354d27f4e71dcf53a004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141555, "uuid": "410c4d8d-7cee-4ca3-8e7a-ad68887293ce", "comment": "Malware payload (NanoCore)", "value": "97190ef2d03d62cbc49ab7f7edd2e8fcf202c4484a5e6873ce314e6de691abe1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141555, "uuid": "a57929aa-776d-4301-96ba-e55f72a81aa4", "comment": "Malware payload (NanoCore)", "value": "ae09965edde0c7101a708fde91fbfeabb4e47b8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141555, "uuid": "84e80d14-9aca-4665-81f9-3e3ad9823b66", "comment": "Malware payload (NanoCore)", "value": "9caa5da73472c86711b79cb1bb6768d243b545cffe3b18b221003e6c0ab1a9a15883fb57f14bc38a5b35e29751780cd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141555, "uuid": "4751b2a3-dc39-4b83-9a4c-eaabeed07d59", "value": "4DD4C8FADD458943D2303673EF61B7329F294FD8B1A22005E21ABA527035F9E892DD53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141555, "uuid": "716996f7-ca67-4bb5-be36-4410c42f6d1b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141555, "uuid": "f666ee33-3848-45b4-ae16-f19bd710457e", "value": "6144:5QqfipsvVV5kULbee1GRXAOqdNWViSMw8dpYZk8Kn/Eixct:y4kU0m8Gwel/7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141555, "uuid": "0fd585e0-ddc7-4010-a384-72e8e3c8bc39", "value": 635554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141555, "uuid": "b5777def-aa83-45e3-9ba8-8ab0b1e78a52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141555, "uuid": "09684e33-116c-477d-96bd-7f2b982ff712", "value": "ORS10832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6006bba-bee9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622119762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119762, "uuid": "2124556f-d342-4c39-83c1-10e86be9e4a4", "comment": "Malware payload", "value": "a41d192c3e0ce358bc1668f2365a2ac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119762, "uuid": "96ebaa9c-54da-44a5-98cb-2773046b67c9", "comment": "Malware payload", "value": "975b503dc323fc6d23a46d800bb2445bbc2491c542f9a8c041fd38fdd0f4bf51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119762, "uuid": "7834226a-ac45-4f0e-881c-766a2741b355", "comment": "Malware payload", "value": "c6c2e46a84a89fe89f8be276198ec20d08470e80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119762, "uuid": "5152055c-0cf5-4f25-b7f4-72bf5b54a5d7", "comment": "Malware payload", "value": "9fdba1cad85939cf2c5e74aa01616af3e36acd2d10083ccd721fefd741d76962ff86fc86657e74225b6aead4919a16bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119762, "uuid": "112364eb-c3d5-4c2e-94aa-0663b337f018", "value": "DC3533C0A6BE1F92E0B8C3797D748F5D58E8B6096B17C2CE69A13B09C4905602FD5D8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119762, "uuid": "eb0a0dd2-77ea-4536-98c0-d137d0ad5c00", "value": "24576:zmEkI6FGtL1Cmkg4jzj3rBT4pgl5MS47xPVZDS2/i82:zm2AGtwmLkzj7Bvy57xPV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119762, "uuid": "3ae72708-f84f-4ab0-a512-7548374d8baf", "value": 1084299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119762, "uuid": "5fac83f7-c049-4d2e-8b22-d5dae930b6ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119762, "uuid": "9d46b64c-4bca-46ca-b4dd-af33824617b9", "value": "a41d192c3e0ce358bc1668f2365a2ac8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3401405c-beb7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622097962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622097962, "uuid": "33c7b91f-caf1-4494-8975-c077d95bac08", "comment": "Malware payload (RedLineStealer)", "value": "a38f94e5562e47b82e26da230cc8783c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622097962, "uuid": "87c2b7fb-18d3-4c38-aba9-3c8e7d7df4d5", "comment": "Malware payload (RedLineStealer)", "value": "985fa560929dee5963dcf094dcd77fb07621c9a1e3f5d63f769f8b41cf322e2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622097962, "uuid": "2d1b6386-98d0-43da-b706-3ae7c730b8be", "comment": "Malware payload (RedLineStealer)", "value": "27e7b7ec8072c5e96a43b3d0344c7d480a2aa6a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622097962, "uuid": "f1198a28-42fe-4136-a3f4-798cf83cd1f6", "comment": "Malware payload (RedLineStealer)", "value": "8c20a1ae418391d4e7784b0aecd1a8af65e7584fd2c556b4c31cbb4bacefdb8a5b753a6f8528f9004bb405e0dc1c88cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622097962, "uuid": "72d6e72f-6a22-4069-97ff-23d699b1eba1", "value": "38849E2067A0C035E5FF22B849B99379653A7DE16B3490FB12C536EE56346E4AC3078F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622097962, "uuid": "8da4d4b9-1159-4587-ac25-e18f6c36523f", "value": "769049f8e01ecc40b9ce31916b22312b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622097962, "uuid": "ee7e70ab-9f51-4f8d-bff9-ddf6fdd744e1", "value": "6144:EP15EMlkSLDxdNtMoid587PCXQH/TYfcsD2oIrXSLXsTRV:EPfEMlTDxd3y58uAHrYEsD/IzSLXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622097962, "uuid": "2aa50c8d-e456-4faf-bfcd-bfd91733cca7", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622097962, "uuid": "bd550ce3-bf7e-41ba-835d-78c06455c331", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622097962, "uuid": "c4951e93-7f4c-45cc-ada8-65938ec095b0", "value": "a38f94e5562e47b82e26da230cc8783c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99153a1-bee9-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622119688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119688, "uuid": "4b9ddc08-ae6e-4f4e-9f38-e77d3325ff1a", "comment": "Malware payload (NanoCore)", "value": "afe6e8f786d993982bf3a6675fbd1066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119688, "uuid": "9fbc737e-200e-41b9-ba09-537ee0b1972f", "comment": "Malware payload (NanoCore)", "value": "9897b70f55d14fe5bf7ef5170ff83257fa5800361c953584982f7437239f19f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119688, "uuid": "2f3f7b5b-25e8-4ff2-a08d-c7a34121e88a", "comment": "Malware payload (NanoCore)", "value": "8976e2fbe3c7dbdfcf0ca608f98f04c1ff605add", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119688, "uuid": "d6f6441b-c2c5-41df-b58c-c98ddbfc51de", "comment": "Malware payload (NanoCore)", "value": "af0217c20a53ce28da10d45eca01d7cdf389cdbd4c0b9f9696f4dbc65c2047460696862c955285e8ef50fe49523e04f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119688, "uuid": "33dc7190-9631-44c5-8a74-68c62985782a", "value": "5C954BAE7650F69EC42BCD76C9641CB0EA90BC6A8307D30794037BDDB96D5DACE440E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119688, "uuid": "22f76a3e-be51-401a-8241-1c6d1faa284e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119688, "uuid": "a7aa401a-1c06-4b02-be7d-4270dbaa8158", "value": "49152:IOJuzRg3Og2rFipvAFB0o3F85/oib3HE:Zuzy33oj0Ao/oib3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119688, "uuid": "d955a605-2b1f-4685-ae91-3ea55b69491d", "value": 2061824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119688, "uuid": "e5c4e6ae-9592-4424-9dc3-5495f196f230", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119688, "uuid": "77a94344-274a-4ac8-ada0-9ac1acc9af48", "value": "afe6e8f786d993982bf3a6675fbd1066.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8e5851-bead-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622093978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093978, "uuid": "c2b10e76-fe07-4bbe-a057-50cc09e1289f", "comment": "Malware payload (AgentTesla)", "value": "dfa0336fff1699a309b348f67f91e7a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093978, "uuid": "2ddb64b5-730c-4b90-ba30-bf800ea6b856", "comment": "Malware payload (AgentTesla)", "value": "9c945fc31639ad3a22b019d3b159e66a8df4a28872576f429392fb4dc64ebb01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093978, "uuid": "db5ed149-9ae5-4fcf-a4b0-8b618caa2f8d", "comment": "Malware payload (AgentTesla)", "value": "551119eadb3fa9e8a47ba0b956f7513b8310c074", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093978, "uuid": "2a210cf1-e971-4a07-af47-e99fee9d0239", "comment": "Malware payload (AgentTesla)", "value": "c6169c498c3f97b180eff13fb9a16263a0237869657629376694c4898fa08a1447e3404c1fde75cd5e86f000313aaf5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093978, "uuid": "6318785c-bb72-42e9-9972-ccfd54e659ba", "value": "7974221561F04A9FC6935EB091B29AAAAFBEF3154034422B37D01F3F68520D6EE37563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093978, "uuid": "170a3bbd-9e75-473c-8759-239cda0a77b4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093978, "uuid": "6808c758-8cf3-4150-95bb-056bcea2f41d", "value": "6144:cQq28HKGrqq9didEE5GTKHrtZBH9Yflb9pECyGhFFmYp8v8wTDDrqCbl/SFZqrLc:P8qGvqR5GTqXderaIFtpkNTDqCheZqnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093978, "uuid": "bc5a8018-e903-45de-9a3e-30122d5828d1", "value": 352041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093978, "uuid": "2a7df431-9877-425a-b4f9-9df4678bf631", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093978, "uuid": "efb3c8b4-5191-44fd-b6a6-51be34083ff3", "value": "PAYMENT BANK INSTRUCTIONS COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a11fc0-beac-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622093534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093534, "uuid": "032058f0-8391-4308-888a-c54a2a185d30", "comment": "Malware payload (AgentTesla)", "value": "f050e56ab676181725f01ef44c4c9123", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093534, "uuid": "0eb4b47c-d0ef-4e4a-9f9e-fe5a3a32b077", "comment": "Malware payload (AgentTesla)", "value": "9da6954c23239e9dca041649d884dea2f7d1bc04414e808a9c32c216c2033e2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093534, "uuid": "ebf71872-bf41-4d04-9b4c-09ad015e26a1", "comment": "Malware payload (AgentTesla)", "value": "377f8635532ffd7cc3e862576f13cf5f54a2dfea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093534, "uuid": "80de3fc6-5cf2-4143-8d19-b3cd7d14bb76", "comment": "Malware payload (AgentTesla)", "value": "91e2f5b361fcde6be424eb29b794d01eff9cd961cf32ea331fecb7336ddd77fea72234fb880a90bd2eb627936a24be5c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093534, "uuid": "be096863-c01a-4e81-bcc5-379a67177ed2", "value": "40D423AEE82B6157F54360614D5A7A1CBF839B56022ECE839D7C81D9C4370D9B7A032F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093534, "uuid": "6d08fc7a-7a8f-4917-a593-18e7ef417409", "value": "12288:IsSIYwT24HQ1gxiGRyspTMevPxMpfxstdx27Qqw7WpUb1sxFmnGKNMzDt:RYwT24gAiGRO+PxC23x28kmbexFrQM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093534, "uuid": "9d33b017-2317-4169-a280-359c9cbcda82", "value": 608257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093534, "uuid": "a3687074-acb2-44c9-84a5-1b4584fce969", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093534, "uuid": "20be6f3d-1699-49cd-a174-1a9da9160135", "value": "PO QT-028564.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94324b9c-befb-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1622127329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127329, "uuid": "8b362f9d-aaa3-4e3f-8247-50f49e634f5b", "comment": "Malware payload (RemcosRAT)", "value": "598e215ffad7643560b4af24780e4e2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127329, "uuid": "d7a93ff1-0f5c-49d5-bcf8-15e655d6fd71", "comment": "Malware payload (RemcosRAT)", "value": "9e52548cd00b9ae163728782879289b956be03f0241b14062e5359175ae1ad7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127329, "uuid": "f725d090-5d68-49bd-bd51-f0d94a449272", "comment": "Malware payload (RemcosRAT)", "value": "d095f323d5a275481b7caf0bc6fc228b91ebbe1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127329, "uuid": "b3988e37-829f-4828-8651-ada9e41961ef", "comment": "Malware payload (RemcosRAT)", "value": "e4adf5cdb275e3241d687358a30cb9ed86b977e6a9740b4c27d039c63df176ba480f11704e90427e88b346a49da6018d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127329, "uuid": "191c7e3b-cb1b-40bf-8548-60845ccc661e", "value": "60D2525FDBA66AF8FC16D7B83C3B59564B30BE6EE026252B20C571220CE36174433A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127329, "uuid": "b870a752-47c5-4a45-95b1-b7cddabfab5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127329, "uuid": "0cb288ac-0a1b-4aae-8f29-d2b5a4ce0e75", "value": "768:sNbczxmAzUr+ePbaMXz5pVwvQBA0aXRgrKyf3eTzs:ebc/zUr+ePbaMXz5pVwvQBraXRgrKyfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622127329, "uuid": "b6dcd70f-9ea6-4db9-b640-b0e337e376c7", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622127329, "uuid": "497b2cae-144c-4d9e-a8ba-57b3334a3605", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127329, "uuid": "fd27fd45-a9e2-48dd-938e-ed012e0fa0c5", "value": "598e215ffad7643560b4af24780e4e2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c201f8fd-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622141579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141579, "uuid": "c013c749-a14f-4605-8a14-f6fcf1965665", "comment": "Malware payload (Loki)", "value": "e578d74dad390b508c64b84335a8ccb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141579, "uuid": "cedbe1c0-b410-4a0f-9629-71f4fe3b4539", "comment": "Malware payload (Loki)", "value": "9ef305091f40e275d536c509669d30ca345e09cf887bb77ba01099e7f6de3ec5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141579, "uuid": "9f91813b-f1f1-4247-b11b-df23b7f4b080", "comment": "Malware payload (Loki)", "value": "89cdcf45f58afefcf97455fb54dd1e634139cb49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141579, "uuid": "a4a8f441-e1ee-46c8-910f-edaa1cfc6207", "comment": "Malware payload (Loki)", "value": "dae7589d6d917f725a7fae42dd8e4424cf209d7f524cc90dbe0c97444c0c5059801903760374a7335498caebbed3004e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141579, "uuid": "a31b01eb-a973-46b9-a3c2-e3bae1279dab", "value": "84457C67B39144F3C1220A34ED1797A8A826BF30393498567BE12E0D7E7E3417D2A6D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141579, "uuid": "3197fd21-55e0-4f6b-bbe6-a181142095a9", "value": "f537b216fd1d228d82b4c032326b2d86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141579, "uuid": "222d4105-6e72-4862-9c7a-988cf867cfdb", "value": "12288:14rDy/HJMbgSSxbAQ3LkDJ1iqZ6egzItpFSofPv01jHvfbQOpwYNsI:14qmjSxbL4DJ19AegzItPjc1j7QWsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141579, "uuid": "0fb591f0-4a50-46ce-93e2-93bb61f552ca", "value": 1192568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141579, "uuid": "cd33307e-0372-49db-94d5-1baf50168479", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141579, "uuid": "b96455f4-1862-465a-86cb-8ec368414bcc", "value": "c1d25edc-2df8-449b-abe2-5185c1b9b0eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8987a15-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141537, "uuid": "4d60d67f-f788-4516-a16b-87914c4f73ca", "comment": "Malware payload (RaccoonStealer)", "value": "e78ebace30cf6bb0ba970ab285244bf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141537, "uuid": "971dc40b-3ca1-4425-bd75-ccac828e20df", "comment": "Malware payload (RaccoonStealer)", "value": "a03efc41514b08958e5597ebb2e1b1e758d1c4ef8d991248626122ec2773c811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141537, "uuid": "391a8c24-bd4a-4f8f-872d-e4e1543994e3", "comment": "Malware payload (RaccoonStealer)", "value": "2fdb557da599ef7792c5393c5f1731f4d6e6b313", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141537, "uuid": "359b3cc8-86cc-40e6-8221-90c775fa3495", "comment": "Malware payload (RaccoonStealer)", "value": "6cdfdc3067503a0cd076039a2f1e8dfbc95da28682e4eb59c0f4b684e42a3bc5ede2d692db4f47f4af1490f15d94a4b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141537, "uuid": "8dd537e7-e3d1-46a4-813f-8999079b6138", "value": "45C4D0316691C035F0B7E2F449B5A27B693A7DA1A734C0CF62D127EE56786E0AC30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141537, "uuid": "a5055197-3ead-4ca9-bfa2-9ad0e9038465", "value": "cb971fcf399235e4e9a69622d3809fcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141537, "uuid": "037915c0-72ad-4910-8890-7e4157efb5f1", "value": "12288:MHB/iFx/sGlVuK8rSHaVxCIw5E6IfIqbmzIWaNdsu45PUOSp9OK:MHBs/4IaVbweHfez+uJMOSp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141537, "uuid": "e9a3c594-9468-4f3f-8820-13221e3cc849", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141537, "uuid": "39751764-9686-43b8-bb21-8809cbd69d1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141537, "uuid": "6fc11415-06b6-4d87-a82e-dc6176c1a4d4", "value": "e78ebace30cf6bb0ba970ab285244bf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9331e0-bf09-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1622133353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622133353, "uuid": "34e79f96-7e68-4793-b62a-6c1bb626e67f", "comment": "Malware payload (DanaBot)", "value": "3a4f82c8bbd97fd7a8e6878c59921172", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622133353, "uuid": "251721b1-a6de-4272-ad6f-9e335cb59d5e", "comment": "Malware payload (DanaBot)", "value": "a0adb7d7f0a24b3882b1a9c4ce48c4ab23de093845dc6e949d6d036a64a33762", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622133353, "uuid": "9813fc18-d675-455c-a9c5-c82d364b6821", "comment": "Malware payload (DanaBot)", "value": "27064e3c2453f4833265e5d0751aab9dff57e3db", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622133353, "uuid": "52aee33c-853e-44bb-8193-d3d24ebf2058", "comment": "Malware payload (DanaBot)", "value": "80cef19782944b29d727c5759d4bdb5ead0a8a443294decc0e6ec973ac2679f589f624873455b03540f9b4bef1d42ebd", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622133353, "uuid": "51b14ea8-9cda-4d11-958c-1094df319d27", "value": "035633306361C439EAFA43F98879C3B5B12B7AF1B73455C751C02BEA5AB85D4A831E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622133353, "uuid": "696254c5-b7aa-41f5-aadc-d81e62f2352b", "value": "0693a6a9ad49d4475fdba0f7412d435d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622133353, "uuid": "52fde24c-87d9-413e-b7b1-f93f96ff4eb4", "value": "98304:8WmmaJBa9RsN5QeXHAIAB6/HyscEyquOsIqaQfO2dSvAMRVg2/3Y7TL0G2i2:8FZJN7HAE/rfy0sPW2b+JYXL72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622133353, "uuid": "cadd9d36-125b-42d9-a976-5eab81c6b36f", "value": 6312448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622133353, "uuid": "79cd393c-9ab8-4c8f-b196-986868b7efac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622133353, "uuid": "a72f4a8e-30c3-484e-a939-8595d40d4e48", "value": "SecuriteInfo.com.W32.AIDetect.malware1.29531.26956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c140a8e-bee3-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622116927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116927, "uuid": "7cee813a-6201-4e9a-8a9b-0a08b51ba4fd", "comment": "Malware payload (NanoCore)", "value": "9cfca42d00e604499884cf66bfb4626c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116927, "uuid": "fe3a2524-fd1e-421c-a6e3-45b2868f19f7", "comment": "Malware payload (NanoCore)", "value": "a1fba3b877a576f41850e0696a9ae45e4419de786d1fb2ed164b2c3c0aa97917", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116927, "uuid": "16d23cd3-51c2-499e-b086-d68e0084a9e0", "comment": "Malware payload (NanoCore)", "value": "28f5073bd547a34de2d3439e869442cf44237672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116927, "uuid": "84c2cea8-929b-434e-bcd9-61f4eb6e3e37", "comment": "Malware payload (NanoCore)", "value": "e4f5e4165afafdff25b89d30b30b6ee7aa21208969d3519fcb327f198b498ab545d768f57f7e6a665234b6605d0e04f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116927, "uuid": "3258af20-086e-44d9-acbf-651b19cc5722", "value": "BAA4122D135DBA9FCB7F05F990904205673AD22EAD67EFC5ACC8B42428A73D742067D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116927, "uuid": "2dbd8b63-a37c-4b9c-b759-72bb80a2b1b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116927, "uuid": "776d8adf-3b8f-45d0-9e3e-ace67abc1aa7", "value": "12288:SRtkAc8DlJr/xyWcuZpXU6UTK1Vj4dklmVsg:Ctk5UJ7DZ9U6U6VLisg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622116927, "uuid": "0cd8874b-e283-4445-95b1-c6e76ff21cfc", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622116927, "uuid": "27ae8ad5-ab12-4655-85b8-c7091cca34be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116927, "uuid": "de137cd3-a954-4bc0-a961-eaceaf35c38d", "value": "PO-13916.jpeg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ae207c-beb2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622096002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096002, "uuid": "13cd80cb-3a3b-4b71-b8f4-5c0256456fe5", "comment": "Malware payload (AgentTesla)", "value": "b35814e693408e2da987aa999f015aa3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096002, "uuid": "7a3de971-8820-4969-89af-78638739784d", "comment": "Malware payload (AgentTesla)", "value": "a23b931325a1dce69774cf5c6bfbfaa23da07af70043e0fe48db72086a5dc6e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096002, "uuid": "5fa9ccab-6ab7-49ef-a608-352fa199c2bf", "comment": "Malware payload (AgentTesla)", "value": "cde64af18249d029110e4e0b3cd97020e1d79045", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096002, "uuid": "8058cb4f-aca0-4ac2-a276-08f8a5851cb1", "comment": "Malware payload (AgentTesla)", "value": "4b21bdaf17b2872c52a714c8ed04d65081f8e89618237f24851fc1d935f1e304048ab8e7f9d7291436b98a759297edd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096002, "uuid": "09005c78-2339-4988-a149-038c3822b664", "value": "B9F48D1C21E8D266D1A8C6B48ED5E42FD160F9377112BFE4ECE607B51B17A4278A207F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096002, "uuid": "2d327c75-9291-4535-9aae-4610aafab0d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096002, "uuid": "1985a225-e457-485d-b345-9f35edc491f4", "value": "12288:wGty6zdWECppbC855k4XCPZqjmOmirT2tJZMrGnhNqhCvzEsqW0I179j:wlqd7M5k0Yq6pirUHAyq01q9C7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622096002, "uuid": "c72fd50f-7e54-4ae3-8e53-82cb3c206e4d", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622096002, "uuid": "71c38818-d46f-4af7-a939-366f74c3f900", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096002, "uuid": "aef9a9d6-4770-4cc3-994a-98624f4989e0", "value": "update on prize list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48146733-bf29-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622146958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622146958, "uuid": "8437f6fd-8b4f-4f85-8cb6-ebe27deab6b8", "comment": "Malware payload (Quakbot)", "value": "c1bba7e3677c3ae89c02b92f74ea8071", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622146958, "uuid": "833e9b5f-e362-4fb8-ade6-1abb573cefad", "comment": "Malware payload (Quakbot)", "value": "a3e5edd3fd9a6c1ad3786170ca0bb08e07ebccc2385bdb0541b59d5f0b41eabd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622146958, "uuid": "fa7c2b7e-349f-4e2e-8c36-fa3e7c9b8d18", "comment": "Malware payload (Quakbot)", "value": "41d5558a5e2bf9fb7d3f7b868267a0537cce72fd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622146958, "uuid": "0a5f0efa-e52f-45d5-84de-ca5eea8bbad7", "comment": "Malware payload (Quakbot)", "value": "a8b0ea3ab2590c7f360b3e86d3d0366b75e2fc4c8decbb8ca338b12d48b3e805f13ace2fdcc8a8223d79a067c7969081", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622146958, "uuid": "bc7cf640-e74d-4365-888c-14d2fdc30b95", "value": "53354967A7DEC412FB231FBEB1839A4404F2ECA32132553E45E03619FD76AB02896774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622146958, "uuid": "95937366-ee6b-46d0-b9d8-a66e99f714dd", "value": "0ccb108307084b188971b94863fe8bca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622146958, "uuid": "98d1a9ca-3b3e-477f-b573-810f2d9df3fd", "value": "6144:eu50+NCirQ6TBByIeJzt93S0EE8cuFA6Epnznitg8055EX+dridQs5SDoXtq:eSVONPfzit1055EX+dWn8Do9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622146958, "uuid": "3d6c731a-9589-403a-a589-605225df1490", "value": 1089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622146958, "uuid": "ead63b2b-b7bc-47aa-885b-c90159873e3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622146958, "uuid": "12ce59ac-1a4f-47da-a2af-8e89210e2850", "value": "c1bba7e3677c3ae89c02b92f74ea8071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62686bcb-bece-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622107918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107918, "uuid": "c3b67a57-a6cd-4e6f-9a89-4d28c8422f69", "comment": "Malware payload (Formbook)", "value": "4e9896e40dba8e4090586eec2b126622", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107918, "uuid": "ff1b5900-a3ae-492d-943a-b2fd57c75c2d", "comment": "Malware payload (Formbook)", "value": "a581540b37de1c11b9ea8b2ef286c73f54147dbd4013c1a3dbb3b6f9ef280424", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107918, "uuid": "2e50d9e3-ee37-464d-b880-c54932da79a4", "comment": "Malware payload (Formbook)", "value": "6f1e14a1b5b76f72fbabfaa56581d891abefe4fb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107918, "uuid": "c871752a-6c34-46ba-b2dc-6921851127f7", "comment": "Malware payload (Formbook)", "value": "3884626df5a8dcd2d6f2caaebb1dea147395a40b0279f1585894724e42d3be83ea26e0987ef2106d196fa22d7b31128d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107918, "uuid": "953477b1-6bf0-4976-afb5-c63ff347b87d", "value": "A1B423F25FD31043453014CE8BA5E26DFA75067C9AEE5F44EF8AF62895B03028347A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107918, "uuid": "883c907b-cb78-4d69-8a27-3b4706f8ec88", "value": "12288:v2Ief8EmE25LhN+AqY6Zv/NTsbxwPO2xjCnjJ4Aby8dD6P1:X4822hh+ZvVQwWIjCj6dP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622107918, "uuid": "37b909eb-ddf8-46b5-b4b5-a5bffa80da8a", "value": 537383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622107918, "uuid": "ae44faaf-46a3-4f7f-a0d6-a634d7faaff5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107918, "uuid": "179deff4-bfe7-4b62-b319-31224388076f", "value": "PAYMENT INSTRUCTIONS COPY.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14df7a5-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622141551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141551, "uuid": "765a93d4-0908-4fd6-9131-58d6aefc4bec", "comment": "Malware payload (RedLineStealer)", "value": "8c77f0cc64d843a90beef1948111b693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141551, "uuid": "7efd30d0-43ba-4cfa-bcd7-d787daa2cf5b", "comment": "Malware payload (RedLineStealer)", "value": "a5a2471193648c16e45c9c053c8672a3f71f21862388ca86d37f26e0fb17328b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141551, "uuid": "92f04576-ff78-4701-a402-7a8f746e7f35", "comment": "Malware payload (RedLineStealer)", "value": "287df7ce401793e2a6db5ba88a279a5ec05ce60b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141551, "uuid": "00acd1b1-b5c5-4339-9222-5f1b9907848c", "comment": "Malware payload (RedLineStealer)", "value": "e5b570560ea4a85fe971939b31e4e317b06cde20b54ddbe4b91fa95d2d6c0b6ec1656b73ac403d349eae1f93d89c36a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141551, "uuid": "51845935-072f-4903-9287-cb2b553bc7fd", "value": "94748C256794DD1AD73D0B3954F0E33982F85E923E16CB468E80BCD73F23F8A6905692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141551, "uuid": "4dc6b7de-404f-4d45-81fa-9332cde36cfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141551, "uuid": "fd71bf5f-30d2-40fe-b2f5-a95451833967", "value": "6144:Phw5xqtUpf6AlUrmgjMeEndB3JcwwvJmYKE5ZnVnRnx6pUQkXFwoD:VU5KrzjM9ndB3Jcw0mYn5ZnZ6pTkXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141551, "uuid": "f869687c-ecd6-4186-ad40-2233099c7abb", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141551, "uuid": "e8cb3e77-0280-4350-bc1a-aa958368ccf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141551, "uuid": "7510b12c-b9bd-41d8-87c8-6723e0f6fb72", "value": "A5A2471193648C16E45C9C053C8672A3F71F21862388C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b003b6f0-beac-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622093446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093446, "uuid": "316016d5-2814-4474-98b5-e893c9a8ce81", "comment": "Malware payload (AgentTesla)", "value": "4cdae6ce12663a8ca59e0996ca4b27fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093446, "uuid": "7d26e164-e414-4023-8fc4-a37ee32881c9", "comment": "Malware payload (AgentTesla)", "value": "a792c75171ffe33735115662b89bb58635c750e2405cb30556faf96e26769c8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093446, "uuid": "e89b45db-07dc-4e3e-920d-97b70562e262", "comment": "Malware payload (AgentTesla)", "value": "fed182557965c63e8216764f901a769b829fe6d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093446, "uuid": "08337744-cb5e-458e-8aa8-86bed9758b77", "comment": "Malware payload (AgentTesla)", "value": "2ccf9b14bdb36fe15b5399d0d85bbe1b8b70972d5002c7b4c7b47d89679c82431c73a20d1a7eaaa0b550acc0a13b6c97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093446, "uuid": "3fee018c-3ae1-4394-af00-1e4ad03806a7", "value": "6B156C343AFA501AB173EFAA5BE47596DA6FB7333B07A45E1050038A0723A81DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093446, "uuid": "ed9dd99e-fcb3-453c-a026-579d54679bc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093446, "uuid": "1532931a-a1d3-443d-965c-6e81e6a9b635", "value": "12288:VmzFdT40x10xEbPAgO3zlVnc3SXHQMoT6U7VgEvWTtZ/LGMDnUmiODfVBOH1n+Ax:Y7R1AAe3KSglva/iO1hph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093446, "uuid": "1dd366b5-7908-4131-90d9-9b10c14c8c13", "value": 955392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093446, "uuid": "fa6493e0-6d76-481b-9d94-6b66fea6c9dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093446, "uuid": "09e46750-d1cf-4721-bff9-0179a21f9e19", "value": "New_PO-N3100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49bc2dcd-beea-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622119903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119903, "uuid": "7645434b-54c9-4900-958f-f5aa84fa0fc5", "comment": "Malware payload (AgentTesla)", "value": "6adc941dcd82ed0869059fbdb520fc0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119903, "uuid": "e1d98522-142a-41a7-981f-da880a6f01a0", "comment": "Malware payload (AgentTesla)", "value": "a7b09f2170a091acc77e7c7136215d4b6c224b1cb4c6cdbfcc1d91a57f16874a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119903, "uuid": "7d18c6fd-02d7-4fab-ab68-1be268845692", "comment": "Malware payload (AgentTesla)", "value": "b0a78612431591f5a9aaa6616902cfe5c105d56a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119903, "uuid": "0a447779-993b-451b-a4a7-5a2046fda866", "comment": "Malware payload (AgentTesla)", "value": "031364bd1781a1d498b3c98c323117b6343aacb4130e5619af04d18890f274ad7c0f268121c2e94cbca6d6858847f399", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119903, "uuid": "d3031808-c9bc-4523-8dc7-2c2e1445eb53", "value": "0CF48D1C2168C627D4ACC2F48DD5D42B9160ED7B7112BEA8A8E6377A1B37743388257F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119903, "uuid": "d67ccab5-b245-48e0-a21c-749bb01b0da5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119903, "uuid": "f4aac0bb-2cc0-4048-b26a-ffb880b62e2a", "value": "12288:nut5d+wejkgnqCezGS+ozz2ioU4rAEAmD:nWdmj3nqCL8C//A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119903, "uuid": "f97f7a19-5cf0-41f1-b8b9-e690c806aff8", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119903, "uuid": "e09d4cc9-2f0e-4742-8630-ef271eadbd13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119903, "uuid": "4f91b014-f53e-4662-924f-c936c86d76ea", "value": "6adc941dcd82ed0869059fbdb520fc0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aac6adc-befb-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1622127313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127313, "uuid": "d2841bf4-93db-43c8-a8a4-0ef0cf367d40", "comment": "Malware payload (CryptBot)", "value": "98654c7c4e4c6918f4ade4d362303338", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127313, "uuid": "d03d0450-e3d3-4773-afa4-d22c2a57217c", "comment": "Malware payload (CryptBot)", "value": "a7bf876bdc63dd748b386d788b9755396257accfb4cf74c27e90b37d0eeb4cb2", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127313, "uuid": "3ec8672c-936f-4f1a-bdcb-0ccc325bedeb", "comment": "Malware payload (CryptBot)", "value": "914429ec1b4863d798d13e9162c807b11cac974f", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127313, "uuid": "9fbd0296-2749-43de-a25b-a1f5116512c3", "comment": "Malware payload (CryptBot)", "value": "fc89cc503e805c0f4ee3f8f91e4b1bf93f122ab9828a97d4ec80a30785c64814b1078b4beedf9d7ea8e9d3da812c5561", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127313, "uuid": "394156ed-d3df-4cce-bc82-afa228520f60", "value": "0885231372C9E4F6D6D37A70A4497B2D0837F360072486FB97609C1A7A269C2B37D64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127313, "uuid": "e8cd0ede-2b74-464f-ba4e-d7fabda40b5d", "value": "011a034751880c1944da3b5ecc18520d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127313, "uuid": "f6712c35-a731-4a72-ba8c-9b027672360d", "value": "49152:JGDQL76S4mWrMijB/fWDrZkvPNaTI3/lD5Sm:JGScDrljStEFaUvJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622127313, "uuid": "dde86c95-1855-47bd-8adc-329e40060108", "value": 1767555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622127313, "uuid": "cb1c3050-34ae-4a02-abae-e78d8c89b86a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127313, "uuid": "bc0e1f2e-7626-4f73-bd1f-d9fae49971c9", "value": "98654c7c4e4c6918f4ade4d362303338.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0f825d-bead-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622093659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093659, "uuid": "2abc3bd5-61ee-45e5-8bbd-c6a51cbddf0a", "comment": "Malware payload (AgentTesla)", "value": "022095d6016cd5d5c85ff74724147e14", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093659, "uuid": "404993ba-30c1-428e-b412-7b69343c3743", "comment": "Malware payload (AgentTesla)", "value": "a9008e9a58111342b709c67862250741f5363222c0b4bd3111e4f78cd434ee13", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093659, "uuid": "01d58f1d-5ecc-4bd6-beb2-3d30130bf280", "comment": "Malware payload (AgentTesla)", "value": "30b2a197dbbf3284d3cfab3b0d552e03836db052", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093659, "uuid": "4395c9ea-6990-403f-a476-eeb4a3d29598", "comment": "Malware payload (AgentTesla)", "value": "8ea72753b5e07fa6c252b04deb8d2cad3478dc9cb66102738f374db064535b0017a1317494d48a732f8e9d676468028c", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093659, "uuid": "ea40faa0-37f9-44c5-8c54-cfcea454b235", "value": "CE9423D367862B1CCB182EA52B614284ECCF663A8DE5CF83A4D335499435AEF01D7F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093659, "uuid": "5f40c6d3-47a0-4ce0-9644-e028094c4621", "value": "12288:x8F3+oxXpUN9wKbca7OnyaNUHRkH7PyNh:x8FBAl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093659, "uuid": "b8b6e414-a1ad-44a6-b9cf-2c4605cc9bae", "value": 422337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093659, "uuid": "762f755b-a35b-46df-a28a-0573ee22ba14", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093659, "uuid": "6d097726-4b4e-4d21-ae69-0045ecc2883d", "value": "210525_332641-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b76264-bed3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622110013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622110013, "uuid": "c144f4bf-fb16-42cc-a87a-95e5163f748a", "comment": "Malware payload", "value": "f5e15338e5b01a9f2067c0caf7ffc395", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622110013, "uuid": "b4583109-ebe2-46d9-becc-5ca8d9086389", "comment": "Malware payload", "value": "aa435c4da9fa1bb3bb186a0bce1fd9710c227b8d72fa82d71a426df82c236eb1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622110013, "uuid": "f517690d-02a4-4642-86fd-efc194814cc5", "comment": "Malware payload", "value": "c321a2f1f06421dd4fe5633be98f8dd18f42d766", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622110013, "uuid": "ae972d82-23dd-4708-8bed-a4af66f88dc9", "comment": "Malware payload", "value": "bf3b4c621581aa291050c66f263a3afbba21977870259f8c18bf7e3839d3d16abf6bae45f6b232508e1837fb50c592f7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622110013, "uuid": "ef8110f9-037c-4159-ab82-d0fb3cf8cbcf", "value": "96260108FB649884C023BE745186A187841B43992EDDF1BF2F59A4D839A7C852747EFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622110013, "uuid": "e2921e78-7729-45c4-8d3b-108fd3e062b9", "value": "98304:j7jSqpd/3bqTSQ0ZVrROlslbRVXv/y4i5gPHcpN6A6/YW:HjpT/LqTS2lslbRVfuOHcpOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622110013, "uuid": "7b3f85a6-dd9a-4475-b5e3-b6f25f6ed46a", "value": 4571292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622110013, "uuid": "2e06206a-14d5-4a9c-8133-621d5dedd579", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622110013, "uuid": "2b8d58c8-d285-4a37-a525-5daec285eefa", "value": "SMP174.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884f4a26-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141483, "uuid": "62126e5b-e8fe-44b6-b8bf-2c4e95c0bd90", "comment": "Malware payload (RaccoonStealer)", "value": "1bdc796c65db06ae38ccd0bdd8f63352", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141483, "uuid": "9857f053-f8f7-4614-977b-f9c2871446af", "comment": "Malware payload (RaccoonStealer)", "value": "aaa2cb6625bf64bd157d2e13efccaf98c0c36b29bbd8ffb7c7216240307a30e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141483, "uuid": "1180429f-449a-4438-be49-aef9d6097220", "comment": "Malware payload (RaccoonStealer)", "value": "b74bc562e093ab8c131bca0e60d9b54d9edf937f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141483, "uuid": "f8ceb68f-6e1f-4df0-9e00-332d71768728", "comment": "Malware payload (RaccoonStealer)", "value": "e56bbdce74b57e1d9ffcdc2b943f8e7f831096bfdda6a3fbc1dab5ef5babf52e487396ccad7fac4a4728b90060f9ab33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141483, "uuid": "9bb86f7a-0a8e-421c-abdd-4e900b25ea91", "value": "12C4D021A693C034F4B312F449BB5275A53ABDB25B7880CFD2D03BEA96356E4AC31753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141483, "uuid": "053c51bc-577d-462a-8167-28a0a5b99cdb", "value": "bca4c139115857ba195befba3c3bfd5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141483, "uuid": "93dbd699-e3f1-40e6-aadc-af32d1530b7e", "value": "12288:lGZ/tzfuLD+00V6gqqapz2Y+bWcwCubhlY6aSQLZF9QyVy:6/YDW6gqRJ2lbZzubhlY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141483, "uuid": "90e07e19-d69f-4de2-96f7-a59fd4aca050", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141483, "uuid": "c88885ef-479c-4c5e-8f4c-62c8615103b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141483, "uuid": "14e2402b-1caf-4f38-b58d-a2cb8be53e89", "value": "1bdc796c65db06ae38ccd0bdd8f63352.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638513d1-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622141421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141421, "uuid": "4b8ffabf-b24f-4fc1-b237-2a5c93d370bd", "comment": "Malware payload (RedLineStealer)", "value": "1534473ae7b4e9b8a6ccb879639e37cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141421, "uuid": "ddbb3918-cc8e-4328-b225-a4246657a00e", "comment": "Malware payload (RedLineStealer)", "value": "ac5866c7ae360d45291ffeb072c2f279f4d2a992d5abd211ca07e7487e667d92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141421, "uuid": "317bc21e-6693-413b-abb1-9261bbcd4c8a", "comment": "Malware payload (RedLineStealer)", "value": "574f4152966fb8e8bb9ae8a1f647900e04110d02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141421, "uuid": "36c9bf1e-5b10-4fe2-a674-a3c3ea7f8399", "comment": "Malware payload (RedLineStealer)", "value": "48ac95aa1a90498ce7019a8133b46af9e2212f40f852d106ff3861c88442485e84d330804ea86c89ec1e452d61dd09b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141421, "uuid": "4bfbae36-2634-41e9-8929-e67b21b8f345", "value": "11B35C7663BEAF14E6BD0A78E4B0121643F4E4CB1012F76BCFD1649E3E6674265089F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141421, "uuid": "30c26593-1915-40a5-9cea-9c8458bdb2a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141421, "uuid": "36d4f6ff-5b37-4a91-b051-4097175841f7", "value": "3072:umD01OMxFlwm8ggC1ybdw61s5XLp34mm:LMxFlwClyp1s99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141421, "uuid": "303c9dbe-b7ec-4ffb-b950-3b9d5adc92a4", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141421, "uuid": "f75fdf41-6df8-4afd-a07f-fdc4a777ac36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141421, "uuid": "a032a89e-1ae6-4edb-a00b-8e7a3fce0be1", "value": "1534473AE7B4E9B8A6CCB879639E37CC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb02c4c-bf1e-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1622142482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142482, "uuid": "929d3037-79e7-4211-8d31-2d81d9bd4b88", "comment": "Malware payload (BitRAT)", "value": "3294ee91b924fd1e934bad97689cf4e7", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142482, "uuid": "cf4f8696-7d65-4333-afb6-84f6edb9aa45", "comment": "Malware payload (BitRAT)", "value": "ae93266da6d1204d789cf03efc2a0e2d7192cd7309d66984340a6ff5b99a7ae8", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142482, "uuid": "3668ac8d-723d-4439-a5c6-15ff3b415f4c", "comment": "Malware payload (BitRAT)", "value": "3a08df2b00b5c3ab36e9b0c986de5377efa6fe22", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142482, "uuid": "ce26d33b-493f-4426-863d-da03596b1250", "comment": "Malware payload (BitRAT)", "value": "9db7a73625f0c45d59f289300d7d205e8dd4aed64cc7e4f8bf77d24fec4d212d3208bb79745db82079f7c6b584291e71", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142482, "uuid": "814592af-ca16-4961-a6c2-b70aa480d2c1", "value": "0DE48D62B2E141B6D2561A3C9C2756659879BE7039345C6637F82C08BF7F3803D2EAD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142482, "uuid": "9976d22f-7d2f-4bf9-985c-6f2dd32640d4", "value": "3e7272567bf6719a2a90dbca5f3a4b3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142482, "uuid": "b3ab1e78-da56-45a2-b454-7f6aa731f943", "value": "12288:wuxGeRhWzrlZe7q6OWA50P3TaD8vVKlWFn+yGMhNyE:wyHWzrsOWxjQfE7yE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622142482, "uuid": "28681e8e-c8ee-4cf7-bdc8-b8812e4af050", "value": 721368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622142482, "uuid": "f3995efc-48a9-4e68-9165-bc20bcc57b54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142482, "uuid": "fee06cd8-e823-47d2-b3bd-d622920670ea", "value": "DHL_7661232.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd99eba-be87-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1622077497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622077497, "uuid": "db091632-56cf-49cf-8462-88d697f5b00b", "comment": "Malware payload (Dridex)", "value": "5dc1e49cf7213349c5b1d96b76c02fd6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622077497, "uuid": "aa914c80-b8a4-4efb-9da8-3e0b9deed183", "comment": "Malware payload (Dridex)", "value": "af77d58150c9ad5a9b19c138cea5d6fb7055fd4355acbbf2a5d41f41ae75bd08", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622077497, "uuid": "67bfbc1d-b62e-4d52-8b12-dbaed4d95636", "comment": "Malware payload (Dridex)", "value": "49c458b405d9fb128e37d2b23e661c0b838bca58", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622077497, "uuid": "90fa84c2-7b2a-4f09-a379-a6de7a3acba5", "comment": "Malware payload (Dridex)", "value": "5550105f28652d7b79d2d1637c920a6f1c9923a148bdfbf8b0e57f64be48ed6001af0876a25b51ae25b89677e08bd42d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622077497, "uuid": "3910bf10-ab76-4f11-bd1a-3d32777bbb78", "value": "CFD4E0B0B6C29526CE8A12379C61EAD6773CEE459F024267F3BD335E5E357C88222711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622077497, "uuid": "5a5ba4e6-2220-42da-b739-6e525e226292", "value": "12288:TspCOElpb+2pUpkNXdTJaaIyQHEQP47H33JSrqHG1Ku0KqD9kG:T5pjNTaaKXgb3Ur71F0eG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622077497, "uuid": "5c8a94d3-f086-42af-aed4-9b1ff401cb1e", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622077497, "uuid": "62a108a8-11fd-4340-98f2-e55c745ef909", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622077497, "uuid": "ba3680cd-1e80-4894-ba17-8debdfdfa8f9", "value": "SecuriteInfo.com.VB.Trojan.Valyria.4710.21156.16238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce2cd9f-bf29-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622146966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622146966, "uuid": "b9445f34-8bde-4615-b185-4d7cebfc246e", "comment": "Malware payload (Quakbot)", "value": "d85491b894cfa79f71e42c4e3386d273", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622146966, "uuid": "97c5650b-6a9b-4faa-bbdf-e7253b6b8cf2", "comment": "Malware payload (Quakbot)", "value": "b0c31580c705cb8cbc49debfc1f00f709c88a0e768b72880c975be2aab6ea96a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622146966, "uuid": "a32d1a08-647d-47af-8199-1cc77c0636b9", "comment": "Malware payload (Quakbot)", "value": "88bfe6dc8df40399b1fb3f055f5fc3c946bf8435", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622146966, "uuid": "60f54f68-306c-4303-a320-1af9406e1cc1", "comment": "Malware payload (Quakbot)", "value": "7bda8188b6ea80b8053be82a1f5dbd8bf36bf10e403b6566e9b5acd92121293bfa8e8bc2fd1581a388a2502861fd8fe6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622146966, "uuid": "89487fee-8d21-4947-a1af-438ac59d071a", "value": "BD354967A7DEC412FB231FBEB1839A4404F2ECA32132553E55E03619FD76AB02896774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622146966, "uuid": "0237e1c2-cada-4b77-ab46-bb715ce71f0c", "value": "0ccb108307084b188971b94863fe8bca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622146966, "uuid": "e0425b5c-7b45-4c6d-a245-442e8cba2523", "value": "6144:eu50+NCirQ6TBByIeJzt93S0EE8cuFA6Epnznitg8055EX+dridQs5SDoZtq:eSVONPfzit1055EX+dWn8DoTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622146966, "uuid": "a10cf222-1c02-42d9-932d-665b30b1dec9", "value": 1089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622146966, "uuid": "ad199ea0-2bbd-47f0-8361-b9b7528804a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622146966, "uuid": "6d0d0137-928f-43e1-b6be-f359d3ea6f5c", "value": "d85491b894cfa79f71e42c4e3386d273", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c45ab0-beb2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622095984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095984, "uuid": "b173f396-1084-4561-a14c-57a7c90b566b", "comment": "Malware payload (AgentTesla)", "value": "a2e2e5ce8df020b2b1c4215b97ff9b7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095984, "uuid": "a996f30d-9cf8-4492-857d-d70bef4be01c", "comment": "Malware payload (AgentTesla)", "value": "b10b874e7ca40e2c536d9a864d9d7b0940c9ab4f60d5def86cacef83e9f1f40c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095984, "uuid": "4dd48be3-32cb-4b92-b304-0a26a663a09d", "comment": "Malware payload (AgentTesla)", "value": "d586a050e98513cd21152ff6328621a6646e9f19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095984, "uuid": "f02d8029-1a73-4413-9ae0-31478a3085a8", "comment": "Malware payload (AgentTesla)", "value": "7da64d6b33f47d4b5bd9275cd3efdc72827e515f0c793375540650f5b85f3d977030f351acf2f51072a9598eb893843a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095984, "uuid": "ced88ff7-131a-435f-8a06-04b55e7c78b8", "value": "F194120027F8476AEBFE2376A91482280737E55E6230F34C1EC538F95E137A54856FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095984, "uuid": "1264cd43-6aac-4699-8fc7-b918af2df35e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095984, "uuid": "976dffd2-04ca-474e-b9af-cfd8b8fc0859", "value": "12288:AnThsKkkeNvCo16157Toh+aO2wvu5I1mgnWPcBBCMPc:AnNsKkvNqoQ1572mZUIwgn0cB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622095984, "uuid": "cad217df-3598-4c77-baf8-d0b50544611c", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622095984, "uuid": "da0ac464-28ec-438a-8884-6eb698041717", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095984, "uuid": "dee6f24e-b692-4cec-a95b-109e808ede23", "value": "AW QUOTE 21505 HQ1-Scan-068703_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76144583-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141452, "uuid": "c75a7a5b-6885-4fdf-be61-68267f2d4f7d", "comment": "Malware payload (RaccoonStealer)", "value": "f54051832478f03b91841a07314347c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141452, "uuid": "52291964-3ff0-4234-97ad-448528bec614", "comment": "Malware payload (RaccoonStealer)", "value": "b47d400aea3fe573eb0d84feb74e90f38da586df8849c3354069aad619e59d78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141452, "uuid": "e4fae3aa-efe9-48bc-b4de-7e7a138e64b6", "comment": "Malware payload (RaccoonStealer)", "value": "bd35aba2ccee0ca17087c8ebb5480f4894f80edd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141452, "uuid": "b604d74b-81bd-4482-9e6b-1f791a3faaa0", "comment": "Malware payload (RaccoonStealer)", "value": "c306185d5c0b2da209ddeb1852c4e7686515388e700e8ac5ed49083531d22a69b34626ce0ee37a04837b6c3d3c1c62a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141452, "uuid": "cecaa846-b8c8-4474-aa24-682252d25e3c", "value": "06C4D02167E0C035FCB322B448B9A2B9AD3A7DA2677480CF52D427E9D6346E4BD30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141452, "uuid": "f02cc30f-67aa-4a7f-8061-8d6a7e270e45", "value": "dac802e4a8085608765f3bd680d77304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141452, "uuid": "0bef7c0b-599c-48d5-9d02-f5a0713c1f6b", "value": "12288:H7x/8j/ONzmxOGurPu7cFd5UJ+CzyCVxZQQj/TMQzVV:N/bzGuWcFb5CDZRj7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141452, "uuid": "7368e925-af4d-4ad4-8cd0-bf956dbd6479", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141452, "uuid": "9e26a434-cd50-412a-888c-a7b501eab619", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141452, "uuid": "2815bda8-45c5-41d4-acff-d95aa4903160", "value": "f54051832478f03b91841a07314347c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8957ff8-beac-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1622093487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093487, "uuid": "7caddd48-b903-4445-ae70-324740ecf453", "comment": "Malware payload (CoinMiner)", "value": "dca89b78b3ae8add50e23e5da27f8978", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093487, "uuid": "d68ad960-936a-49c1-a94a-8bc85773339b", "comment": "Malware payload (CoinMiner)", "value": "b50cfd0edcdb6b99115f83ae101003203d113e40e7cf1fa9c796886115f8c994", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093487, "uuid": "1105798f-8192-4525-a1b8-ce1661e02148", "comment": "Malware payload (CoinMiner)", "value": "080ea57e5ceb78ca02df9bf68019a6fbfb7c1919", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093487, "uuid": "68821994-2b4c-4fd4-bcfc-62ce4754491d", "comment": "Malware payload (CoinMiner)", "value": "566cc951bc3766c8443f6b72babff23d6595a176f16d6d579fa682ea61f9fe362a006dc96354f125e21c5c0603bed781", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093487, "uuid": "41a2a7a6-2e79-47f3-85c4-cd15f977930b", "value": "45B5339CB020B1AFCD4BCDB58E946E55AA60247D131FC283A52756EC7B8C89F8F15933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093487, "uuid": "d02b1af2-ee19-44d5-9803-b94b8299b739", "value": "49152:Ir05w0uVu0vPqn3pMvOQg8TlvxVAfJlJ1Ep8/v8:Ir05g9vSn3pMvOXi2DJep6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093487, "uuid": "64550470-62ea-4727-92e2-b75dca6d3f33", "value": 2341376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093487, "uuid": "1f3b75d1-0b74-4f48-87ff-c94dc4c9698e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093487, "uuid": "a56447d0-0681-401f-8801-cc8beb84d77e", "value": "Install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa444433-bed9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622112898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622112898, "uuid": "3a3f50d7-bc62-44c1-bfa8-049dbe174681", "comment": "Malware payload (AgentTesla)", "value": "f1231636b32e6a31e3affaa5aa6426a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622112898, "uuid": "1a6d094b-4806-4bfe-9853-e3b73aeebb19", "comment": "Malware payload (AgentTesla)", "value": "b514cec21be2969d48e38f1a3506ff177074e69afa66d0692eda6990b015a3bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622112898, "uuid": "7f447b58-748c-4cc8-b361-9e5ef3445e36", "comment": "Malware payload (AgentTesla)", "value": "7b2368e454d6b2f0cbbf4b0f73a3bcc861d3cd3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622112898, "uuid": "222bc3ac-8a7a-463e-8d1e-c29e5fe85971", "comment": "Malware payload (AgentTesla)", "value": "128dffb7e9f6f1ad198a56315778a8311dcb83a632740d52631e685417585a5a75c55fbc6356d4ad56f8d7d10389bd71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622112898, "uuid": "4fde7b7e-1b57-4351-8e2d-0ed969025eee", "value": "5F94134C9B6C7E8FD6FE21F8E86911884376C591FD21E6C7ACE615A870677CE4000BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622112898, "uuid": "0b54394c-e8e9-42a0-b90a-6ca9edfd5336", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622112898, "uuid": "6e48f6bc-400e-4262-8e18-e2c4df88fa65", "value": "12288:RcFHDub31VWF98tYkeNmD7fLjn7JUaTZyo+S1AMasR:3Ycq0xUaty/SAjsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622112898, "uuid": "7b139768-2185-44d5-af6b-608d825a6253", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622112898, "uuid": "0b0c5b8a-6c46-4c03-8c4f-67cba2de7b86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622112898, "uuid": "20144987-b15c-481e-9676-9c7724ebeb9b", "value": "Quotation650342.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1eab00-beac-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622093362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093362, "uuid": "f6532cf7-44db-427b-aea7-472f8f412fd3", "comment": "Malware payload (Loki)", "value": "54646bf78c439ac5def2f0da07e7515e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093362, "uuid": "af8efe95-fbd1-4064-98b4-2dd62a518502", "comment": "Malware payload (Loki)", "value": "b61bc8dbff7333ce96cf5a5f59575845872e229facd3dc13da76835d5dddc01c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093362, "uuid": "b6ea8415-703f-4ab9-89a0-adb277406209", "comment": "Malware payload (Loki)", "value": "83aad696c9ff02ca6b309216da81e478a600785b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093362, "uuid": "1bedb631-4d52-4932-9a1d-755efa7f58f5", "comment": "Malware payload (Loki)", "value": "d55fc9505e4d2369bae2b8fa436a6cd170183cb614d5cd6f252a672f5ea820e2f721d32f36028ffd78f557ffff0f2d1e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093362, "uuid": "56b23b04-6335-424d-8805-c19f6cff7d9d", "value": "8364236B266F621C329D5C83738E748E49C4CA5E83C5B3EAC61FC86D849B05C5DFAD84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093362, "uuid": "bd0f7ee7-8e04-4257-b079-c365649d8437", "value": "6144:a3EZzqgygitV2svChnSipCPsthjRvovDf2nueVCoCtBjnvcWa6FPz+:aezqTgk4DSiPtnvovaueEoAnvjaIPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093362, "uuid": "32bc65b8-cd8e-40ce-b88a-434368335fa9", "value": 323936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093362, "uuid": "3a1b88f6-a3f7-4ad8-9b54-7f01d34570e5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093362, "uuid": "81df3040-8854-4b02-81b9-e87b75265d58", "value": "REQUEST FOR QUOTATION (RFQ REF R2100131410).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf740c89-becb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622106813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106813, "uuid": "055f61a8-8659-4d34-976f-6d9698d14195", "comment": "Malware payload (AgentTesla)", "value": "0a2c1f1abdc6ce0f03a67a64bd20136a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106813, "uuid": "66eee46a-c8b9-40bd-aa0b-e5b7667d8111", "comment": "Malware payload (AgentTesla)", "value": "b61ce2ba6202961ae774cdc021d9e33737a0d75072d230ad93b9247dccbdf303", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106813, "uuid": "ae6161f9-ad7f-434c-8caa-d148df30db90", "comment": "Malware payload (AgentTesla)", "value": "3b20cb710ba8ece5f037eb212a95c4c2a1758cb2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106813, "uuid": "2bb0643d-2b96-4dfa-ad60-3a7c6bd50062", "comment": "Malware payload (AgentTesla)", "value": "c39cb1801327ebe523e7f27f0e27c5df4fab435a417ca4fb224854503863941dd3ffa188e94ad4ca6505cc4df5a974d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106813, "uuid": "43620543-3a97-4858-923c-5e2f7f0b4a18", "value": "6F941239E1D039DFC7BE197EA17142C483B6D237E086FB876C51706A6662BC52A0E7C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106813, "uuid": "2fccd8cc-cb16-491e-91fa-93565c071685", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106813, "uuid": "2f754461-cd70-4f56-b89d-b57ea0c66a61", "value": "12288:p55Hac+MuO3RVjQWqrTfDURaHyx5MeRgF9pTs/:N6Quwn/RHEs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622106813, "uuid": "92288e80-b020-4f33-a731-7720d7b0ae16", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622106813, "uuid": "ff76f0b6-4cea-4644-aa4d-b4e7c5dd69a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106813, "uuid": "1e0b2593-61af-4468-ad1a-6f53d03db6bc", "value": "Quotation6064722.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731b79b2-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141447, "uuid": "f66517a6-7a2b-4a86-aa9a-49dad336bc84", "comment": "Malware payload (Stop)", "value": "5d0eba41c858f5da1467481677ccf47e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141447, "uuid": "4c5cfaa4-5069-4eac-bb52-cdfd6e384cc9", "comment": "Malware payload (Stop)", "value": "b734fe93c531236a5f083fa70e88e7c991d5bb6ad4c8c9a293aa7a3280201208", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141447, "uuid": "ce0d2105-d4fa-442c-a758-0c08a314c4e7", "comment": "Malware payload (Stop)", "value": "b855cf369902a2c846a5e796d7cccc4dfc74239a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141447, "uuid": "e29a8c98-5efe-4c1d-b7a8-549aad693e47", "comment": "Malware payload (Stop)", "value": "209cb032ebf4628569d21c3be0d91b94010b233e8c9c11b280e276e8376dd212713d48005508d5225b65879c0aba8775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141447, "uuid": "5b096f99-bd4f-4005-a332-54e30e83ee59", "value": "4105F1306691C035E0F313F189B682B8693A7DA1ABA450FF22C53ADE16345E5AD3177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141447, "uuid": "31346183-d286-4574-b123-1ed167585cc4", "value": "491e594dd178e0e1cc881884afe309e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141447, "uuid": "0f15edf7-7e93-4ed2-a0bf-f94646af51aa", "value": "12288:2gXIQjbjClfZ6oDB0Rg2OH+P/X24dYtZSjPyltnuUvl8yhSKeMrsA9cze6O:2hQjEZLB0Rg2OCmPreByhSrMQAqz5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141447, "uuid": "52de8261-dfc7-458f-b4a1-e4cad1e68e4f", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141447, "uuid": "fc4f9655-8ad4-44bc-8c49-5d3caac6c436", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141447, "uuid": "de13cdb8-65c1-48b1-99a5-f9a10763fa8c", "value": "5d0eba41c858f5da1467481677ccf47e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d289eff-beb8-11eb-875b-42010a9c0053", "comment": "Malware payload (SystemBC)", "timestamp": 1622098326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622098326, "uuid": "f20f9c90-aa04-49c9-8fe7-a95b10933de9", "comment": "Malware payload (SystemBC)", "value": "9edeee6085d9b638b05597aa5e5bd1da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622098326, "uuid": "69be55f5-fbee-4482-ba79-3b9233e63362", "comment": "Malware payload (SystemBC)", "value": "b945e05ea2847ee0d38aebe79dd5824bee6286e165c97e67d063dd4697ff1a82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622098326, "uuid": "6116028b-e290-4afc-b17c-fb59a5f5677e", "comment": "Malware payload (SystemBC)", "value": "032d3d331bce8dc9871c07a1c6532c5154d52eeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622098326, "uuid": "a65f43f7-6fd9-43e7-a30f-54c1d3d8809a", "comment": "Malware payload (SystemBC)", "value": "f3af5237abee221ec3c1f0eae6605728e90d9ed2c8b0c8e25f1f7eef05a27edabe2a77a9066acc2c2955c0f5d5389d59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622098326, "uuid": "3a5d28cd-6f5f-4bd0-8f28-8f339a883096", "value": "4264BE217BE0C4B2D50754306865C6B15B3EB83559B4CA0B3FA807BF2F603D15A7BB9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622098326, "uuid": "8d07f2f1-ea43-4e54-9a95-af3f2a830225", "value": "1a5a5aa2d8101b1942ff79e0ac371d65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622098326, "uuid": "4b3dc7ef-0183-44c8-b3f3-af5c6b48626d", "value": "1536:uPk2MqXY49x4Sl4L0ZWUe0KjU4A+xJtGpZIxyuRK0/:uJXPCLQ+jO+x2SyuRK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622098326, "uuid": "bfae5e5b-066b-4e21-8748-52fce7b095be", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622098326, "uuid": "c2f7ef1a-f01a-4c48-898d-24a9bb7cb207", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622098326, "uuid": "8885f853-f796-4d07-83b1-64e3b83515fd", "value": "9edeee6085d9b638b05597aa5e5bd1da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d744389-bead-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622093817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093817, "uuid": "e670ab09-e58b-489d-bc82-952ff5909789", "comment": "Malware payload (SnakeKeylogger)", "value": "c584949bbe6e8dc9cc0b3b00195f4c64", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093817, "uuid": "471acd1f-c62d-494e-b464-4611aa567497", "comment": "Malware payload (SnakeKeylogger)", "value": "b9756dd3c1072ba5ec297f58fc3b2b2a800791d8cfc679c4ba018b764a9c9cd2", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093817, "uuid": "9601b77e-8b1b-4aa3-946b-26a2c7db8f93", "comment": "Malware payload (SnakeKeylogger)", "value": "34070d8d936a7ffd179b3d5272fd823f906be132", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093817, "uuid": "8d2a3819-3f31-4f6c-943a-9b84c0476762", "comment": "Malware payload (SnakeKeylogger)", "value": "a5d7302900b26b177872e56482bbfb4651189816ef827c4ab3fc14012015cf7d6d1243b596d2de2ae305ad221eb4fd18", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093817, "uuid": "ede8e3aa-cec0-42ed-af9a-ba32ed77e788", "value": "9BC4E05B24CC4AD6E4AE06310DEEF71DBE26AE223D208D5A7E95F67D183024251F353E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093817, "uuid": "8961ff9a-760a-45fc-a0c4-0b9ee690d6fb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093817, "uuid": "f41529f0-f4e1-48b8-ba07-61944b4a9d99", "value": "12288:ZvGZOZCcqOnoDfuYj/nrozhF87FlWAcjlwlUIMhYzWphp:Zvhno6o/n0f875coUIMhr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093817, "uuid": "c81b0423-da8f-499f-bcba-f88a5ac358d5", "value": 570395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093817, "uuid": "fa39e86a-64cd-44bc-9c4f-bcf3e381dfec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093817, "uuid": "f2690728-34a4-42a6-a384-f62c568915f2", "value": "Consignment Details_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c947d7b9-beae-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622094347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622094347, "uuid": "a4f472e7-af86-4de2-b2e1-1c69a70cbea8", "comment": "Malware payload (RedLineStealer)", "value": "6253c3c0a0ea3764d371d124d8559e29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622094347, "uuid": "3e30200d-d8f6-4851-85ff-b19fe1c4a88b", "comment": "Malware payload (RedLineStealer)", "value": "b9920980953d166ef0d4706ed87748cf4a3c72a97403ecfe4706cd0853832661", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622094347, "uuid": "d3ee2745-a80b-486f-ba48-593ed98d9520", "comment": "Malware payload (RedLineStealer)", "value": "5f63582af6fe90ea806d30ec3adbba4b96ae333b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622094347, "uuid": "906ad0d0-b905-4370-bf78-65440fad46c0", "comment": "Malware payload (RedLineStealer)", "value": "d18d22e0d3ae753b27c09495b49bcd1e5349fc93bae189a6070d8f3a66167c5de0de3ca45c564c2cad0628b794eadc8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622094347, "uuid": "a3155c6a-1f0f-4304-a1f2-afc3f57d07fc", "value": "4B165AF13A0BE2EFD65604B4F409D943C52823FA9654A505EC29BC788F42C7E25DABDC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622094347, "uuid": "1d215d09-bd50-4b7f-a5fe-ce16c4f21aae", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622094347, "uuid": "78c47d51-8824-425a-a72b-e112939c9b7f", "value": "49152:ar7Xuoq1F5kQL6NVtGqSbiJSS+It17WUoXu/g92xGscRpJ:aGo8PkQLEt5JSDIt17WzuIBscRpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622094347, "uuid": "0ffaae28-5a82-423d-9853-e0587f469342", "value": 4139008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622094347, "uuid": "15c628dd-0172-4044-9ae0-08bbc3d03e9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622094347, "uuid": "24fc576f-d77a-418b-a113-5f50c08ac789", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a340e0-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141445, "uuid": "94d76645-1642-4f9c-9029-de11d9f16122", "comment": "Malware payload (Stop)", "value": "e01ca5bb897cfae01732fa8bef27e1e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141445, "uuid": "44713bcd-0437-4eed-8b95-13a484db7c20", "comment": "Malware payload (Stop)", "value": "ba22e3783caf02b8cbf3b9e3139d1f69b1e4c123efb0ea9846e470194b223c9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141445, "uuid": "ff4a3306-9bec-48cc-94c8-9eb6bcc74497", "comment": "Malware payload (Stop)", "value": "118fa6b3847a66a4bff5f75baf0d2ba4210df850", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141445, "uuid": "33f76ba0-bada-4ecc-aaf6-457e0c8d514a", "comment": "Malware payload (Stop)", "value": "8d3833949585ce1d59a49b489e6b35bcd5d80fc661ef977c8ee7e11c75dfeb60f01ddc4836a7c0592dc3df9f7a59ce1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141445, "uuid": "ef0e2022-2a9f-4314-8986-010c6bd91717", "value": "4605F130B6E1C034F0F396B447B582F5B52E7DB26B6440CFA2D42AEA5A396D4AC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141445, "uuid": "7abc5717-a517-4bd3-8e36-6ca55ec2bda0", "value": "556bc424bd608c9e064a122699e67eca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141445, "uuid": "1027295d-97d7-4278-b206-d4350800e123", "value": "12288:rn6Ts1yk0JTsa4GYriG/17M6FzLoW7BzoLvAMCn/JFQrrzYCf1ziNg0:2TLJSGYri419JLJ75uAMCRufD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141445, "uuid": "5c796867-00cd-428d-b972-01c708a28965", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141445, "uuid": "13bb6d1d-a667-4682-9c14-195347f82c06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141445, "uuid": "0d7c0c29-689b-46cd-91ae-eb7afdc45181", "value": "e01ca5bb897cfae01732fa8bef27e1e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f85e46-beae-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622094291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622094291, "uuid": "91c1f6a8-5110-4c70-81c7-102c3ddba6cf", "comment": "Malware payload (Formbook)", "value": "3d3e5e6b374dc31f5417f73a17256a60", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622094291, "uuid": "de223b2f-a9c0-4023-bd1d-15d9acb59328", "comment": "Malware payload (Formbook)", "value": "bb8edab2af37d542c7774e5f5253e1de86fc80525f29e0e274747378201a3537", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622094291, "uuid": "7b7f399c-f52b-4fb8-b88f-0221589af97e", "comment": "Malware payload (Formbook)", "value": "7b25a40cf1655a98ae82ea2d6c54e3000afba7bb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622094291, "uuid": "342f1737-ccf6-4b61-9b1c-9c2788d2c3bb", "comment": "Malware payload (Formbook)", "value": "daf63634dbc5b3906ec7edb62eec03bd6570e73301f9dfd6ee6065a0c25ce7d7e4b707b2c2308e6c8100dbb0d48b6e32", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622094291, "uuid": "3f367067-9277-4402-936d-97e3ecc9664f", "value": "EC9402162BD4CD77C69202F848F6D3B9E7746E843A65C6139BDA3E7B3E3A3846C41085", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622094291, "uuid": "fa495bdc-6137-4cc1-bd3b-ae0f745cb102", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622094291, "uuid": "29ee4607-6818-4111-aeba-9e479567ace4", "value": "6144:PQqhBsiQh1uIZdP6ZptYKdHKF6FrOFSz3OfkrcmCWWFA9hCc0zfEaAeyuk:/WP7uIbP6Z/jdqgOHcrcmVx9hP0Aamuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622094291, "uuid": "e0dc12da-9c66-4586-a6b6-0f674a1d239d", "value": 428140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622094291, "uuid": "c4dc6cc7-08f3-477f-984e-6d7758225c5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622094291, "uuid": "af0e123b-a705-4626-8cd5-2cb9c3a22529", "value": "PO_2021005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6162b67-bf32-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622151089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622151089, "uuid": "c2836126-0010-4a8c-b7b3-65f6237a790c", "comment": "Malware payload", "value": "5f89c7bf2759e0854661a54f904841d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622151089, "uuid": "d950a533-6edb-4981-9dd2-4a33dd0e7c2e", "comment": "Malware payload", "value": "bbb47e57037acd2f1d74101614c715c4ab9d7f294fa138953bc9823c8e16c7ec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622151089, "uuid": "91ccca76-0019-4ef8-a132-041e8a49dbb3", "comment": "Malware payload", "value": "18687695d90eb68985514acb760fb242bb444550", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622151089, "uuid": "a45b87b1-31b3-4745-a0e3-b028cf28e84b", "comment": "Malware payload", "value": "588847b0eae95a6ce451c6f520d66b567a0cd7bf7dfc44be662d436799a72e382e2604d92bd111eea1e01449826d8ddf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622151089, "uuid": "4419ee96-0871-46a7-b017-71a1ce5ac089", "value": "DBF3129439B3A542CB19007664A4D07FCB78EF5592B2176BFD8A738688721C5A1E78F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622151089, "uuid": "8a9a4821-ed14-4744-84a0-06cc2c66205c", "value": "3072:xaKZ5qD/9NMYeR2G3eaj1FNSdUNzdmeRt7Wbm7qWjS66U+GW97A:UKnqLMZ2G3B5kyJLtnY5UI97A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622151089, "uuid": "57d1212c-0376-49b3-a1e6-1ba22783d695", "value": 165381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622151089, "uuid": "e5826375-96b2-4bba-b0bd-0e233d273799", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622151089, "uuid": "f74bf85f-0189-434c-9e8c-9aadfa070a44", "value": "bbb47e57037acd2f1d74101614c715c4ab9d7f294fa138953bc9823c8e16c7ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1cab226-beac-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622093422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093422, "uuid": "0838721f-07a3-4d63-a3e1-1c3c44290692", "comment": "Malware payload (Formbook)", "value": "372d269702ca0030ed6f74a4420f3110", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093422, "uuid": "e495e34d-7a44-4d4a-9a52-d6e42efdc427", "comment": "Malware payload (Formbook)", "value": "bdadd78792a7c09144a0fbc30f212c069c3672b809b4ffb1acb1c4375422313c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093422, "uuid": "3c8ffeaa-a175-4d01-ba22-b1a792775f39", "comment": "Malware payload (Formbook)", "value": "9a32c6fd806b280b6c39d9b42e72ee910c28a89b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093422, "uuid": "06013b64-ccb1-4514-99d4-e413ab627ee7", "comment": "Malware payload (Formbook)", "value": "0375c2832e4d5adbf3a80b3e023b9be25aea847678c68bb773db4402c2b1b6184d30aeed3b65746bd4876f14f1929c80", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093422, "uuid": "ba5b738e-4a20-465a-aa1d-21d39f4ca620", "value": "DAC42307EFC851577B88EA586A36C0FDA3DDE209C251DE3884470E3A42B7B764662F35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093422, "uuid": "add8bac6-8d74-4b7b-b876-e15178110925", "value": "12288:zfHEzf2ONZG8smy7rcfgWsoDj63MLYr1yoyAbpBWbCbb:DEzfvNYlc9soDjXsgRAbC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093422, "uuid": "4900a6bf-553d-4712-86c3-ba7ae404644e", "value": 549420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093422, "uuid": "82009535-fddf-4e79-8bba-299a8cfc56c7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093422, "uuid": "99eb90dc-1ddf-4de5-a480-9ae817871818", "value": "ORDER LIST.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9c32a2-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141495, "uuid": "54319757-cc5e-41e3-abb9-600cdc34e841", "comment": "Malware payload (RaccoonStealer)", "value": "fe08b9e6b42be27d92edecd906a7b800", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141495, "uuid": "aee7360f-664e-4b7b-b35a-e00c9624e44d", "comment": "Malware payload (RaccoonStealer)", "value": "be4ed9fb0354aaa2ef474bdf0c618617c075467f3ee96d813c1ed8ed89b74b0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141495, "uuid": "53889345-a58e-41ab-9f9b-d600cdd9be7b", "comment": "Malware payload (RaccoonStealer)", "value": "dd4f6b6771fe1aef42f2fed07a2b75cc625ba0f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141495, "uuid": "714815b9-e687-4317-ab91-09d643f65b38", "comment": "Malware payload (RaccoonStealer)", "value": "12b07837c45436e8580dd7cae00a50694590721032dcf76dc84b5fa7b00cadcec1bf1f2d1b90f30fa70fc3f00d3200c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141495, "uuid": "715eb91b-f6a2-4b24-88ca-cb598ae4e494", "value": "88C4D021B6A0C039F0B356B479BDC278753A7EA2A72440CF62D63BEA47346E19D30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141495, "uuid": "3d755a66-0b56-437c-be25-85a1afac0f3e", "value": "dac802e4a8085608765f3bd680d77304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141495, "uuid": "06744f79-9823-4c2a-9299-cae09e1f6630", "value": "12288:Dfh/8juO6zmxvGzf396bBXIDDgEt86X+3vGEe8LakvH:9/lzRzfYXIDsE76akv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141495, "uuid": "1f04d52a-d5b2-495c-b198-0651ba6e1fdf", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141495, "uuid": "42fe8181-4cc8-4269-816f-49491d1503ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141495, "uuid": "4ddec0c2-181d-49a4-9583-2026aabc5d4b", "value": "fe08b9e6b42be27d92edecd906a7b800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f97c194-beea-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622119913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119913, "uuid": "0ad0aa99-9321-4b50-9b5e-5845edf1ab0c", "comment": "Malware payload (RaccoonStealer)", "value": "f105a00c26fdff2deeb11a5308de88b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119913, "uuid": "4a0262f0-3b8a-40e3-af3c-b30cc430b712", "comment": "Malware payload (RaccoonStealer)", "value": "c046d5405f2898028f938bb3de4b13c3a23742c042170d36ceed5a4d0d6c9323", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119913, "uuid": "62b87407-7477-45c6-ba1e-f174d77d6fa1", "comment": "Malware payload (RaccoonStealer)", "value": "69ed506d4fc528c8644fe845dd9bda1a57a0ab3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119913, "uuid": "f090374f-c558-4992-8d42-b42e899fdce5", "comment": "Malware payload (RaccoonStealer)", "value": "10c03bba39ff89a50ca8120cf912b63410ae4a2d32801e10f1917a9517ed5ecdcfcc034ddfe71ea10431710a93185e97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119913, "uuid": "1e5b86cb-9c2f-4bc9-82da-b50f7f854c69", "value": "FFC4E021A6E1C038F1F75EB449B69274E13ABDB26B3440CF52D12BEA8A357E49C30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119913, "uuid": "80787f2a-9364-4fc0-8335-a2f439acda48", "value": "556bc424bd608c9e064a122699e67eca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119913, "uuid": "b9b8e2d9-03bf-4d49-af44-634f876db349", "value": "6144:9y/TVXvtlIfn9BIEgghnWwTiU0++m8Chxc7PZVYTFoJ8+aN2bnqCNp9QWnP5Ahqn:9y/TVXsf9dgghDkOT2I89TP5qqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119913, "uuid": "959ebf68-8239-40b4-b76c-95989af6ffbb", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119913, "uuid": "293d353f-11f5-4a25-929b-bbfb9a60ffe6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119913, "uuid": "5af868fe-4a01-48f2-ad04-151e92f42e24", "value": "f105a00c26fdff2deeb11a5308de88b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ff41ee-bf38-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622153421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622153421, "uuid": "f88bfeea-3a89-4a61-a25d-0d9b1a62de91", "comment": "Malware payload", "value": "057a4192cb3d27727812e1dff1788245", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622153421, "uuid": "aab242f3-becf-4ebb-8aa9-58678e75fb1f", "comment": "Malware payload", "value": "c09ac50f450c7c5c2795dcb324e07ab810272ed1fd6633978b94db46dd709b5a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622153421, "uuid": "5ca74b98-544f-4745-a095-0e0a215a83e3", "comment": "Malware payload", "value": "34831068b66167329982008d9804211411317630", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622153421, "uuid": "4d4b89cc-3172-4140-a069-e1083b146fd8", "comment": "Malware payload", "value": "47f959ce99014aa01bfc65a261c6a575c6702ee64c9ea0ff98edd014f9258b6e76ded4d4c03187e58323012b9a8d10b7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622153421, "uuid": "f77f0c64-e527-4197-84be-9bd4b8c79afe", "value": "BFA59342E5BAC912CCB136F4F186C20D7627ED5376668656E10F3D2E8B6E38D68CD603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622153421, "uuid": "08808d90-74b3-465d-803d-f0b79a05fa7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622153421, "uuid": "ebbff804-f209-4ea5-b299-3dba92c530de", "value": "24576:QzljxHOhm7mnk/1nH4LbNs4h11z3h3Qvrn8M0Nku:Qhxcxk/t8s4hVM0N5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622153421, "uuid": "722405ff-9889-4b79-9f65-7545107415db", "value": 2100824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622153421, "uuid": "9f7e8d2b-caee-4ee0-8012-cd3c4a972259", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622153421, "uuid": "98a49755-6877-4827-8efe-84b08ba54b15", "value": "c09ac50f450c7c5c2795dcb324e07ab810272ed1fd6633978b94db46dd709b5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c291778-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1622141409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141409, "uuid": "259cffd3-1a5f-4494-b67e-d98ddcf8b50d", "comment": "Malware payload (Adware.FileTour)", "value": "47be12d63d2262e5f73cc86ad4abff97", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141409, "uuid": "ee15aeeb-d7db-4e51-b57b-675ea35cec48", "comment": "Malware payload (Adware.FileTour)", "value": "c0b90c23b8130fffdfbff412f4535b474a3c207fa2228f78e6b822a38fae2d3f", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141409, "uuid": "085917a8-1147-424f-9f02-8d4f8f6f3672", "comment": "Malware payload (Adware.FileTour)", "value": "17c76282c08667b9cdef64b009f6a646449d6a3f", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141409, "uuid": "74a09689-953b-4b4d-95d3-bc1b83f5d9da", "comment": "Malware payload (Adware.FileTour)", "value": "c98d7e184282bbf8893a4b355898b68acaf6611938c1e86cae141178ce947c235fb07c9a52521c23acdf37ec8aeaaf4f", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141409, "uuid": "f2328fb7-981a-48d0-9a70-a87a8bb9e520", "value": "45841292B7E54838E073CEB05C90DA22893B79655C7CA50873ECAD8F9F3F6819256743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141409, "uuid": "127ec91c-5894-48ae-b72d-102195cf113b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141409, "uuid": "14400e04-a075-4c7c-96b6-8c53b3b4addf", "value": "6144:x/QiQXCeJm+ksmpk3U9jW1U4P9bKOGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZogE:pQi3es6m6URA3PhKlL//plmW9bTXeVh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141409, "uuid": "6692f51e-a0eb-46a6-9023-f25ea40ff6ed", "value": 390055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141409, "uuid": "e2ee3104-ec1b-4697-96fd-21a4e7b56259", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141409, "uuid": "316bc456-5c5d-4960-a3c4-67552aafcf81", "value": "47BE12D63D2262E5F73CC86AD4ABFF97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a89d9d-bf20-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622143002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622143002, "uuid": "f1d351df-9928-47b2-adb1-984eca81b0c1", "comment": "Malware payload (SnakeKeylogger)", "value": "d2470e33e04e12bdc2acf475f40da080", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622143002, "uuid": "e9ba3d30-c098-443d-940e-3368f6a3bd65", "comment": "Malware payload (SnakeKeylogger)", "value": "c14aabff124b5374c5d132ad50b59b8de999c1633b5cea642644e3ed0108b5d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622143002, "uuid": "3ae596d1-23ec-4192-9a78-6388d2478c00", "comment": "Malware payload (SnakeKeylogger)", "value": "3f81ef86a1a4c5c3929147560ee76fb5e8712824", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622143002, "uuid": "8568cefb-6c90-4fa0-a042-9e8f6816cdb2", "comment": "Malware payload (SnakeKeylogger)", "value": "2c71e9a843316e784aaf76fad136cf93a47d5db76f113604d3335cebf9c9e9efba2707d51083242fcf2eb76615c6795a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622143002, "uuid": "fcb86a9e-9c9f-4b21-affb-bfb0125a46f2", "value": "C014F10AD6C5F56AC4D60AF6CD63C2F60371EE129E62DA4B44083F5F32723C4CA60BA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622143002, "uuid": "7cb43f74-3cc5-4a6e-baad-3ccd27a45d55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622143002, "uuid": "796f6098-84c7-4905-a0f5-6bdaf781b19e", "value": "6144:q4trD+S2achWalmy1OjOCnfR4l6BBNXR:j+fFWalmy1IvnfR4l6BB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622143002, "uuid": "77f03b50-4b60-4751-844c-2144b27008a0", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622143002, "uuid": "6b54b678-7768-48b7-ba3b-b486830a3050", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622143002, "uuid": "7ea8d5f8-7661-4704-a8bb-4fedb667a8db", "value": "d2470e33e04e12bdc2acf475f40da080.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a5909f-bee9-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1622119703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119703, "uuid": "00f86164-1233-4d19-a5b5-7aa8e93a99ab", "comment": "Malware payload (CoinMiner)", "value": "0e95db519fc0dc768888ec7def3a9f27", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119703, "uuid": "3decdf73-9a99-433c-ad5e-1fe1b406d3e4", "comment": "Malware payload (CoinMiner)", "value": "c194fc8cfaccff275896f4a8d60b07156aa9f3180620c0c003daacbadefe9371", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119703, "uuid": "8a01b710-a49e-40ff-8455-762bac88bd4f", "comment": "Malware payload (CoinMiner)", "value": "6ba14fc9bb9d911fe1bbedfa5acbc5cea7e3d824", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119703, "uuid": "f5aea13a-1ba8-4747-9333-1c489d35d1d1", "comment": "Malware payload (CoinMiner)", "value": "be115a5ced07766b4113f6a690ac5bce67f577a97ca9f60058b589e4c6d802ac1286d2abe2291161eb0ac52de8ddda6a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119703, "uuid": "8b86e22e-4483-4357-b9b4-58aafd96c35a", "value": "75D2FA37BEE68DB0EF2604BA31ED3247D9AA773331A09453E7106F26A521481C59DB1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119703, "uuid": "d2670b0c-27f7-48ac-aec2-c9cb57a1a190", "value": "768:RVpdbq2rAp6JcOpXRUmY2WoevuWUes+HYHh7ow8JEW9fkG5Qrhb9wF/nACkhso2:HpdbGcJcOph2WCYB7o/o2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119703, "uuid": "28bba8b0-34f4-4cf9-a9fe-964c29ca6bc2", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119703, "uuid": "c8e864af-f414-4e1e-8f44-dc554ba1078c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119703, "uuid": "644b09ec-32aa-41c2-8110-cbc6362ac1a4", "value": "0e95db519fc0dc768888ec7def3a9f27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135a41a7-bf20-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622143004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622143004, "uuid": "7458e257-707a-4e8d-8c96-e85a633d8b02", "comment": "Malware payload (RaccoonStealer)", "value": "04f3b5cf52471a4f3334a4d4d6f2e6b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622143004, "uuid": "0e0a60df-0003-4d36-8ac7-d9b33d2b452b", "comment": "Malware payload (RaccoonStealer)", "value": "c50339202bebf620f50f539aa41632031d42ed3e640bbc210e50502bdb403856", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622143004, "uuid": "8eeb8aea-5aae-4303-bbdb-d77d1d33dc50", "comment": "Malware payload (RaccoonStealer)", "value": "83490bc7216e2305f788025cd6083f0074bbe323", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622143004, "uuid": "dc39a63c-817c-4ce1-aefc-5a3742313e78", "comment": "Malware payload (RaccoonStealer)", "value": "c532f1eec24a0691592ca50264e602ef1f2ead9eb7bf2280af686cc799d09064c04109f4110a2ee78633dd36f379d607", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622143004, "uuid": "865b03ee-bf2f-42f4-87fe-429cd5a434be", "value": "48C4D020A691F035F0F712B849B9827BA43A7DB16734D0CF52E52EEA52745E5AF30713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622143004, "uuid": "960f1ea3-43ed-4a68-9766-b1191de6696f", "value": "cb971fcf399235e4e9a69622d3809fcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622143004, "uuid": "e2adc1a0-c88f-4e2a-9b1c-672d01365c05", "value": "12288:xHB/iFx/sGlVuK8rSUwUQl6kevcKlJNs3HjiSK/4ls:xHBs/4Da+HsXGP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622143004, "uuid": "c6f8585b-c63e-4950-8e8d-dc6c3faa54df", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622143004, "uuid": "ee8545a1-aa0c-41ba-9d70-b519ed52bb8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622143004, "uuid": "fe196b3b-4b0c-4a16-800d-701b84ffef86", "value": "04f3b5cf52471a4f3334a4d4d6f2e6b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25d9280-bee9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622119676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119676, "uuid": "3e305034-4304-4836-9b79-617d6dc953ce", "comment": "Malware payload", "value": "1d6ce1ac8e5b4b233c91fd692194930e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119676, "uuid": "8e885a57-9cd6-43f1-b71d-efcd30aafc80", "comment": "Malware payload", "value": "c70a67a13b5977d741ed50e16b2a6817b8280cd28254ad01a562e0c114757652", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119676, "uuid": "f70fdd94-a1a7-413a-a547-20229b245974", "comment": "Malware payload", "value": "9e7d3dea4293b9215fa9fa443fe436e1faad7856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119676, "uuid": "ff9c7953-89ce-4f54-bbe8-f8d7f165d294", "comment": "Malware payload", "value": "f43a7a2489e63d63a5288a1f2d5cae140dca8892269b8dd9a1828343f3f37e90f67d569d69a0218822539a18882cbe18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119676, "uuid": "950c0da2-9cb7-4665-a35b-0edb54a05be3", "value": "5E749E20A7A1C035F1F722B849B59378A53A7EF06734D1CF92D03AEA5A346D5AC30B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119676, "uuid": "4add3be1-f39e-42d4-a1a2-d2a84006fb22", "value": "fdbe3f2aedac4f7a47219085c5785404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119676, "uuid": "c2dde38b-1d9f-4bff-a7b4-befd31d62761", "value": "6144:CYXAQheApl6vxq84RL+6iPMgwPIhHE8h2/xdb2SMUvd6rr:twQheol6vxq7L5iPMFPsp2/xdbHts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119676, "uuid": "befe4357-d045-4700-b4aa-5c472c9164e4", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119676, "uuid": "58eb4bb0-d053-4ac8-893c-7050db6a6678", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119676, "uuid": "603c0129-0555-48fd-ab4e-a50d3a53300b", "value": "1d6ce1ac8e5b4b233c91fd692194930e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e837f784-bf0b-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622134342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622134342, "uuid": "b745906d-0a7f-4d2a-92b5-daa5d4e75ddb", "comment": "Malware payload (RedLineStealer)", "value": "d0736faa6369dab01b182257791fa467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622134342, "uuid": "9759764f-1ddd-4673-a2df-08870a7a5c2f", "comment": "Malware payload (RedLineStealer)", "value": "c74725fe1e3f3681bc7033ce7694b98075d395c06ba22989216d4288db559e85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622134342, "uuid": "dd61b549-4437-4d8d-9ca7-80a948432075", "comment": "Malware payload (RedLineStealer)", "value": "9950e6cb64d7462e33433b154e43cb634d450823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622134342, "uuid": "3f4b6d64-a5d0-4ff2-a0ba-ab5f3739cf00", "comment": "Malware payload (RedLineStealer)", "value": "db470e908282c28f2b178e0e97d08dba5cbdef7e9f2f618d9a6381bdaded14b4ea898c2916fa3484732cadcf5974a11b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622134342, "uuid": "06054296-a1c7-40b8-a5d2-11da8534a219", "value": "F43633C3AFDF937DC999E276B0A329ED97445BF38B2D496E0E1470001AD6F5228CD462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622134342, "uuid": "cc70be69-60bf-461d-bc13-1bfc183dd569", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622134342, "uuid": "491751f2-a857-48d4-8131-fad494ff1bb8", "value": "98304:IaY2lHXnwEP0kS6+4k8+ZWqQfUCh0Uj9dBFuR5SyqSd/gC/0F:EUXwEc69k8Cqh0Uj9dufHqSdd0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622134342, "uuid": "c00fa8c6-b51d-43d8-992a-33611a3f1eef", "value": 4895440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622134342, "uuid": "c6bb1321-332b-42b9-9346-64c45e433a31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622134342, "uuid": "a0f8e36d-d42e-488a-841d-b77ddcc2e8dc", "value": "ExtrimeCheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0798a8-bef3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622123853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123853, "uuid": "27d3e54d-b7e8-4369-a835-c6ed8ef5138e", "comment": "Malware payload", "value": "8c99983a3a0a6faba69b271c20a97b61", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123853, "uuid": "bc655581-1506-4052-87a4-dac4a74f7609", "comment": "Malware payload", "value": "c79f72f8a32b93fc15bf2dd313daeb0d583fb35bf266ecd40d031eed59d80f54", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123853, "uuid": "63f4058c-c3e7-4729-b2eb-bc39befcbb18", "comment": "Malware payload", "value": "c4a53c5065486e50887e7b341566117e134766ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123853, "uuid": "318ec796-7b78-49b3-818b-d461411d1cb6", "comment": "Malware payload", "value": "a94bdeec7f52414ca56cd6fec3a2e61315c4978e05b744283292b77d10fa89a7e7b3286d320a90ed37f1ef6e47fb3fcb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123853, "uuid": "193dba6b-0a1d-4c0e-87d1-c7bfa9da6177", "value": "45B423AE8E0DA9B8D3C15FF97A07B87F8B9C6CAB796781ED4054D3BEC2D09321145604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123853, "uuid": "7dbb13bb-ed8d-4cd1-a9e1-ab5c08c6fafc", "value": "12288:LX8VKB0gaDMLwyDetULKiR0VkMpIYAfc8vZRwortq7MwANdPRwM:LX8VKuzMLbDetULhYTp7Afce/wUXd57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622123853, "uuid": "38a42833-da9e-4e2b-ba97-0f4912033330", "value": 505596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622123853, "uuid": "61ab65f8-491b-4853-a4cc-43766dcfdd29", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123853, "uuid": "16a71119-da4d-45b6-b735-97aaa8ffe9fd", "value": "PO_MPL0022323920.pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15be90c6-bf20-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622143008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622143008, "uuid": "26572cf6-b7ec-4fd6-a681-55f09dc72d3a", "comment": "Malware payload (AgentTesla)", "value": "d08412601dc64d6dc5e3945d550ad9a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622143008, "uuid": "96b70e54-4dac-4b99-8352-d350b5b83215", "comment": "Malware payload (AgentTesla)", "value": "c8f8510cba7bf3a1af68bd76428a0fcaaf0cce231d22c366d49926122a2fb439", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622143008, "uuid": "4f2024b8-a05d-4998-9209-37b0c9ec8525", "comment": "Malware payload (AgentTesla)", "value": "06cfbf0af5ab9edc688ce9ef6a8ccb41bf3b3533", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622143008, "uuid": "d497c660-61b3-4d71-bdac-9b5a73dca8e2", "comment": "Malware payload (AgentTesla)", "value": "f0219d920e5de76875de2785665edb9727de08e3af9798224b4b2ea4c46ca1076076bffad6e985d6fecf4d88623ac2a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622143008, "uuid": "8905b849-07af-432c-9b21-b2e9da1e83db", "value": "A7F48D1C25688616E5ACD2B88DD5D42BD250F9377112FFE8E8E703B91B07A4379821BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622143008, "uuid": "b1973b53-3495-4010-92f0-9d6420a01e77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622143008, "uuid": "1c14c3c1-f079-4b00-9048-32175343adf0", "value": "12288:GUGfvdnLnDy165y8aaYYI/Oy6h5JFvbB39y+:GhdLDh5yngXJFvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622143008, "uuid": "b1c630e0-62ff-4635-a5d1-d13b2f487867", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622143008, "uuid": "c53de743-b23b-439a-8a87-10953d749378", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622143008, "uuid": "cac6651f-a2a0-409b-ab8b-d5f52fabe13e", "value": "d08412601dc64d6dc5e3945d550ad9a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3c7262-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (OrcusRAT)", "timestamp": 1622141602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141602, "uuid": "65e67f33-ae67-4cb0-bdc0-ab034a89d5b9", "comment": "Malware payload (OrcusRAT)", "value": "f1fc262feccc275619bc3ce0879c5e12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141602, "uuid": "2fdba7fe-4963-4352-922b-d09ffcfdfb10", "comment": "Malware payload (OrcusRAT)", "value": "c961c19943e6b90918070b48e4570d83605820f9ea198bc6078e8cbf84b434d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141602, "uuid": "8f517ed7-4ed8-4a5c-803c-472f77e97fba", "comment": "Malware payload (OrcusRAT)", "value": "857ced946759cce945da539c14c0689a81919097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141602, "uuid": "96f04361-bfb7-45b6-9350-bc56f2d6c0b2", "comment": "Malware payload (OrcusRAT)", "value": "7587cd72be5c6e53b8cdac21f48d5ae2f29453f87841feee931fd96510a28b4e1d1ef2fffa06618e6287c20bcc26da8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141602, "uuid": "9560be44-82f1-4d6e-b5c1-d4584cd25e5c", "value": "93B5CB2439EF622A61B3AEE15BD47986986FF673BF1B6EC7104043864512C42DEF0D39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141602, "uuid": "868ac94a-50df-4f8c-9619-a249b99edf60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141602, "uuid": "c298feba-82d0-4d12-adef-559792e22285", "value": "12288:gfC+MGmBOGklBzaCeBtH6rhi7/JFxwa46NTHHm5IOykb7JrL/uFEXmWnH997s+vd:ZaoHzLNUlnNg1G5y7/PiCWpyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141602, "uuid": "d71a42eb-c949-4699-873a-639d9a278ff0", "value": 2359296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141602, "uuid": "d9263e86-c837-42b8-a521-d4dfe4df52b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141602, "uuid": "7c3a315d-0c0e-4b35-bc0d-d1ebcadbbfbf", "value": "F1FC262FECCC275619BC3CE0879C5E12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0181143b-beea-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622119782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119782, "uuid": "deb9a6f0-05d4-47d9-94ca-9ded0199790a", "comment": "Malware payload (RaccoonStealer)", "value": "66f5111eb8e9ad2df6bce17ec1355a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119782, "uuid": "71b6d345-eb15-4c77-8a6e-5f52ab11ade9", "comment": "Malware payload (RaccoonStealer)", "value": "ca38055f0d5c0939ae1659855448350ccad7df186cf2ee866e79661759367fc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119782, "uuid": "73599f97-76c8-4cde-b8f0-9d3096a5db96", "comment": "Malware payload (RaccoonStealer)", "value": "bd3032cfca69d3a179feedf9c06e55dd561b201d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119782, "uuid": "3415dd94-e0d8-4c5a-bb1e-e249f6d1dc3a", "comment": "Malware payload (RaccoonStealer)", "value": "b650ca186ef9e017eec46717230579bc96767fafc0750210220bf2645189018fc84dd808342f3c72bf43de1bf0983f88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119782, "uuid": "6ff616aa-cde1-47c1-8336-2c119fd7d8c0", "value": "4BF3AE1224C5C0B6E16278BB815AC7B14EAE786527269ECF5FC94CB41F24BD2DB3470E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119782, "uuid": "950bd6ad-8ae0-4da7-b575-2987f7127878", "value": "3072:ETX+3BUevPAysBYNJigb0t+GCvQeWmlxRUxLu9oU9YhbzYDWp0X:8xyfKCoNmFULYWQhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119782, "uuid": "e0af736c-053e-4e28-86a3-b3dcd7b48130", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119782, "uuid": "f8a695f7-abbd-4b2e-a67b-31a39b21bbd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119782, "uuid": "db8f124a-eb0a-48ce-be30-9557c3d7029d", "value": "66f5111eb8e9ad2df6bce17ec1355a6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a596255b-bf1f-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1622142820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142820, "uuid": "c75d91a6-d7d7-403a-a334-021145b91ecb", "comment": "Malware payload (RemcosRAT)", "value": "e772bfc410150dbf717842441986db47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142820, "uuid": "ca8aef70-5915-45bc-8591-e09165274f91", "comment": "Malware payload (RemcosRAT)", "value": "ca90a8391204ee90d138b7eddbd1f2e9a1193c1ea1a5ee28cc0d373f9d167c52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142820, "uuid": "255d4d6b-2e87-40e6-b40a-fdada40c891f", "comment": "Malware payload (RemcosRAT)", "value": "2afa1d6d337c63ff35a45db7e36f5e53b625654a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142820, "uuid": "52ea14f2-0b7c-4265-b18e-e1a7c8bf64c3", "comment": "Malware payload (RemcosRAT)", "value": "6df0f4ad06aeb3042f9bb1601ef0a363f7e879b4a43e674b3bbac3f406bdeafa206162cd4773e6c1892ae99fd2e27f8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142820, "uuid": "2041bd94-a336-4c36-91bc-f564f38f0f00", "value": "4E15AE3E16942616D13CC3FACDC0A413E665E917B162EDF898D213A90BD27D674833BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142820, "uuid": "2386b70b-6dc3-4b1a-bfbd-6d81e8d3ba31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142820, "uuid": "0565dc4a-ffd9-4c79-82d6-9eda7c3a12a4", "value": "24576:572tACXGUDxFc0zOiv8Z/yx8D2xhL6tMMysu:1AACXRDxFcpl4YtMMys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622142820, "uuid": "6919811f-d06c-4a64-ae90-a019323bf7cc", "value": 948736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622142820, "uuid": "21d2b26f-a859-4433-9162-e80896a796b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142820, "uuid": "4b0b3d83-481a-48e4-8f56-41f226a51ea8", "value": "e772bfc410150dbf717842441986db47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51c08c5-beb2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622096004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096004, "uuid": "dd29ea08-57c7-4f22-bff9-c64be86dea5e", "comment": "Malware payload (AgentTesla)", "value": "9f14d6147ec30fda404fedd956b02ba4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096004, "uuid": "20bb227c-0d05-420c-bec2-ffaa76e80590", "comment": "Malware payload (AgentTesla)", "value": "cc1b5d976d21bf5c4dc7cf1183e83444092dcc1c79d5cda49e515a26c3bdb329", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096004, "uuid": "b552b38e-21fe-4815-8643-6f195ab810a9", "comment": "Malware payload (AgentTesla)", "value": "8043db012cd954c1881142543e8a133042b418c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096004, "uuid": "c66e9484-57e2-4363-9020-fe8b9a3fbe59", "comment": "Malware payload (AgentTesla)", "value": "b6c8fb370563ebd947cc1f97db62dbedbe4d980de0b49f016345c4c0136e108097b5162eea0580ef30678867cefe668c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096004, "uuid": "5df90781-e9b5-4ace-b8f4-45ecb094bcab", "value": "08B4F066F744D6B2ED161F3481B1692813FFAF36A1B19659648CB2781B3336F10938B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096004, "uuid": "acd871f4-dbe9-478a-a2b1-dd01dda136fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096004, "uuid": "506a79f2-fc0a-4453-9350-e417127c6e7b", "value": "12288:3X1KymUTuGT+0SpJSGuyhLbIlYS72z/e/AkiY8:3XhmUaGSob3Y6MeiY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622096004, "uuid": "fd4b70b5-db1f-4929-8d6c-b9c32edb9100", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622096004, "uuid": "6689dd32-b943-4419-a6a3-7122545aa601", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096004, "uuid": "d549730e-3f60-476c-86d7-09c749bda1ec", "value": "INV BL Shipment Document Packing Lists.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abbeff83-bee1-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1622116202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116202, "uuid": "81adfb09-960d-45f2-8231-0585b4fa093b", "comment": "Malware payload (GuLoader)", "value": "b82b564fcfaf8d526c8623e4ff68a5a5", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116202, "uuid": "b50c3658-164f-4dbf-8d4f-3fbf7b777541", "comment": "Malware payload (GuLoader)", "value": "ccb11db540b028c7524e40415fed0f21d180db473d738c33097e0d871df5cdc2", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116202, "uuid": "86143de4-e385-4c91-ba47-7b268f980698", "comment": "Malware payload (GuLoader)", "value": "4cf065316d3df3a6c224e10eba32477b8ce46713", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116202, "uuid": "e4fefd78-4a0a-46ae-86d7-6af43741a874", "comment": "Malware payload (GuLoader)", "value": "fbe2ea8ceaf7f258d770ad02b19b88804b97edcaeda0fd444365ab79b1309642551e1f5f290b26f4092e838800bfc771", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116202, "uuid": "0273da6b-54d6-4049-adbc-9db5e307b062", "value": "9A65334C7F951B29DD4769B610AB8A7CC867CE8465215EBB3B4EF31429737600EC2B1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116202, "uuid": "14ace94c-2788-4d96-8c1a-b7813d9c2043", "value": "24576:krz9m4WKFTjnt3SuDJSAyOWWubRFKd0G6fBtEcrMK8fXpe9hlq:YzFJnV7D2Tb/A09tEcrefXg9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622116202, "uuid": "5cb68edd-746f-4368-96d3-2d4aea15d54e", "value": 1459200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622116202, "uuid": "79911101-5ed8-4e81-ae8e-f0c8beaab55b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116202, "uuid": "b473479a-d879-43f8-b6bb-d9af428a5a83", "value": "IR21356553_00009339_20210524130931.PDF.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2453f5f3-becb-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622106526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106526, "uuid": "30316c88-50c3-45c9-a5a2-8c770d48d47d", "comment": "Malware payload (SnakeKeylogger)", "value": "5fd023e4878d519105d32d14dda1869d", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106526, "uuid": "ec1aa2b9-34a6-4cc8-8060-e16348f264eb", "comment": "Malware payload (SnakeKeylogger)", "value": "cebeab6db2aaf335a7fa6671aa2a9a55e15c8ccdad55f02b0e2ca0b5bdda75a6", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106526, "uuid": "7da37472-3195-4c65-9ec9-703d6cc2f3a5", "comment": "Malware payload (SnakeKeylogger)", "value": "9417a1a9c574f7b82a4375571921c69c7a265352", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622106526, "uuid": "b19bef27-f432-4427-bd5a-9c401b034ae5", "comment": "Malware payload (SnakeKeylogger)", "value": "f7520c091914443303758ed806e11589421d5efcdabba4d57acffb46b6233ffb124bd71bddeb26e35888d80a9bc0f371", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106526, "uuid": "6e82bbdf-48cd-4bfe-abc5-7e735d10b4ba", "value": "F505AD2D116EF226C1ACC27D0AC4543BF990D73B7131BE69ECD70B985719E80B99227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106526, "uuid": "e40131d1-837c-48aa-9172-9ed26f5d2c4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106526, "uuid": "49c00ead-bbf3-4e76-beb9-91bdc17cfc5e", "value": "12288:vRLzJNvDqyBax6RPJaOEV7xN5JqnBc6g0yZI8wr1jkFJhq+j:vR3fek7RPJmNxjJyg0Z1gNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622106526, "uuid": "fe8f7bc9-7f08-4171-ba85-5f6341b4850a", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622106526, "uuid": "46b2be02-21a3-40fe-a7db-c7cff0fd2f2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622106526, "uuid": "4396aa8d-7269-433f-8f2f-ffb25d7ea9e6", "value": "INVOICE AGREEMENT image.jp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f873023-bf2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622147749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622147749, "uuid": "f5dd77af-dd9a-463b-8de8-f422940fe224", "comment": "Malware payload (Quakbot)", "value": "795b83559dff59fb6121a3103e7a5826", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622147749, "uuid": "dece09ba-e2f9-482e-89d2-283995a9d49f", "comment": "Malware payload (Quakbot)", "value": "cff8e3dd7dd27e58e8b67ffbaed058d6b849d6d8288031e17be09d9ca2555df1", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622147749, "uuid": "12744d14-c47b-46b0-98d8-08c78db0bc09", "comment": "Malware payload (Quakbot)", "value": "098fcc1e8e3160e89bb96e68ccba0a83dda9dda8", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622147749, "uuid": "9b6ffa6c-fa11-4ed2-9415-1c9d86e06fe0", "comment": "Malware payload (Quakbot)", "value": "15c09a29eb66da3a67bd6953e7cbd73827f53014a660a88313a88878745475ed327233a7a939dbc46c2866782cdbf8d6", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622147749, "uuid": "9f2f0b56-38e5-4518-9b35-7ef5acb615e5", "value": "F474127EE2C169F4C3398D3FD680D29082A5F1E041A7732D47DD3928A35325FA95D2EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622147749, "uuid": "8c2039d0-1e0f-4f82-97a4-81fe1287f0c8", "value": "6144:RwRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNP:RwRMmEv2Bc/nvm8IKABfsYOmauFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622147749, "uuid": "574d19f1-371d-4af5-b96a-c52087a544a6", "value": 339474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622147749, "uuid": "3bb0d556-2966-4eb6-ab74-3312b3edac76", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622147749, "uuid": "6445b469-be79-4efe-9a86-07e1187c34a2", "value": "SecuriteInfo.com.Heur.30848.22606", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8e2c6f-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141439, "uuid": "6a4be3d6-dc8c-4fe2-9c89-cb0070c4a421", "comment": "Malware payload (RaccoonStealer)", "value": "f79512994dd1ff099646bbb534072cd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141439, "uuid": "d1293e39-ef5a-4c5b-92c9-ee82f658a106", "comment": "Malware payload (RaccoonStealer)", "value": "d1993b73547aea08d2926cc8796384f5918b1b553a9aaf27bb316f0294753785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141439, "uuid": "dae543f7-c3fe-4838-9396-056562563317", "comment": "Malware payload (RaccoonStealer)", "value": "81686f67c7b56abb51e9640d3b3c0256d01e3463", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141439, "uuid": "7ed9fda0-1893-4eb4-8158-8acb2c4f00df", "comment": "Malware payload (RaccoonStealer)", "value": "c52ac8cc8fb3455bddc37651295925f1540c78e0230cb8970efcdc37c9aa3731b808dd7bed84f0131e76b19531e5f8b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141439, "uuid": "6eceb7a1-46d0-4087-8c4d-66eceaa23831", "value": "F2C4CF21A6A1C035E0F31ABC48B982BD653A7DB2677450CFA2D43BEA45356F7AC30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141439, "uuid": "0fe7b145-8ea4-42ea-a0fd-ab705c485131", "value": "dac802e4a8085608765f3bd680d77304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141439, "uuid": "e55d3f0f-f4ff-4d99-a0df-1c09f1394c10", "value": "12288:W+W/lFJdXXptRp5lN0ioZzO5Mej4JUGrTvLl13i6ez:M/vXb5lN09dOWJdnvB13xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141439, "uuid": "af93dc39-9afc-4a94-94c7-c343a245b94b", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141439, "uuid": "c77cd944-97da-4446-81d6-cf96f0776c01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141439, "uuid": "998403a8-c50e-4cd0-8730-7e35045fde67", "value": "f79512994dd1ff099646bbb534072cd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78db4c4-beac-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622093566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093566, "uuid": "d8e3b14f-d8ce-4f3e-b96a-655c29c43c75", "comment": "Malware payload (AgentTesla)", "value": "cd483a048e27faf6839f137d37567296", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093566, "uuid": "d3e41c3b-07d8-47c4-96c5-2f692c71d843", "comment": "Malware payload (AgentTesla)", "value": "d2578b0374891a585fa4894746bec0b5bc6589b5da8479b423c6fb9d65eaec2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093566, "uuid": "baf9f8d3-3cd2-4162-bfa8-41b3eb180263", "comment": "Malware payload (AgentTesla)", "value": "89ae3f2e6720a60319c605afa22dd8e2c01739cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093566, "uuid": "0f3affec-e52a-48b6-bc6d-5bab866a8b85", "comment": "Malware payload (AgentTesla)", "value": "a60b92d76e346bf8c12a5889eb50894bc18797314cf8a6dbab28a6db45a32e0a6016538b126f5c6801787d566e2f634f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093566, "uuid": "3a1f756e-4137-4fe3-8777-595850b5a784", "value": "0BE47D1C2568D226E5ACD2B48ED5D82FD160E93B7112FFE8D8E643B90B07A43798117F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093566, "uuid": "e42c7796-c389-46af-abb6-4b964da66b91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093566, "uuid": "0f7f0b4b-be17-4319-af60-d856b19741ff", "value": "12288:jWpysdhwb8i8v8B5FqYwPJa/+6/n4UkR+IuY:6ndh9EB5FzMT6/4DwIuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093566, "uuid": "ee198646-9e26-47cc-a6c6-6e7c36c0af98", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093566, "uuid": "4b3a3ade-2860-4983-80be-b74dc517660b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093566, "uuid": "7d902ea9-e455-4de7-a86a-1a103c4c74aa", "value": "Scan docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4c0f83-bee7-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622118864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622118864, "uuid": "f9cace86-744b-423e-a5f2-d026f7d00295", "comment": "Malware payload (SnakeKeylogger)", "value": "9ef3f7e341a810b9d6289453f7e53155", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622118864, "uuid": "8c0ff4b0-79e9-4233-afe3-f487f75ef14f", "comment": "Malware payload (SnakeKeylogger)", "value": "d5e33330a0fccc0bec46f1d928cfe64fa838a8fa50b60a8913bbd20c89469f06", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622118864, "uuid": "9fcc200d-f3a7-423c-a146-baadf2f1f899", "comment": "Malware payload (SnakeKeylogger)", "value": "74a79687912c3bc2f0b1a8d605dea5e7b8b2e8fc", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622118864, "uuid": "b2570c67-35c7-47dc-9102-0de1514e8f30", "comment": "Malware payload (SnakeKeylogger)", "value": "5c1b3750707e2b4e6597564b17794d3d0bbd41b5c521dbd2057d04e51bf7b2dd6242f222af32e4ac44427ecda2d90bcc", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622118864, "uuid": "40a6e248-2788-415d-834f-e3ac216fbbdd", "value": "AEE50B0C1CDB6148E65B1DA33EEE10C4DC7A650939FCB5935E09091B9E87F04BDAAF1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622118864, "uuid": "58886c4d-1211-4b15-94b8-601cb774142a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622118864, "uuid": "d763b729-2580-44d0-99b2-c9a8ea21efa2", "value": "1536:ZYyytImvHpbTaphCIzmlTHdTGnTMvnEIQXTQv5qFk8y3K/jLniW3/HWmQgueixjP:ZgPMYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622118864, "uuid": "384992c0-0921-46a3-a902-0d284b35c5ee", "value": 3190272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622118864, "uuid": "1d5aa9ed-3c32-4462-b2ec-18e0a76b5db4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622118864, "uuid": "3f826e04-d2c7-4373-bd3b-a8b34066ad9e", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.22984.6318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86969c6-bee1-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622116196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116196, "uuid": "ce1c3c99-7ca6-42d4-bb54-23ed08d34354", "comment": "Malware payload (SnakeKeylogger)", "value": "2c18205f1fc4fd8ee03332dd8ccd66d7", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116196, "uuid": "95d2edbd-69e5-44d0-9389-2d2495b7f925", "comment": "Malware payload (SnakeKeylogger)", "value": "d61e50d7a5f7aa30b6eb90ddf1acfda2cd9a875dab8e841dc71a0e7db15b6ecf", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116196, "uuid": "cdc3d42f-bbbe-456b-b90b-0bd74023f4a0", "comment": "Malware payload (SnakeKeylogger)", "value": "ca0c50b3137fdeb694ec3d9130250567d6cf89d5", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116196, "uuid": "e4f424ca-8be3-4961-9d23-c175c55af120", "comment": "Malware payload (SnakeKeylogger)", "value": "3fc0b3f75f87d57ca5b1e46bb47ce4480745c8134682d8a541625a5360f3fe3ab672d674bc06bbe6d6018f872cf5bd78", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116196, "uuid": "3fdff61c-e1b2-4831-99a4-2067c32af0df", "value": "BF8412A4B2D5CA43CA471379CCD642DAB622FC62AB86C3873794F71D57323C48A53356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116196, "uuid": "9698a7e3-a06a-487d-a01f-401b06f335b1", "value": "12288:C5UMHq/88o5zJOcVLEP9iEtHliIM9fGa:C2M2C5zJwbtHW9fGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622116196, "uuid": "d22f9901-75e2-43d2-907d-7edd456da4cc", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622116196, "uuid": "7ea356d4-be3d-41a4-8ac6-305b62211797", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116196, "uuid": "f18f4a87-1af0-4835-83c1-08432efcb13e", "value": "FTL_607222103.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96dc6e35-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141507, "uuid": "e5a2c8bc-03c5-4c57-b404-84f8355df464", "comment": "Malware payload (RaccoonStealer)", "value": "75f21a9e3a62c057f7f1ff053f7f8ecb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141507, "uuid": "50b43c62-3a5d-463f-a7ff-bd5149968e50", "comment": "Malware payload (RaccoonStealer)", "value": "d7536c88d4eebceae700447a2bb2626e012d87d6e56b61add20052328f2465c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141507, "uuid": "e0f45fa8-a15a-41af-bdf5-63ba13d84578", "comment": "Malware payload (RaccoonStealer)", "value": "427d1f4f129b1c01aa3e2878e818d78e77e3924c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141507, "uuid": "e7896162-e928-4f81-8b62-06282dc65e44", "comment": "Malware payload (RaccoonStealer)", "value": "52218d07082b90a51a126d56aaf9ebf3d2c1dd36d7f1d6bc3924be0ebef72a979e4ed01bd7576bc4bafa4ac831abd6ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141507, "uuid": "98c13942-1242-4421-9cda-59fe11697062", "value": "24C4CF31AEE1C035F0F256F449BA82B4A53ABDB1673450CF21C43EEA4675AE5AD30793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141507, "uuid": "bc111da5-9f12-48ba-aae2-c03f160c4b03", "value": "491e594dd178e0e1cc881884afe309e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141507, "uuid": "501d2714-cef0-4c1a-adaa-2c4fb024dbea", "value": "12288:znzGjAVOUoRXMnSM5KBuPWONDWQKCCmiHweOu:3GjXRgh5KiZFfhihOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141507, "uuid": "c30cb179-f328-4ebf-89d9-c6fa9421ab8e", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141507, "uuid": "899bc6cf-991a-4bd5-9405-96c50e0c7ad4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141507, "uuid": "812da77d-73b9-4f45-9bdd-d101826fbbd5", "value": "75f21a9e3a62c057f7f1ff053f7f8ecb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fc1b14-beb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622096001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096001, "uuid": "360a0665-2cef-4127-80eb-6a0aa219e306", "comment": "Malware payload (Formbook)", "value": "0bd97d3e4c46970a2d79f2348b979487", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096001, "uuid": "1febdec0-e367-4836-9631-5e0a6d32f520", "comment": "Malware payload (Formbook)", "value": "d7d2e1f3971983ade2d3d7728651354827c37b565eca280a72f1649bddbcdf41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096001, "uuid": "5597152a-34f2-4f8c-86d7-a65bf646f485", "comment": "Malware payload (Formbook)", "value": "173eec3974493d9ce934a84da74a624769aa0e67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622096001, "uuid": "dfcae876-8c3e-4f2a-bb73-f30e1ec9a72a", "comment": "Malware payload (Formbook)", "value": "0bb18b6a7f901f9743889072d3397d6b772244de60d682a6bd1d064db712e0b653b5213fc46c515bd8a6f3d253b1627f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096001, "uuid": "f69f050b-bcd5-4069-b44d-0f615c0280db", "value": "2655D01C25698227E5A8D2B49DD5D82FD560F93B7112FFE8D8E203B90B07A83798117F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096001, "uuid": "3a568352-b101-4001-82f7-595e2f2bc4d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096001, "uuid": "b255963b-56f4-4461-ae3b-eef6b9496f80", "value": "24576:BFdzbbeIKPQZo0LgriBOFWBYDjT7wQMxzaUeqm6:BFoI5o0LguOHHwQMxzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622096001, "uuid": "754228c7-31ef-4d49-a1ec-e9562710c17c", "value": 1334784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622096001, "uuid": "4c20120c-ac4a-46d7-ba18-0f8462291c5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622096001, "uuid": "47c9c655-6203-450e-a074-5449c2224526", "value": "Slip__Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec084b29-beb7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622098271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622098271, "uuid": "a5047f6b-6d8b-4ccb-86bd-16b7f4de1d12", "comment": "Malware payload (RedLineStealer)", "value": "a383b619e3eb59a389fcdd6ab06031b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622098271, "uuid": "3ca7c912-67d6-4cf8-b67a-1a8fbd17e20c", "comment": "Malware payload (RedLineStealer)", "value": "d963f4aed34e78fcdf6566dc8f777d85178244634e0e5c4473489afe48cb9a82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622098271, "uuid": "62634829-4a3e-4c7e-9f99-70603e084efe", "comment": "Malware payload (RedLineStealer)", "value": "33888ac4e16034e07bb290bbbca3dbe232c96eaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622098271, "uuid": "dedc62df-7cf9-457a-b851-558afabcf4cd", "comment": "Malware payload (RedLineStealer)", "value": "dfcce28f9820bab9b4ffcc5ceeeb91b2a5650442392cb111ed13517c3bac9389f97529d1ded9b880735a0ee3b1ae465e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622098271, "uuid": "e8a75045-08e6-4cde-a30a-018f42542d79", "value": "4C121829E3B8D272CEBB1A31ECB353409770E7900067E95F56C9891B6DE3F5806926F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622098271, "uuid": "e444e55e-e34b-42f5-9eb5-9e64b3d14f63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622098271, "uuid": "32153320-f52c-46d5-85c1-8002a4ba1b52", "value": "192:HBksu7m6N7oy1X9eMZZ3d93Vnjdwqzx3l1mP2f:P4xB9eM3Fnhwq9V1mO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622098271, "uuid": "ad40cdb6-216c-4bff-8b74-7abdfcf01e2f", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622098271, "uuid": "39b14032-660f-4545-ab10-d8c5e922258b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622098271, "uuid": "d4f2a2cd-dcb2-4237-8969-7aa25434c66e", "value": "a383b619e3eb59a389fcdd6ab06031b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70157c00-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141442, "uuid": "af625a4f-df38-4324-b80e-686d592c7d2a", "comment": "Malware payload (Stop)", "value": "feb28fb1d0b0fdf9415916408882e52c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141442, "uuid": "321d9db9-0e7e-46ae-a5e5-209255a7e0b3", "comment": "Malware payload (Stop)", "value": "d9767e19da70445e2954d08807ce67f7b870952932042274abff94ccd6a46eec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141442, "uuid": "30028ca7-9ae4-4c49-8efc-a46cf387f8ab", "comment": "Malware payload (Stop)", "value": "6282259aeaef8c99ed32695a590f45763eadcda2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141442, "uuid": "ac9996cf-1d5a-464e-b7f2-816a46921b4b", "comment": "Malware payload (Stop)", "value": "8cebf7b929a73a7ab9987bc53e4ac002803c4143ebe00884db17c8291c056ccb219c50cf85517984ebc5db33e51576fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141442, "uuid": "1f7c38b4-baed-4c73-9d00-7c96cc79667a", "value": "7605F121A6E1C034E1F712F445B5967AB53ABDB26BE080CF52C127EA76346E5BC30B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141442, "uuid": "0f6197c2-1377-44e7-8739-f9500f791025", "value": "bca4c139115857ba195befba3c3bfd5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141442, "uuid": "aff23e88-b4d8-4845-8fa9-5d858a13d583", "value": "12288:chR/jzhkFXIMj/C59Gdo1tA/5BLuUSPpVXXZ8J4OLz6VMeSv1/C46zpiE6:W/UXxC59G4tE63p5uKOiVM1tHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141442, "uuid": "9de67b62-207b-42b0-826e-19f1f9349d6b", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141442, "uuid": "b3075367-2b15-4fc6-9ba1-da55bab94d80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141442, "uuid": "920f0e65-fb41-4070-8ec8-9c42ebc7c52d", "value": "feb28fb1d0b0fdf9415916408882e52c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae96a8db-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622141547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141547, "uuid": "afe77bac-f3f1-4603-8488-a51875d77f32", "comment": "Malware payload (RedLineStealer)", "value": "a5e429ba9dee7fcd2898667e957be1e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141547, "uuid": "11ae26c0-6a17-49ee-b7db-a78dfe0a37d5", "comment": "Malware payload (RedLineStealer)", "value": "da95de4e9d6377d3fb8509f8c5ff35a47840158562a8e8d2fb8efe766aa857c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141547, "uuid": "704366dd-0331-43b1-b7d2-6ea5bc7441d5", "comment": "Malware payload (RedLineStealer)", "value": "4a7e24764ad8cf3d823ddda7576e72b1d04a6745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141547, "uuid": "ae5c5809-f384-4562-910b-cf9791c96ad1", "comment": "Malware payload (RedLineStealer)", "value": "62453b58a75b1b9cb0a0c1fcffbb8d7bba759373e6d39800413005000ab042a2a0d5a4a21e83de4fb765c44ca79fe3cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141547, "uuid": "5ce174db-8459-4788-8081-cfed15713127", "value": "5A047DAC33C8AF85CBAD463FC6D0561483B5CD6B4147E32B698437F8259FBE6710224A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141547, "uuid": "4a7c1f5a-faaf-44ce-855b-a06f4486bd6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141547, "uuid": "0524f5f2-12a2-49f8-9d50-04d789b8cdea", "value": "3072:qYmgGlOAzJoJFuHEDexqWfWPtsJaxDss8bBnsZx1kFl25:q3TJ8FuHEDKu1sJWDO6ZQFl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141547, "uuid": "3b3d6b78-ec33-4174-9d46-32ef98fbb342", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141547, "uuid": "f71bb8a9-76b3-41f1-831c-e0395a9493d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141547, "uuid": "11696906-0408-4566-8396-9af4e609ae11", "value": "a5e429ba9dee7fcd2898667e957be1e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06113f8-bf1e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622142516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142516, "uuid": "4701a080-be5e-4e22-94e9-a82b29911600", "comment": "Malware payload", "value": "324e61ebc5012a5402334de0c5ffc5c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142516, "uuid": "1540ad8e-a868-4fac-84c1-27b4651f4400", "comment": "Malware payload", "value": "dafdbdf6f2366c9e76551117e36c6f8142cb79fd007a8fd9aacb31e7e8396b67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142516, "uuid": "ccb7e6a2-2cd5-401a-9583-90a2af4942e3", "comment": "Malware payload", "value": "e1a05a2140317662f5a500392c02b0951a263cd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142516, "uuid": "a2d6a2fc-c50a-49e2-be18-1e8cd9aa28ff", "comment": "Malware payload", "value": "f33d8b9bb36c5e4adc2639d6ec9c16ab602fe7be70b16f92a0b7620303520972d9142ddd056f2ddc8181276821ac9386", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142516, "uuid": "be66fb58-8555-4d94-8810-207a85f82b60", "value": "4225DF887050B48EC863CD316A9CDC54E65A3CA2B3569F83BD83339F99FF2459F442A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142516, "uuid": "e13024b2-f4fb-4c7b-ae0d-3d7e22d4303d", "value": "24576:pAlxByfN5/wSC8+6CY1mNEq4CV1l4H444h:6lTyfN+B6CY1C54CVH4H444h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622142516, "uuid": "87d416df-da44-401d-bef6-4722123dac28", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622142516, "uuid": "d6bc7895-b3f1-4676-9080-909001626601", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142516, "uuid": "9e5a79de-27b1-407f-806d-840ad0049ddd", "value": "Shipment arrival notice2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c201d8-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1622141562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141562, "uuid": "6d95481e-ddb1-494e-9b49-852bf7980282", "comment": "Malware payload (NetWire)", "value": "1dec08891610db104bce8f7abdcf3c93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141562, "uuid": "952358f7-1123-4250-9ab2-0b847234dda6", "comment": "Malware payload (NetWire)", "value": "dc9030495d59d6792868d978609f095ab2cf6145a60897550d606712717bac76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141562, "uuid": "322643a4-313f-4155-8b5c-3b0da83eb80f", "comment": "Malware payload (NetWire)", "value": "f752d4fce11482deb2cbe2b7d36c2fa35a9098f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141562, "uuid": "f8f1edf7-109b-4ec4-bf10-2b46fa03ebd4", "comment": "Malware payload (NetWire)", "value": "304d694d7939239e0e0b1ba347ded05ff4b97b2ea73b8bff9870377288328504baa724a3ca7bb506870ccaa6d932886a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141562, "uuid": "549f3187-c31e-496d-ba67-7a625a63bb0e", "value": "5F65225BB541C0EEC7974AB0CE1AD36CA6236DF1AFE08042BFC53B9E6F7546AD915002", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141562, "uuid": "e3db6fde-75ca-4bbf-acad-ff40aab82cd6", "value": "29b61e5a552b3a9bc00953de1c93be41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141562, "uuid": "97173482-806f-499e-9695-dfeb2a4869a3", "value": "24576:0iH+xbBfsT5p0AYzGqSB1lAZqOvWeRE5E82qc5BSssc+kX:dmBEqzGqSBQZ5BEaH5BtsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141562, "uuid": "2fbe9bf8-b017-4e08-8492-aafb5abe9d01", "value": 1504036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141562, "uuid": "19335cf8-37c9-4564-8568-afc26fbe5b00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141562, "uuid": "2c54f5a8-9806-4213-a5ff-4873e4339508", "value": "PO20880538.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7285574f-bece-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622107945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107945, "uuid": "cf5376e4-e140-463f-b941-2ffce7db5711", "comment": "Malware payload (AgentTesla)", "value": "70fddb1d09c7870405664cf7abf0a741", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107945, "uuid": "3ff896eb-9800-48ba-a35c-557228bf83c3", "comment": "Malware payload (AgentTesla)", "value": "dd6d6fec3d550d6a03b813c09df830c9a542e4d4b54401398e4625a5649ed874", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107945, "uuid": "51e330c3-9806-4c50-aade-14c5aa5313b5", "comment": "Malware payload (AgentTesla)", "value": "cb2c6b46c3862c1c81ddc63933ab61258d0216a9", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622107945, "uuid": "f9d26356-2219-40d7-9185-a088be21fd05", "comment": "Malware payload (AgentTesla)", "value": "77f1e3921a7b19be1b279dd0b5a64e0d3dabb99a2049a7af1892ce47c182b61ef037e512835632a17038956df0c89248", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107945, "uuid": "69b93968-d381-4a4a-80b4-a3c166a9d9bc", "value": "9EE4BE91A290A4E7CEF85E7B6A0ADE340F217DF8E11991A535DC3DAF74F66F30244182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107945, "uuid": "40dfb920-afac-4ed5-879d-525b214448f7", "value": "12288:k1iOz1A5/kZcv0KkbXnl9g2WQr/tPDLueGX52MMMMMMMMMMMuMMMMMMMMMMMMMMM:Iz18/kZcMK6Xnla2WQr/tPDFGX52MMMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622107945, "uuid": "f0d521e3-f075-49e5-a535-7d61779f69fd", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622107945, "uuid": "299479c5-a373-420a-96e4-c3c395b74978", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622107945, "uuid": "fe978d8a-8170-471b-9d80-b4ecaf41e0f2", "value": "Bank_Information.tar.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a004c86-bf38-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622153458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622153458, "uuid": "8601ec79-31b1-45ff-802e-0d4f2262e4b3", "comment": "Malware payload (RaccoonStealer)", "value": "0ddaacddc23b1eefcd65c552b79a86b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622153458, "uuid": "33cb4c56-820a-46ef-88fa-d30981ce13b3", "comment": "Malware payload (RaccoonStealer)", "value": "df102108e8beb55334e3976e1cb7f389e8f9ecd23a12c4d71c22921626938c50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622153458, "uuid": "1b69791a-73be-48f3-9a26-7778de008b48", "comment": "Malware payload (RaccoonStealer)", "value": "b9e6d4f5f10707ef1125b6dff0a6ad456e38d53c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622153458, "uuid": "c55aaca2-572d-4091-a29b-c7914a6a7708", "comment": "Malware payload (RaccoonStealer)", "value": "f6edcf552f0519e557fd7b51ee7150afb99d318e93856614add68f4115dc6a94c6e371cd105610963a89c55931d4850e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622153458, "uuid": "3f2ac130-3714-4bff-9b6d-eb56bc3063aa", "value": "CB163392738205B5D6B0D174AA9C9F73427D43E84734A8F397A0C94D9A3EC51F267B0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622153458, "uuid": "fbf81b9b-d0b7-4c32-b405-a1579071791d", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622153458, "uuid": "b3ca0c11-fd24-4d59-b553-5ba4eaf0c0bd", "value": "98304:xkCvLUBsgbg6l+Pmmfj9w9jEDMUxkZ1S+KnzFkZRmWxT9hUA:x5LUCgbNlrgmxgMIkZ10smWB9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622153458, "uuid": "f064dd58-e322-4aa1-9c60-db67752bbef7", "value": 4113402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622153458, "uuid": "94b222ba-b107-4514-a247-378be7bede17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622153458, "uuid": "be8ee530-c69f-4356-a740-ffd883eb4ce3", "value": "0DDAACDDC23B1EEFCD65C552B79A86B7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82040005-beb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Matiex)", "timestamp": 1622095945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095945, "uuid": "3b9997b9-4ab1-442b-b561-7f46294f2a9e", "comment": "Malware payload (Matiex)", "value": "8bd53e3504794176de65b6174a564cc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095945, "uuid": "131a3e1c-5b72-4004-92aa-306121af8395", "comment": "Malware payload (Matiex)", "value": "df333bbcd3fdf540358e2502f9e138e16d1cf73f13564d0fe6c40c7f0164ff7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095945, "uuid": "400b333e-d0c0-4446-bf8a-901f863abbca", "comment": "Malware payload (Matiex)", "value": "c3537faee541d30689dd17005992ec328a356698", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622095945, "uuid": "1764f17b-8e8d-48fe-8038-9d2ed71763e1", "comment": "Malware payload (Matiex)", "value": "f1cf0a1b2086575d71f6ea748654ebfa51ba9724d42e333b26cb05a0d98de8a6519ddeafe15979a42802e374abf92595", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095945, "uuid": "a952d153-5791-4db9-b46d-2bb2afa5a964", "value": "0825AE1E6519921AD438D7BCDDC988136713B8BB7002ED98BCC763764392A96B46333F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095945, "uuid": "06c3720d-5b24-47ba-b8d7-54ac3822de4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095945, "uuid": "d264c9e1-d3b3-474f-9b77-b01d65ace1b7", "value": "12288:EZsejAspMkN6T/NVCBxKfCBYGx4s2wGtRYoQJsC6wq8IH1:E+3T/qPGyYGx4bjuaCZIH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622095945, "uuid": "5c6bc26e-775a-42ec-8ec7-9b664a451510", "value": 1018880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622095945, "uuid": "62d501ff-e1f4-4468-a798-f943e0913948", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622095945, "uuid": "32ecabdc-32fb-4606-b64b-8762a29e9a2e", "value": "Inv7343-h5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878f7cdb-beea-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1622120007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120007, "uuid": "82b1ad24-1082-48eb-8c35-12544e02fcb8", "comment": "Malware payload (NanoCore)", "value": "a7a8c3e6b8854ab03b71a5b128d7b9ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120007, "uuid": "51f25447-280d-468a-bfb2-60ffeefc91c1", "comment": "Malware payload (NanoCore)", "value": "df6dc86d7d3af52012925193704ab594844739b107f8e635dd4f46aa4aa4d5d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120007, "uuid": "05102a43-f607-4a80-83bd-b7b27483d3bb", "comment": "Malware payload (NanoCore)", "value": "bdc8842ee0adc28bf209b07b19fedb12eba56397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120007, "uuid": "81af0a86-d9aa-400b-93b3-323c9674155c", "comment": "Malware payload (NanoCore)", "value": "b0337838a0b7f1b468894ff01717effb007c5be992c61d27e9a36f7cf660c2be44ac65d8b8e3b1bf2fc3149c7746885f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120007, "uuid": "32efde14-1c22-4880-8eeb-f5e36584e4b8", "value": "DB45DF6E3240F69FD927C87289682D70EB60B676830BE3036453469DDE4E5ABDF111F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120007, "uuid": "c5a4cc15-eb80-4d79-b34c-1b01e2f28e14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120007, "uuid": "4b649841-9aa3-4623-b0cc-47470548e313", "value": "24576:SdwaNdXmvTOhbOr75f/Lt2Y/NKtplYphTc0AXKyOgin:ShHWTOxOr753LQ9xYfT4hYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622120007, "uuid": "abd275aa-1b0e-4680-ab27-1882ba937374", "value": 1219072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622120007, "uuid": "32e2717c-0c97-4d84-8497-5bdf2e443a63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120007, "uuid": "77425b3e-951a-4a12-a078-ef7f868409e0", "value": "a7a8c3e6b8854ab03b71a5b128d7b9ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb77082-bee1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622116203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116203, "uuid": "95614937-9198-4bd9-b2e8-81509e309761", "comment": "Malware payload (AgentTesla)", "value": "62a3ad2e234b9b3a74c23db4f6adae2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116203, "uuid": "6946d615-4e07-40b0-b82c-ef00551d84a2", "comment": "Malware payload (AgentTesla)", "value": "e10ee4f3420f1298d05f24cbdbdb3c89c2eb951762b61777e90aa388652d1b3e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116203, "uuid": "4ba5441b-ffda-438f-9825-59f68f844378", "comment": "Malware payload (AgentTesla)", "value": "d5b774bd8377f1c2cc26500989059d7c0a16c3a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622116203, "uuid": "50976d6f-237f-46e3-abe2-b3f70e8940dc", "comment": "Malware payload (AgentTesla)", "value": "6c67601a242e051d4b31936447ee4a534d360ce01251abd38dc884b856232294fd6ebb231e3b29df43c4ceb94695fcbe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116203, "uuid": "677f53fd-904d-4b1f-80d9-096c4f179e7a", "value": "F9712A6821FC0D85CD6E0166AC7DFD8262C4B0468EC96CF031DEDDC803AE3617635557", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116203, "uuid": "509be99b-dc8e-4999-8e2d-e0d44a81d02e", "value": "96:36S390X7untTnoPorwBSRh64QWZzHRw9wO:F39mAJokwcRh6kFxrO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622116203, "uuid": "9f80f9ba-2459-4a0b-bbc3-f0780c071563", "value": 3511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622116203, "uuid": "918d2679-24ff-4bef-8638-9241b841c1fc", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622116203, "uuid": "959d9e4c-9aad-471c-b8b9-2347cabec190", "value": "MADINA GROUP RFQ for PIPES.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2c9992-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1622141575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141575, "uuid": "bcd0053b-ac34-4fbb-9799-5e902de1a29d", "comment": "Malware payload (CryptBot)", "value": "042fc8a0746598b0ea113cbd1cc6f1c7", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141575, "uuid": "7d195af1-c221-46e6-a4e0-80955dfe17db", "comment": "Malware payload (CryptBot)", "value": "e2627edaef3e465cadfb84b250bc0d47cef26af5d2334e5f49ab38d8f919b511", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141575, "uuid": "43a25083-e2f5-4c20-990c-2aed95c143c5", "comment": "Malware payload (CryptBot)", "value": "4d389e0fa00bbccf3453b4b7c2339cbb80091b0f", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141575, "uuid": "edcb9072-6fb6-4dd3-ad37-180699ad21ab", "comment": "Malware payload (CryptBot)", "value": "f713f0bc11c2f71a98f1dfe7330f293aa25f119e7f728e3cac59dcef4229b5103c423d8c24b2ab935a3533bb4ba1cf65", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141575, "uuid": "eb2be653-7d45-4830-ab77-983a8ca9abaa", "value": "6FF4F130A790C034E5F325B444BA82B9953ABDF2A77450CFD2D43AEA5634AE1DE31B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141575, "uuid": "823c1345-c265-4dab-88ac-59f417f248c0", "value": "a31151b8599e7385dee2461451ee66a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141575, "uuid": "d0876289-7e80-47a6-9fb4-58fd90d0cd86", "value": "12288:ASlcYzlup7rSYBSSDzqToWQ7JQhqfG+ucvzoQu4aGVvxZ6zdMkjom0gwCyevb5xh:UYzlmBSSeS2qftuIzoY7Z6zdbjom1wCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141575, "uuid": "02a62132-60cc-4784-acc6-3b78387c2372", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141575, "uuid": "03b49f25-f692-4e6a-b15d-cd2c79705eaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141575, "uuid": "193f5e7d-dc12-42eb-a39e-1a748238b7d5", "value": "042fc8a0746598b0ea113cbd1cc6f1c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35b5472-bef2-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622123597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123597, "uuid": "b3ca5e84-f5d3-4873-852d-30c2bae59eca", "comment": "Malware payload (SnakeKeylogger)", "value": "296a626e83428eecdd6c5540fbc186bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123597, "uuid": "3c2733e3-e5a1-4abe-8f83-254da2f85e97", "comment": "Malware payload (SnakeKeylogger)", "value": "e29819fc521c66163dfbe1d264c560d4fe8a5bbd5d19b49ce86d001dc7aadd9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123597, "uuid": "bc0c7269-7424-45f7-baec-dcff661e0657", "comment": "Malware payload (SnakeKeylogger)", "value": "efd87b54d87bf2c1af4cb45f928dc0d18c9b481c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123597, "uuid": "2fca28ab-e1a9-4cc0-9397-6d6f89aed03e", "comment": "Malware payload (SnakeKeylogger)", "value": "a820205688177186718ec62cd38e7264972fddeea079079990362dba2b3b4e0e0abddf57722a1ab557d2dd78c52fa16f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123597, "uuid": "72ff48de-32de-4246-93e6-1697e9b460da", "value": "FFF45A3439FA501AB173EF6A9BE4B59ADA6FB7733B03645E109003464723A41DEC253E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123597, "uuid": "427e70f0-b9fd-4836-b51e-2a73e26a01aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123597, "uuid": "2b6dedbc-0036-405f-98a1-9a9ecf98c5a3", "value": "12288:BC1mlOjfSABnis20xZJgYlCvqyEmfp2OhZoEbYhQTRQHNm1EeGszoT+HJLTTsYp:8YOmNmG2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622123597, "uuid": "fef11e18-178d-474d-a848-07df4a1fb4fd", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622123597, "uuid": "90d8fddb-8d9f-4293-9221-89ba58c01155", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123597, "uuid": "14854c98-6188-42c1-af23-59ac8eaa47ba", "value": "sirt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123713ef-bf36-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622152451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622152451, "uuid": "2668f867-fb16-4753-979d-d9de2c5de612", "comment": "Malware payload", "value": "d2ed93283144a3049c608429bb2ce89c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622152451, "uuid": "5ffdfb57-1e1c-4a37-b2c3-b9b5e2ea6c0d", "comment": "Malware payload", "value": "e4db906633b826b98a70dfc1f9a59c89139b041cc200c1c8021057e40151d28e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622152451, "uuid": "1153d37d-f95a-40df-9555-ad440d4cfb47", "comment": "Malware payload", "value": "71b80d3b25285c9b7202c9b3fe9a310aed988f44", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622152451, "uuid": "f314ceaa-e30d-4863-ba94-431b309ed727", "comment": "Malware payload", "value": "38026641f41c13f419c5acbdc67822c94228e797c2a48a4d2b476350f6203edf9805b5ae7b22198601592c5376b1f619", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622152451, "uuid": "ae8f3131-da07-4e78-b358-aecf72f4849a", "value": "429302809071A094DF2AD731BB8F81595FCBBC1AAE076B7953417E5E6BB6CC0A313069", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622152451, "uuid": "0a73b934-e13e-4bae-8954-f8d2195f8360", "value": "1536:5lJsVXqZqgoCIn21T4EHhK8uKzlEbnw92ZdMKmAQY:NpoyT4CQbKhEhMKme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622152451, "uuid": "0b5c25bd-438f-4884-9bce-69ae3bc74f01", "value": 91141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622152451, "uuid": "6367e837-5c76-495d-b8ea-193fc4b97342", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622152451, "uuid": "5027f6f9-97e3-49d6-996b-5973ded74cb1", "value": "e4db906633b826b98a70dfc1f9a59c89139b041cc200c1c8021057e40151d28e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f782a962-bece-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1622108169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108169, "uuid": "40d4d72f-9837-42a8-8b00-320cf954f944", "comment": "Malware payload (CryptBot)", "value": "7a2f5bc93c259322c16e5a94f7139031", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108169, "uuid": "a0e1486c-9efd-417d-aac4-bf5f5b4fb40d", "comment": "Malware payload (CryptBot)", "value": "e5dae08e748e408a4a256bd0c5d216281596a20399ea0127ac35b1661248b3ea", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108169, "uuid": "9587ac83-09c6-4fe0-b07f-9ffa84ce81af", "comment": "Malware payload (CryptBot)", "value": "d7d2408cfdc8860a52546dff71ffdbec835102d8", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108169, "uuid": "eaf153ac-4011-40ed-8fff-8bca20715b4b", "comment": "Malware payload (CryptBot)", "value": "6924393cb3ca0e6af3fb3de3afadff1aaf654401aa8f7765394928d09fba485ef12bace8857d3241bd47f075f50597ea", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108169, "uuid": "6c120888-5fd9-49af-94be-7ac93917a741", "value": "B6F4F121A691C035F1F716F488B5E278A53A7DB26B7440CF62CD2BEB56346E4AC30B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108169, "uuid": "805f6d74-a6f8-4c89-8e23-bb9350d87235", "value": "556bc424bd608c9e064a122699e67eca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108169, "uuid": "aa8375bd-6036-4721-8a80-94238c39023f", "value": "12288:ARMTHCo1KlqQcZUgix5ieKimzvRP9pVgIae6wJTCjMFMt9qIzT7Y8A/5+Cwr4:LTYluWO5igf3gIjQjL8/0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622108169, "uuid": "35010674-8daa-42c6-88eb-9a80f73899b3", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622108169, "uuid": "0da85b7f-772f-4374-8687-647793964c1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108169, "uuid": "d0e72c09-25d8-45c8-becf-dfca303d770b", "value": "SecuriteInfo.com.W32.AIDetect.malware1.14936.10307", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3a3623-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1622141405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141405, "uuid": "8e397b56-aaa6-49e4-8935-bb52aa2a5037", "comment": "Malware payload (njrat)", "value": "5552c809bf26bf8bc649f12a327f89e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141405, "uuid": "a317c7b7-494a-4096-9c38-82cecd787433", "comment": "Malware payload (njrat)", "value": "e732588f5e528dbf258a36c6eb6ade9de82da5d2290e9b378a13c11d4f1dc8c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141405, "uuid": "6ef37608-e015-4f1f-b73e-9250c06ab4d8", "comment": "Malware payload (njrat)", "value": "1a2927d40cc370c0164c45a7ae63c4d354f50446", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141405, "uuid": "b14a3af7-88a4-4dc4-bd86-15b58febd11f", "comment": "Malware payload (njrat)", "value": "02301df18300744a5f06c8a34ad42f206f02438c972a707e68428544181a2c53b25199890448f681d78086a9cad707c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141405, "uuid": "0f83d8ec-08fa-4bca-bfb8-9839e98f9da5", "value": "68B2094E3FA98866D5AC17748AB5965003B091870423EF3FCCC554CBAFB36D92D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141405, "uuid": "7c22a701-4bda-4685-9acc-f77d32404482", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141405, "uuid": "55a9d1fa-d26f-422c-abcd-37c5855bf2d6", "value": "384:AluBPiZCMfdfSJrQbsLRGSIxYVL46pg/i8BD9BmRvR6JZlbw8hqIusZzZJf:vOmhtIiRpcnuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141405, "uuid": "764e4012-ef38-42ed-8b15-dd222219b8f5", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141405, "uuid": "b3fda1ff-b7fc-4903-8d15-6d649bee42fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141405, "uuid": "fff1994d-2e4e-4a79-9740-f8a78984f19d", "value": "5552C809BF26BF8BC649F12A327F89E9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ca0fba-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141480, "uuid": "053700ba-3aba-45e5-a9cc-9c2a8e63b505", "comment": "Malware payload (RaccoonStealer)", "value": "39370573e02f4d1d282b32abdf630b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141480, "uuid": "a77bcfe9-bf85-4bae-8c50-1bb46757731c", "comment": "Malware payload (RaccoonStealer)", "value": "e7b76b39a0d1d7f1598ef84feb3184b4b207ba9c85c4acd81ebc9ada6ea67c60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141480, "uuid": "48347d70-69c7-4a5e-91b2-5b188709449b", "comment": "Malware payload (RaccoonStealer)", "value": "96c4da90ecc8626f4999e85fd3dff41821ddb95c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141480, "uuid": "ed9ea98d-f876-472f-a06c-93efe0f9b920", "comment": "Malware payload (RaccoonStealer)", "value": "fce98e4e0b52d7203f85480b9ba31c340275f9fbfae65f31a8b36f54da6f4cfafc588aa23bfaaeb2cbb0292d742b9cd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141480, "uuid": "af091812-e6d1-46ab-9ad7-0ada9adcea70", "value": "BEC4DF31A6A1C036F6F716B448B69278A43A7DB26B7440CF62D037EA46347E4EC31B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141480, "uuid": "cec77077-937f-4ec7-a7ff-8e9b68c55f86", "value": "556bc424bd608c9e064a122699e67eca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141480, "uuid": "c55d8846-c83d-4e18-b21e-fb7ac2373459", "value": "12288:Aa7Tnr89D5eASJQMOCLniAnWwP1TBhAiMSpgeOC:XTe5cQGi6WKTjPMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141480, "uuid": "bb500179-986e-4fb6-9153-3603fa74b37f", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141480, "uuid": "4311c9d6-95cb-4771-a5ee-55b32f3b8edc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141480, "uuid": "069208d5-2cb3-4311-b59b-a040da9c3f51", "value": "39370573e02f4d1d282b32abdf630b1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a881db13-bf3e-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1622156140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622156140, "uuid": "99d2d0f9-ce6c-4757-8805-02dccba8aa1e", "comment": "Malware payload (CryptBot)", "value": "4ab92989a8709a31edb4ecbffd8e0ad5", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622156140, "uuid": "ead26c3a-f913-4cc6-8ca4-baabcf8811fd", "comment": "Malware payload (CryptBot)", "value": "e7c3cea59ec83faa8886c1a5d0b0eabd00cf68ae8491ad6a985f3b6e422c0d19", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622156140, "uuid": "3119d679-e355-4e8c-8b38-48449758fe3d", "comment": "Malware payload (CryptBot)", "value": "7a7f62356a67071b0943686b57232c13289fd075", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622156140, "uuid": "d29d3409-0816-4721-8f9d-81b7df2e957e", "comment": "Malware payload (CryptBot)", "value": "371a043d976476be11d6ff2f25e80e470ea9afd44e607ed32ba0a453a763b7f057927f72ecade1bc6bef37ea8028aa90", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622156140, "uuid": "da16ccdb-3a3d-422f-81ee-a55cdb470fca", "value": "C51633559AA05906CBD0CFB47888DB230F9698F51570AF25EBF0CA8FB69FC51234B907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622156140, "uuid": "b412722e-0864-43eb-ab22-9ba5f7064394", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622156140, "uuid": "f422313c-05b0-4185-9cc3-674044ed190d", "value": "98304:J85Mi396HjeeAD/fg6KpHi8JxYQvToZB3bzuEn/j+R0lqzyq:J8559GqeSwLNxYSoZB35/60lOyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622156140, "uuid": "6fdc83af-24fd-4230-885e-8150591845fd", "value": 4024316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622156140, "uuid": "45062b01-91a9-423c-a111-005fcefff24c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622156140, "uuid": "c3c2092f-a2f5-433b-bcad-b7066327d1eb", "value": "4AB92989A8709A31EDB4ECBFFD8E0AD5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b41b4832-bf1f-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622142845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142845, "uuid": "35c0e1b2-e63f-4c0c-80c3-fa1c02bc5a9e", "comment": "Malware payload (RaccoonStealer)", "value": "151d97356158259495ff324c7b9f2689", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142845, "uuid": "bed41c12-6d8e-49ee-8e52-eb2c2c5b026c", "comment": "Malware payload (RaccoonStealer)", "value": "e809c0bff233e36703cedc4d53af9d5ffbaf94b21d7af62f147765ffdafa6d18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142845, "uuid": "5e76fcc3-5b43-4a5d-aa3d-910de7f426f4", "comment": "Malware payload (RaccoonStealer)", "value": "60af5a2c3a63f6134dc0c4127c6f9f90cf860244", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142845, "uuid": "95006e37-db88-4160-a3bc-526f7cc9965f", "comment": "Malware payload (RaccoonStealer)", "value": "01c698e142e5c35e72c3c1931023733b50aedc138ce6ba39ae8c0ff43a662c179fec05417010460882e9787187bbb7b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142845, "uuid": "296f844d-3412-4180-b077-4b2d1ab80652", "value": "10C4D031A691C035E8F305F449B592B8AD397DB2A76440CF22DC3BE996756E4BC30B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142845, "uuid": "5bfd92af-3cce-4b6c-9b69-683641a046e2", "value": "a31151b8599e7385dee2461451ee66a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142845, "uuid": "f36b69b4-c1e5-4282-bc87-467dda1f3f5d", "value": "12288:V38J3lFLiEV4C62RA3Fd61C46IeM3prDa+pRaKFiM64/3:K3lMTFdIC0drDNraQipM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622142845, "uuid": "bf5ad045-fb8e-42fd-a84f-da30419f415a", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622142845, "uuid": "05933a0d-48ca-4b0c-ad63-8fca2f02fa9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142845, "uuid": "dc15fa80-6acf-481d-ba8e-faa236d482f2", "value": "151d97356158259495ff324c7b9f2689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928508a3-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141500, "uuid": "5a0a289c-d74c-4fe7-b653-e181ba53b70a", "comment": "Malware payload (Stop)", "value": "3724e17ed961da4c456a71d0317bf941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141500, "uuid": "904a75f6-248d-4df5-9645-b03b49bd52f6", "comment": "Malware payload (Stop)", "value": "e93dc790451209861b688ac1646fa0c297124eb4935bd427ee9a27ba35728f12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141500, "uuid": "69319bbf-42e0-48ab-95cf-c88499db0265", "comment": "Malware payload (Stop)", "value": "baf6f7a7c668560b48c24d5bc2d0de6f7264654b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141500, "uuid": "761a3b60-98c3-4921-bc74-a559b07e6e43", "comment": "Malware payload (Stop)", "value": "76aa985320122f33c961eac02341c06fc464644b5ad38516ca2dca0c47968cb03e2fd13b509815186495c14b22da7bc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141500, "uuid": "2dcf73aa-31c6-43d3-9f4a-3dba90f0e061", "value": "3505F13076A1C034F1BF56B448B55279B62ABEB1673081FB52D13BEA5634AE49C3039F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141500, "uuid": "6bc45a55-40c6-41c8-9a67-db8b22a56a31", "value": "bca4c139115857ba195befba3c3bfd5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141500, "uuid": "f7772def-d163-4d53-ae2e-9cc461f54247", "value": "12288:3Q4/XzEFuHp3Yenl4QKYVaP+jeRlEVkILgtIp2XXhbc6jlJUVnKwoOY9n4ipVddA:T/PHpl2YVaG4l+vLgupIYujROYuik5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141500, "uuid": "dfde3c73-48a0-412b-a729-0cbd6884e9a1", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141500, "uuid": "801c8301-a22c-4b4f-890c-f5ad698dd2fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141500, "uuid": "24c31b2e-aa43-4267-87af-23a0e8e0aab5", "value": "3724e17ed961da4c456a71d0317bf941.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358e978b-bead-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622093670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093670, "uuid": "6c20c354-9178-4758-8be4-9c45562c4f46", "comment": "Malware payload (AgentTesla)", "value": "82e40f002db1c0cf865fec8093da41ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093670, "uuid": "c2dba7e6-7f22-4b57-944a-8f1dbae66ae8", "comment": "Malware payload (AgentTesla)", "value": "e99f125d74a933c143c44cd0af298bf2e88502dec6cc0cedde0abc17644c4f5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093670, "uuid": "44455593-2657-4f08-b4b5-cf2d444b4cdd", "comment": "Malware payload (AgentTesla)", "value": "b4ed2ccc7f0a902194797a4977b93e88f7ddeaf7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093670, "uuid": "b2a40cef-206a-4321-92aa-a45b98228d59", "comment": "Malware payload (AgentTesla)", "value": "e956277741b3d375b8b561e64d99b974fe423fa71da554d14a3f284519423d0c3443c391efc730591c3fa4f4c645c758", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093670, "uuid": "f6375fd9-a4e7-47fc-beb3-47e02a028175", "value": "FCB55A3043A99B9E75F323D08085B59E1EA6EFF083BB5586A6121777CE312194FE4336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093670, "uuid": "e5102ce1-b78b-4758-a364-26edcde42bc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093670, "uuid": "95d1972b-eda0-465b-956b-0da1f02760bd", "value": "192:C3w1sN7LfzuyAu/DWP8n1kLhCdjNiYOvzgR6SQznmeoARk0Mu0MHNhZz2VXdKOTk:YwCNPfztAugMIpHhp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093670, "uuid": "7b5381ab-a00b-4bc5-8ba8-35defc649b11", "value": 2280096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093670, "uuid": "f68452a2-7fbc-4079-8590-a53223e38e85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093670, "uuid": "613047a7-4626-4841-acc1-2e06dad68d74", "value": "210525_332641-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa50f3a6-beeb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622120494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120494, "uuid": "8de9d5d5-1bd2-4eb0-a18b-dfedd1134871", "comment": "Malware payload", "value": "9fa5b4c08b30abc82aefd8c2059a6896", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120494, "uuid": "375baf9a-c46c-4919-abe4-93d9e381439e", "comment": "Malware payload", "value": "e9c01e8a6a9d4be329058260bc857d0642124bdccd46d5c3a9e98f32d501ae82", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120494, "uuid": "a90c0691-3337-481f-a63e-5c77e23f8567", "comment": "Malware payload", "value": "e34277888c6431fa19a4715a28215b4f88b51bee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622120494, "uuid": "727d2e0e-656f-48d2-8d9e-e5489de09742", "comment": "Malware payload", "value": "bbac30c80ebd0a70a0d0c36bc8582abbaaa15a5eec626589c06c097ddca43d9e6b23af40d0a5a2b8b61f249304b77893", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120494, "uuid": "456c1d21-be0d-4312-8802-088ca7d1b86d", "value": "E96412ABC8FB89CEFE6E4FB5265B1D0E0EF6E1D4E5C53D94452A00802BF83566514F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120494, "uuid": "1919c195-b972-462a-a0d1-cedbe8b989be", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co:7O/QJHZweEL/NOjCHm7FZZnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622120494, "uuid": "21bf9815-b1dd-4db8-84a5-9706cbac1681", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622120494, "uuid": "9fd31216-a759-47b7-b673-3e1991ca4355", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622120494, "uuid": "f08678cd-7340-4f45-ae17-1b0143c3d2e3", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c842b9-bf1f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622142571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142571, "uuid": "65efe074-f23c-40bc-888e-4cc3e7523b8e", "comment": "Malware payload", "value": "ba7efacd3d25de1177d1d769ab1c6b25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142571, "uuid": "f14d1212-da19-4c6a-a6b3-da53f7606cd7", "comment": "Malware payload", "value": "e9e5ea15e87532d4a481ce2b493ebf914e67e25d2ee9ca8c9ae8e0df7a8eac45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142571, "uuid": "4afe1fb1-49df-4642-a359-f3176b97607f", "comment": "Malware payload", "value": "3318d9d0b93ad9678e8fd9d41609ca119e41cafd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142571, "uuid": "a1cf1933-0667-465b-a2ed-5096a3075aee", "comment": "Malware payload", "value": "eda30ac746607be7c34f9683f35e10edac8564e1f05e6f8e361ee5dc4e46d97a77ef4880295c0585a491a35c812759b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142571, "uuid": "a19792b5-3c09-4795-b7ca-c432de52f072", "value": "59F49D32A3D111B2C15A1E389C17A2699D64FE703D345DA937F52D48AEBE3803D2E5E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142571, "uuid": "32dd9ccb-06e9-44f1-8f94-98b92c781394", "value": "3e7272567bf6719a2a90dbca5f3a4b3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142571, "uuid": "049f448a-9af4-459e-a804-0d1b36d150eb", "value": "12288:huxGeRhWzrlZe7q6OWA50P3TaD8vVKlWFn+yGMRNy:hyHWzrsOWxjQfELy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622142571, "uuid": "4c5b6d9a-b166-402d-bcf1-de483daf71be", "value": 738928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622142571, "uuid": "b17f3bc2-fd06-4a6b-ba30-dfb7ceed394e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142571, "uuid": "2d9db767-3032-45ea-bb5f-c39f8658b495", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926694a4-befb-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1622127326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127326, "uuid": "8f58654a-0395-4a19-a573-68f4cc0c0537", "comment": "Malware payload (RedLineStealer)", "value": "2aa169b757a9cd15aca4fbb57baf6424", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127326, "uuid": "a8a4859c-acda-4809-9fdb-09334bfd01cd", "comment": "Malware payload (RedLineStealer)", "value": "ea385b24cb4c641a72a5a15655843942cbd95999c3a5899166b10ebddb6af281", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127326, "uuid": "b05a47cc-b868-4541-8118-46afa6304d36", "comment": "Malware payload (RedLineStealer)", "value": "13cafebd10fd85a04fdeedb9eae8b1511ddb99d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622127326, "uuid": "8c1e068e-6b37-42b0-b929-941beecc81d8", "comment": "Malware payload (RedLineStealer)", "value": "4c7e98446f5e19854bed7a26beb94cb056adeb406d3d1baf237936b1e94f838ce69099e665f119a950e76e57f774bb01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127326, "uuid": "2fc9ca1b-21e9-4228-9e19-0471cb15bd8f", "value": "C755AF909A84E611C9E877F3A32B965013F51CE58767920DBEFE76B56832017FE0360E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127326, "uuid": "377396f8-3d10-4022-9af6-c2e11a640349", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127326, "uuid": "7d42ddc6-63bb-4614-83ee-401448f7de31", "value": "12288:GhzRr/PFQo1wW8cX0OjdPgplyOiTSwzWtVKCH1DdjSx4qRQPAeb2JEHQ4/1Q95f:Glxf8ckOpPIyYmEMCHHjPvWcQL5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622127326, "uuid": "fe2fc943-ea08-4bcb-a414-431c202f1dc4", "value": 1285024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622127326, "uuid": "4de8fd35-30ea-4898-bb82-8fd2b6677059", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622127326, "uuid": "a3401d02-c074-4b3c-8fcd-167e97a02eb4", "value": "ea385b24cb4c641a72a5a15655843942cbd95999c3a58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7036af36-bead-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622093768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093768, "uuid": "97025c9f-67e2-44f6-b8be-e57761610646", "comment": "Malware payload (Formbook)", "value": "b8b88912a93b01d685edfdfd95bbe3bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093768, "uuid": "09a21db8-aaeb-424d-bec7-20baa31fb4a7", "comment": "Malware payload (Formbook)", "value": "eb2f60b27fe8568bceadd7535f5f7c88de028cf454185a54a4b0b2aa0be63a17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093768, "uuid": "e2f7597b-1e44-4f95-969a-8af06aa95f1b", "comment": "Malware payload (Formbook)", "value": "3e8269a4d94626a38cb3d8dd580786795da577b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093768, "uuid": "ccfda766-d63b-4e7d-a1c0-6e5a8ffc8ee5", "comment": "Malware payload (Formbook)", "value": "95c479962548ef9122c75d05a36436427852f5dc4756ebb1275432c6eee3b8d5a2f49fba4b87866ff767efbb40bd8311", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093768, "uuid": "6c503570-0cb2-416f-9663-285c1ef00c15", "value": "C684013175804BEAF0151A31A423E439E7F23D36EB608A4BF7D23F1BAA71192555F60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093768, "uuid": "34fb8b08-bf6c-4145-aee7-ef10bee3dbd4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093768, "uuid": "38445656-0b95-4274-a464-efdf50fc468d", "value": "6144:BQqztglB/TJ72rQnDe1DgIfmHppk5FxozV:GBrJKrGDe12CxozV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093768, "uuid": "5eb757dc-5a79-4d85-9c61-8da3139642d5", "value": 380407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093768, "uuid": "0d4dd099-2a07-46c2-9503-5cbdf5f79a83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093768, "uuid": "01a51727-0f69-47b4-878a-5909ccd2e3f0", "value": "PO_no52071.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ddde53-bead-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1622093809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093809, "uuid": "707d3dd9-dc43-4d9f-896c-88b6e2ee2492", "comment": "Malware payload (SnakeKeylogger)", "value": "6c2a1178a96b9859f2b2cb539b43920a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093809, "uuid": "30d9cacc-3742-41cd-85bc-edc651f2ed35", "comment": "Malware payload (SnakeKeylogger)", "value": "eb4435e90357e458b14e53e00945a5c5718db7190640cc09591f72d9ce0d77de", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093809, "uuid": "c2faf971-1d26-45ff-99b4-f12808ab27db", "comment": "Malware payload (SnakeKeylogger)", "value": "7b4eadaec42e879174fb35a61e5466225b64b9de", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093809, "uuid": "88fc1fcc-2070-4fd3-a5bd-509fbbb10fcb", "comment": "Malware payload (SnakeKeylogger)", "value": "7191ce0deda99068c27c77869fd17d22f07ea9f48e7e3e4c64ff21cc9e034a4a72432906ee83cf6f4a3b4bcb1b530c84", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093809, "uuid": "99b20165-e144-4592-9799-d0e9046dd7cc", "value": "F8A42343516E52C0C92BB7E4C50168A96B14EF2ED036EAF92BE60067DBB7800DDB19F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093809, "uuid": "68cc6f33-d344-459d-83dc-6172ba6e6cba", "value": "12288:2oc9NJHl6ByYPKIUbRXzhFzq5PHiIhVocoBsZ28Y9:7c9NJHBaKztF04B8Y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093809, "uuid": "9bba2ba8-1edf-48fb-94e4-d514ae904832", "value": 467894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093809, "uuid": "bc4d045c-a0e2-4674-bc36-350d2d392216", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093809, "uuid": "28c976e0-14d6-4188-be88-bb700c1daeb6", "value": "Consignment Details_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0775c3ee-beea-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1622119792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119792, "uuid": "32395c4d-95ce-4e25-8ffa-8a0534655828", "comment": "Malware payload (Dridex)", "value": "a7b63000938bbeb31722acac4a96b004", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119792, "uuid": "3ec2cec0-cc78-4929-9848-1988fa28b672", "comment": "Malware payload (Dridex)", "value": "eb9509c453a808694eb50c18101558f492f16e6fdb3f349686da3d7c627311c9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119792, "uuid": "8d1d09fc-d67f-4351-a10c-6edb916946ab", "comment": "Malware payload (Dridex)", "value": "89f78b3028d7028a5b3f23f4eb78764abc205ab0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119792, "uuid": "c4f5d7b2-ca36-4006-91af-50dafa816241", "comment": "Malware payload (Dridex)", "value": "687125f08c5346c39b83863c56451656a77db85a03df0bc67a2c065523b373d8f87e988a657cca8149ea15c84933d981", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119792, "uuid": "602f3b2c-09c5-4a3b-a8b2-72073e749ae3", "value": "B615F515B695CB16D6660E310CAF8ADF6339AD40CE35830B7E9F731E2E3275C9852721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119792, "uuid": "55570cac-eb62-4ba0-89bf-66191018f787", "value": "6144:Ik3hOdsylKlgryzc4bNhZF+E+W2knAh4s3eZCoebhQ:qelii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119792, "uuid": "785a6cd0-926a-4778-836b-c67098947d51", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119792, "uuid": "87ef3406-3e28-40f0-9a42-722ea0d5b526", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119792, "uuid": "88b42f3c-8d6b-424c-9368-82b8a793f140", "value": "a7b63000938bbeb31722acac4a96b004.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8060179-bef5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1622124839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622124839, "uuid": "1c288c85-f710-46e9-b124-096faa0123b1", "comment": "Malware payload (Formbook)", "value": "4ce7d1db443a1c5a2fafa23ef8b32ddf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622124839, "uuid": "5d61c6f2-358b-4b2d-b702-69c8a93b7582", "comment": "Malware payload (Formbook)", "value": "ebe1f420ea3fcef5b426cf6458d23984e12c4ceb5983571699f60aaa963b159a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622124839, "uuid": "a026769f-ce16-41d7-b8a6-90cb5bd0b729", "comment": "Malware payload (Formbook)", "value": "fbf663948ea7e4a1fcfc2d37274d61daf769252c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622124839, "uuid": "9bdcfcca-2709-403a-92a5-e95a76500d54", "comment": "Malware payload (Formbook)", "value": "d80730be2807cd22d98ddaa9a0a926f0d6dde0d38e10bb9cb159e01ee39bb446a965a58a7a930e0051bdd428380a503b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622124839, "uuid": "f361fd3b-5dd6-40e0-bebc-660b9cb8b72f", "value": "6024121AB1CCACFBD9CB4E3142BBE67BDBB587510270150BA7112F6B6C31A32671125B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622124839, "uuid": "52f85d1d-878d-4b76-92be-4006c7d02e9d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622124839, "uuid": "baec42a2-1d82-4728-ae32-1f26b91ce3d3", "value": "3072:cLk395hYXJTMunA4Eea5+dodvX8ma+ooQAw+0ntaKbvuWGPcY3YQnuB4kkTyRSVv:cQq24A4zE+dolXn1oh+6YKWkhQuHCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622124839, "uuid": "65c72573-e23d-490f-ace2-ad68ef924e16", "value": 218201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622124839, "uuid": "15dca7b9-7ef4-4309-8a24-9d3c76c1ecf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622124839, "uuid": "4dcc2eb6-dcad-4e8f-b89c-3ce4993e9a60", "value": "USU(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f1b457-bf1f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622142549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142549, "uuid": "ed6eeb1e-bba5-4152-b09f-82fe315366c4", "comment": "Malware payload (AgentTesla)", "value": "db4f6dd6bf62f57b3bb8e9725cd294a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142549, "uuid": "2cd79b53-e170-4221-895b-cad3217a72c5", "comment": "Malware payload (AgentTesla)", "value": "ec11b9a6145dafb16d9f1d1355b00e15171136749f5e2b59c2c8266da65be397", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142549, "uuid": "28d1b23f-4524-40c9-81c1-4351112ef1f5", "comment": "Malware payload (AgentTesla)", "value": "98932cd8f4d887fdc8279c28b23d95b965aae119", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622142549, "uuid": "f6e6d98a-6bba-4428-b336-eb5eac8d7762", "comment": "Malware payload (AgentTesla)", "value": "423ced7236c44f11214ad5ed9164a32a94d10e401a0520f11baa2e2a4fea98e3605d34b8546abb90a6fe6bd105485cd1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142549, "uuid": "e361fced-ad67-4297-8981-e7a3bc26c44d", "value": "0E253A8D2604DB12D229D774CAEA54B343E0EC23D301EB8A9DC63BD536727C7268656F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142549, "uuid": "f3605990-f402-4403-949e-de2e63dbd8c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142549, "uuid": "00909cbe-7e88-472b-87dd-4406fdcb8167", "value": "24576:RD8o0N6dXLEul3gm2zAoS/xkCE7mL4glrbS:Rg0FlmzAoMsiL1ln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622142549, "uuid": "0291c0f9-25e2-414c-89a8-5833ce8d78ce", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622142549, "uuid": "ab88a660-d458-412e-8569-f5afa282554a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622142549, "uuid": "6caa631c-dbfa-48b3-99e6-465ffd1234cc", "value": "Nuevo Pedido.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ae8609-bf12-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622137163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622137163, "uuid": "160d8e43-b2f5-4c74-9313-e77f9675392f", "comment": "Malware payload (Quakbot)", "value": "b93a8d98e7383546e5031cc9ca220d50", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622137163, "uuid": "519511d9-6198-4480-ad65-a68f90818fc7", "comment": "Malware payload (Quakbot)", "value": "ec2b4aacfa59f8128f1941ea9df9ac519e483e8048089ec84ec7435363f47fba", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622137163, "uuid": "c108de9f-a0b8-4d95-8b62-a722b5b6a6f8", "comment": "Malware payload (Quakbot)", "value": "cc740774863941c4313d769baa08d116c859fa3c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622137163, "uuid": "9bc0a05b-e1ce-4a80-9bdb-fd1dc1b7943a", "comment": "Malware payload (Quakbot)", "value": "7588c948011c1a38c0d786d9cb0ce772090b3dc07b50c94af7844ec882b5561efd8872681554d9376b55825d6dcfdafc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622137163, "uuid": "a9b5f5ce-1e06-4c24-948c-a30bbca6e3a4", "value": "F1354967A7DEC412FB231FBEB1839A4404F2ECA32132553E45E03619FD76AB02896774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622137163, "uuid": "d837e58b-04d4-4acb-b88c-8e47fd590da8", "value": "0ccb108307084b188971b94863fe8bca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622137163, "uuid": "1965d99d-c187-4a38-92e6-0b828a5da88e", "value": "6144:eu50+NCirQ6TBByIeJzt93S0EE8cuFA6Epnznitg8055EX+dridQs5SDoCtq:eSVONPfzit1055EX+dWn8DoEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622137163, "uuid": "86a415a0-41b1-40e6-8e5d-dd52e22ceacf", "value": 1089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622137163, "uuid": "4b5ca157-0e91-4946-81b5-1c91b37a6b70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622137163, "uuid": "3b2aac16-04a5-4f23-b27c-84a97153fee9", "value": "3107790.dat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b46c80f-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141515, "uuid": "1c41f7a8-7d71-4466-9869-b4aceccc7c98", "comment": "Malware payload (Stop)", "value": "5dd179efc860ef9fd31fc64f0ac40762", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141515, "uuid": "fff1110f-9837-4033-b100-9b2328a0d699", "comment": "Malware payload (Stop)", "value": "ed4fb9c1f2b01cc88e1e558185d5a94c4a2a33aa97093c4255c4e7fc76991975", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141515, "uuid": "9c502794-67f8-4592-a531-b18d5620d3cd", "comment": "Malware payload (Stop)", "value": "4c96001b361a8c73c8b6cd47bc23057c7b0b9859", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141515, "uuid": "a7568d87-cf63-4ddd-ae15-35a72a2c6786", "comment": "Malware payload (Stop)", "value": "911338bed36ac983ac74338889af339c1394f178c9a46dfa0ebe87b6fd83e0d5851ef7bf6dc63828e4d3e1ec064356a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141515, "uuid": "d2ec6a5f-e36b-4bc5-a7b2-10cee49adb93", "value": "D805F12066E0C038F1F31EB494B59278793A7DA26B2491CF11F5E7EE4675AE49C30B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141515, "uuid": "0264f473-856c-49a2-97b1-f39f78def53e", "value": "556bc424bd608c9e064a122699e67eca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141515, "uuid": "e2dcbfa4-8c02-454a-b512-45b54835b45c", "value": "12288:X6GTMlEETJTMzB26zJ3+hI1mOlF88wkzHzu6/J8xPA6v7EgWYT4ho8RpNnXZDlhk:DT6J22KPmOlXwuuYJ8FA6vogWDTv5N0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141515, "uuid": "949f6767-cf6b-4455-b621-c56316f48a82", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141515, "uuid": "08a0abce-5f90-4ee7-878f-9e9c324441bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141515, "uuid": "573b9465-2bfc-4e13-a86a-888b217aad46", "value": "5dd179efc860ef9fd31fc64f0ac40762.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8d2e54-bece-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622108123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108123, "uuid": "659bb30c-3c9d-42b7-8d3e-e6ae05aae496", "comment": "Malware payload (Loki)", "value": "cdfc0ec3ac0a56dbecf5a7765abd96e5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108123, "uuid": "7dd05042-8deb-4e61-98bf-65258bd97c14", "comment": "Malware payload (Loki)", "value": "ee4d08cbe3a26c2e8999545350038b61a9eb5f00da7696da7c4a049a650b6bf9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108123, "uuid": "5c0f49b6-df6c-4089-8be1-024a66c2b039", "comment": "Malware payload (Loki)", "value": "1e79d5897fc8665622bb51efdc1d26f8dfd63951", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108123, "uuid": "7e3d99da-2f46-4b2f-a373-9e596aca79b5", "comment": "Malware payload (Loki)", "value": "29f5029a3d8d006f0db972178a7c88fcf45f54c344d30d674d47d8379d67441da5eadc98d7fdd14854c9c39770dac6c9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108123, "uuid": "be821413-e61f-464f-92b3-e89bbf60eee3", "value": "625423F7B5212070FB1E967A72E721859F91B1A58E79983FA29309A2C39F05F47F11C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108123, "uuid": "fce93f23-f9e9-4892-ab3f-ba36fa179f68", "value": "6144:BInSriX4z4nph3zqmwecqlRQJZI+2fWYVsvgMWSwUjAyt+n8:BInt4zGpdzqOVoQWqMWSwUjA58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622108123, "uuid": "7c4a051a-0952-4765-9272-097ce7ccbbe4", "value": 302669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622108123, "uuid": "5e3194bc-36ec-4e1a-bd2d-9da20cd13d88", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108123, "uuid": "2046f99e-4291-4cbd-bdb6-ba047815df35", "value": "Quote JQ102474.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42f564c-bece-11eb-875b-42010a9c0053", "comment": "Malware payload (SystemBC)", "timestamp": 1622108163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108163, "uuid": "86d76515-8d2f-4194-ab95-142a8bf22ae8", "comment": "Malware payload (SystemBC)", "value": "12ffd8852c3713d37faeb6af83ca14bf", "object_relation": "md5", "Tag": [ { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108163, "uuid": "309ac0d6-5689-4f2e-882e-3db625c31f2c", "comment": "Malware payload (SystemBC)", "value": "eec36810573040757eea624543f2bd7c24db70a4b9cc4acba85acd0a24ad9874", "object_relation": "sha256", "Tag": [ { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108163, "uuid": "d1ba3454-9bb3-48c6-b649-0fac0f33af53", "comment": "Malware payload (SystemBC)", "value": "1a4fa395329fda8380fdb0fe64f6f4d874252391", "object_relation": "sha1", "Tag": [ { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108163, "uuid": "a20e00d0-6e17-42ac-8991-75504ef7c2b0", "comment": "Malware payload (SystemBC)", "value": "4ed6bdcaeec6e157151ea12d277eedec73368895b57c7684b653507d2f7c27aa36c049cf997e03508946ce63f967da77", "object_relation": "sha3-384", "Tag": [ { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108163, "uuid": "0e1e7a12-c54e-4d00-9007-a0bd1568d7c0", "value": "15E48E26F2D04837C1732A3D9D5B93A49C3ABE913E2859476FF41D4C9F382913A39297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108163, "uuid": "25f7d22e-a5a6-404b-a2df-8f048561de2d", "value": "c5d90eac7529625ec4fea5a92436d0b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108163, "uuid": "2fa86da7-c0e5-41df-bcbf-fa987b3e6cbc", "value": "12288:QTickpaCamj4+qeSDYPQ1X1FN8hoFw0VIfh+zKsHpPV:QGXGmTDShJJ8hQAwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622108163, "uuid": "fc985951-7a17-4fdd-973a-38c5214971c4", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622108163, "uuid": "b461cfea-cfc4-4704-9ff1-e9b265a96c29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108163, "uuid": "3aebef10-4389-4961-a7ce-c25c9bf5c9a9", "value": "SecuriteInfo.com.Trojan.Siggen13.37560.31798.27931", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b99034a-bec9-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1622105706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622105706, "uuid": "863f804b-8871-47e0-8f51-75f385e269a2", "comment": "Malware payload (AZORult)", "value": "e079b71f8be07412eb350bb5e3e61478", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622105706, "uuid": "13959e50-632d-4507-aeee-10bf60d07fed", "comment": "Malware payload (AZORult)", "value": "f1ab8e352e53ee2d4aa8625e789682ca1a5ef4adaba22b1ba7ce3d68664bcb2e", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622105706, "uuid": "819d3a36-3a0a-41e4-8986-720655ed3d9c", "comment": "Malware payload (AZORult)", "value": "035f8a3b30e404f474f533ed283cd89cbb3c9ea2", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622105706, "uuid": "ba80fc4a-8ee3-446f-b63e-334fadd3487b", "comment": "Malware payload (AZORult)", "value": "86a077dd51aa4b8a55c43b733b6a264dbb09fac9a52fe41ccc114102aa92a69031a6be26615e11fe9d7b05c3250a9f24", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622105706, "uuid": "c2861bcd-f68d-4671-9cb6-54e74db56971", "value": "0F64E106B64C816BC8364D31887B9236C7FD4E11A7A9C5533BE0BB0E15F75E39B1E18A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622105706, "uuid": "672ddd9d-14b7-45ed-b82a-684188a8e6bf", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622105706, "uuid": "3dd35efb-6009-4748-a400-6375251f8974", "value": "3072:FLk395hYXJENgL0UxTmM1RWnAffmUarxAyaVaihjTbfr6FjJGXFR:FQq+NgL0STb1RgMuFrxA/VXpT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622105706, "uuid": "7d31f44f-6660-4e25-aeeb-0d9d23230511", "value": 329749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622105706, "uuid": "a137f86b-b355-4d73-af60-eaba418589d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622105706, "uuid": "e34635f5-0256-4853-ab00-b58ce8b608ea", "value": "Ziraat Bankasi Swift Mesaji 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440ebae2-bf29-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1622146952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622146952, "uuid": "69c3ea2c-4f1d-417a-bc4f-ae86c05a992e", "comment": "Malware payload (Quakbot)", "value": "a04561fc9404fa69d74ff6926808a75e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622146952, "uuid": "61016017-22e5-461b-a4be-64a0062aedb5", "comment": "Malware payload (Quakbot)", "value": "f23ac5511891744fa148c099f8f7e175c806a4ca6f0451622863ca33cb9ad41f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622146952, "uuid": "1ad0c985-30aa-4ac8-ab19-465863308e53", "comment": "Malware payload (Quakbot)", "value": "c1fafdd9a29ce6726386e3445cae2a55f21f0c8e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622146952, "uuid": "fa24f341-f541-4c3d-888d-b1cd8ed10e4c", "comment": "Malware payload (Quakbot)", "value": "ac8f91a9bf4532d7dbc3fc5a02e63bc0e841b7252a0414db57806e34427de4ecc0bebca3b7a5491f72f2fc29af3215c7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622146952, "uuid": "11a3490f-dc74-41f0-a1ec-049158522268", "value": "44354967A7DEC412FB231FBEB1839A4404F2ECA32132553E55E03619FD76AB02896774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622146952, "uuid": "0470f3db-8f33-4c0b-9062-9fe700b5b9bf", "value": "0ccb108307084b188971b94863fe8bca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622146952, "uuid": "de1cd845-9dad-4e08-8347-3190469c9cf1", "value": "6144:eu50+NCirQ6TBByIeJzt93S0EE8cuFA6Epnznitg8055EX+dridQs5SDoBtq:eSVONPfzit1055EX+dWn8DoLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622146952, "uuid": "cccbf868-c9d3-43f8-9462-17de24da0ac8", "value": 1089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622146952, "uuid": "4192ca2b-e65d-456d-a3b7-9240585b569e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622146952, "uuid": "96d93bd4-23ff-472e-be58-91df59a5e983", "value": "a04561fc9404fa69d74ff6926808a75e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2fe21d-bee9-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1622119664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119664, "uuid": "deb33a13-52cf-4216-a2e9-62413632c363", "comment": "Malware payload (CryptBot)", "value": "1a4c96515b10859b7053a4f717b61608", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119664, "uuid": "09519821-ebcf-4e69-81b1-73540989285e", "comment": "Malware payload (CryptBot)", "value": "f2a7cc00ce9933490e51df2d5df9e7b0b2165c73297a9fa8a99fbf51b85926b8", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119664, "uuid": "4e008a6e-c808-4488-817f-118c07b69260", "comment": "Malware payload (CryptBot)", "value": "ba141d261cf8ee1f33cfb0c4c820d840850e781b", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119664, "uuid": "53613875-1ece-44fb-9749-311ab87b3063", "comment": "Malware payload (CryptBot)", "value": "a45834c4ea69b18d30e15ff555aadec501f9b0ef1348ba22b85a8fff008dd7fbdc9e5098f2d46e0f1b991f916bc3c675", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119664, "uuid": "7ef5562e-c401-4643-aaa9-ec37309cb8fb", "value": "EBF4F130A6B1C031F0B712B419B6D2B9A53A7EB1773490CF62C72BDA56346E4AC31B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119664, "uuid": "29aed846-5134-476b-b987-211611965b97", "value": "a26f0e6bd2952037425bd22d2a7efb64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119664, "uuid": "8382651e-2e31-4578-97b7-56fc65d0e86f", "value": "12288:cp7+nEFn89BZUuMt9Jn9NzOUbrVEAe8zdk16al6eseqGEYWbChoUpi5TO:cpQEFvDJ9NiU/Te8zdO6m6JeYCho+i5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119664, "uuid": "bb85c479-cdf4-4920-9efe-6b26271a5c55", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119664, "uuid": "29bcb5cf-f115-4fcb-93c4-936469e32aac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119664, "uuid": "d411d06b-4ce5-45d1-9dc9-53b6a919b52b", "value": "1a4c96515b10859b7053a4f717b61608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c909d7b1-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1622141591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141591, "uuid": "97723262-daa1-4fb6-949e-32442a486503", "comment": "Malware payload (njrat)", "value": "ca4e7eb683d1eb735c6cd0b4f3e54ca7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141591, "uuid": "38473f89-e09e-43f8-b4f4-4b167f77fce4", "comment": "Malware payload (njrat)", "value": "f31d9aa3e238e16d44636ad8a5093502f51cbcb3cfa3b7ec4a2149a54c748dc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141591, "uuid": "4781e5bd-27dc-4f6f-b70f-4ad31cbcfc12", "comment": "Malware payload (njrat)", "value": "3b4363c2d7da24e669ffd6edaaa3a63d4837c7cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141591, "uuid": "3123a301-aa15-4932-9cfc-971d372c7f83", "comment": "Malware payload (njrat)", "value": "bb6b5707574cd83232c59cd651a99a31e55be07b3aca34cbf762a01ed7b5255d82d1c044e1a730e96defb2423b309979", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141591, "uuid": "53cebbbe-3fa6-4824-9a76-34c5b319ddbe", "value": "C3A3633C77B647F8C5FE32B64195B2330A2CB04B6871B67A59AABED93F123405E805D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141591, "uuid": "d364c5b2-f027-46e7-bc0c-dc05330447fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141591, "uuid": "c5a3649d-4e23-4d37-aec1-c7f42432886a", "value": "1536:FSjjTYLpAcyP+gRJNRBErX8emsbiuCXdlOJ:FSj3YL2J+yJfyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141591, "uuid": "13ac75cd-cf6a-4489-9657-733c916f98f9", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141591, "uuid": "c41a0144-7e96-413e-a1d1-3f20295b7e24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141591, "uuid": "5438e4f7-345b-4649-a807-326b32d0701a", "value": "F31D9AA3E238E16D44636AD8A5093502F51CBCB3CFA3B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17b0aa9-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141525, "uuid": "aa7c67a9-cefe-421a-8abb-83fec689b8d9", "comment": "Malware payload (RaccoonStealer)", "value": "d3752c9e4466ffa7dcf4b5a065e9c274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141525, "uuid": "d3213bd9-9d0e-43e0-99ce-5f3fe065c999", "comment": "Malware payload (RaccoonStealer)", "value": "f6598f853f981a4bcb58922d3584833086de09b9a7a6f368ca56cda7677f8126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141525, "uuid": "8ef02490-f1b5-4a37-8984-6d6f01ae7a83", "comment": "Malware payload (RaccoonStealer)", "value": "997d4d61d1691862f8aab10b94c9d654f2a65e3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141525, "uuid": "5545dfd0-c571-4ecb-8d84-859bef5fa3b2", "comment": "Malware payload (RaccoonStealer)", "value": "77f6a75fc913735fd1cb6ef7ce290df492c9fdabd27dd5777bb4f985ee4783e5120216a8f82da30c46545db49920868d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141525, "uuid": "24f79d29-2051-4bb5-824d-e36ec3a5de95", "value": "7385ADE86518E865D10A4BB3C6866CA85338BF22E7D1D31F757C727906F13E2EC051AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141525, "uuid": "5517207c-7997-48c9-bbf0-b537630debb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141525, "uuid": "8c5026bc-cc24-49bc-a0d2-2fc5a30eb199", "value": "49152:syGQZEzmWXxizsmkdZfR4KKZy2vG5+66pi5R/:xfIlIPkdZfRJv6piX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141525, "uuid": "27d18ed0-84d3-48d3-a06d-7535a76d317d", "value": 1816288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141525, "uuid": "d65b573f-1b1e-43d4-8dc2-cdc6b77dd2af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141525, "uuid": "cbd099c8-785b-4711-9cc9-015f36e98f9c", "value": "F6598F853F981A4BCB58922D3584833086DE09B9A7A6F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f1cdf8-bedb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1622113379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622113379, "uuid": "5f43fe15-084e-42ef-ba84-e398bfbd7e11", "comment": "Malware payload (Mirai)", "value": "dd719d849e6fede699e6c1d5e619d10d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622113379, "uuid": "fae20804-d80b-4f59-830f-e717ebfbdd66", "comment": "Malware payload (Mirai)", "value": "f6f40433f8b126c4644953b451f6ac1802d6a2ede53bae062231bc361e732a3a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622113379, "uuid": "6273fec2-a55b-460b-bb5e-dd64f9cbd303", "comment": "Malware payload (Mirai)", "value": "ea82c85bb9ba59256d8ee4bb582d6e4a3e754eff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622113379, "uuid": "a64b774e-9bfd-4643-8f9f-608fe7639de4", "comment": "Malware payload (Mirai)", "value": "8888d056bd5052963e3670398dfc03849be89a747b7c7c29ad78317a473b42b27237e73dd0e21b20da0b8f1c56569697", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622113379, "uuid": "8295cf4a-7605-4e42-b87d-7e76ca843de9", "value": "F464F1CAED01AE75F9C547B9FA1F074973B28BE8D3C77110E624C6143ADE2468B79188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622113379, "uuid": "39f1e156-1965-4f46-a58d-ee5730790ec4", "value": "6144:7O/QJHZweEL/NOjCHm7FZZncaoNsKqqfPqOJ:78QpZsKCaiaHKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622113379, "uuid": "9209919a-7460-4bfc-94ff-a160dd54cea7", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622113379, "uuid": "131fd3c4-0418-45fd-8c8e-1ed96b6214c7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622113379, "uuid": "455aab03-c60a-4d9d-81bb-66f74a907f17", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dbe161c-bf0d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622134835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622134835, "uuid": "bb12d138-0f27-4d01-8dff-9f4e7a9f06ac", "comment": "Malware payload (AgentTesla)", "value": "0f7ba860b2e79770acea97e501bc43f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622134835, "uuid": "129f9d6b-1e1b-4291-9814-cc7385b5484a", "comment": "Malware payload (AgentTesla)", "value": "f7f4178a803b7a7386e9c67ebed6b184f0b10262b225ef6355a22d4879a4db1f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622134835, "uuid": "4e541f46-f55a-4623-a352-a83ceaf704fb", "comment": "Malware payload (AgentTesla)", "value": "a26904bdc86d4fc4e66ab010dc9cd88ca656f1ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622134835, "uuid": "c27dd426-f50c-4371-a049-a5eb1e888996", "comment": "Malware payload (AgentTesla)", "value": "4aef4b343535be9a74b150fe0c9904f0a8947ac75c16190ad4901b8e25ddcda366b63cc3a972c5fc47ea8d453ea5cfc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622134835, "uuid": "d5fbd332-c51a-44d9-9088-ef1726f20c30", "value": "4AF42F9D721072EFC857D462DEA82CA8EA9574BB831F4213902715EDDE4D89BCF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622134835, "uuid": "27088702-73b5-4953-955d-015daf27b26d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622134835, "uuid": "94f1907c-422a-4792-99b0-eee235e5d7e4", "value": "12288:X/qDM74KaybsPzSzcoT9pXJmqlqD9y4O8G7pP0LUuUjov1E/xXRu/Gj4c1dZm7Zg:XCM74KoP2zcoTfX1J4Of7p8Uulmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622134835, "uuid": "ec425137-20fc-4388-8500-6c24c4dd4b9a", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622134835, "uuid": "275e989c-537f-4872-93ea-a8bd9eb85e97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622134835, "uuid": "9b838106-d374-4671-bf86-02e93c1e141a", "value": "nnpAgZACgKWPMNFomehz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2482b848-beea-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622119840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119840, "uuid": "d4f25d68-9e4c-4537-94d2-2d3d427a21e6", "comment": "Malware payload (AgentTesla)", "value": "4abd8a37f96790b0e8ba7ea283c32630", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119840, "uuid": "d61e4a55-bf51-47ad-a088-92a4a088b57f", "comment": "Malware payload (AgentTesla)", "value": "f885a70224456ed92e59c2b7f75177c2094c31f02d8b5ae8063f400c16ebdf03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119840, "uuid": "7f0b8ade-9611-4240-9784-9534017d9583", "comment": "Malware payload (AgentTesla)", "value": "b79a097cd110a3b16b916d48b5e756146de18b9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622119840, "uuid": "6de1fb9e-964c-4147-b8cb-bdeda540dd97", "comment": "Malware payload (AgentTesla)", "value": "0f0abbe84defefc6e3309c6bfab036882549d50d7fdb67429ba06d4c39c8ea83a6ccac6e03ce776accbd6ce50dab4dc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119840, "uuid": "3fb5139d-680d-4074-abdb-f2d37bd6b6af", "value": "8A941208BA29746BCBFD28FDE41061D88674C274EAE2F75B6DD09AFE15127C60201BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119840, "uuid": "9d85b0a7-6baf-4ae0-9b39-dbddb68f0031", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119840, "uuid": "20ca9df6-58ce-4723-9220-32dab6c42c98", "value": "6144:ikLHWGzHyAszwAbyLgcL17Ic2eQVJ9aomWo0loEbMlEV3fFM5mpf4ihR9wF1RI2t:iWWGzS3xWU6984r2bMlo39M6862xl+sj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622119840, "uuid": "fbfa376d-0437-4315-b446-5bf6f58c48f9", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622119840, "uuid": "fb65da56-1f4b-4dbd-ac16-47b539bfaa71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622119840, "uuid": "b930b5df-91f9-4dc2-97b1-68f30ed85bf2", "value": "4abd8a37f96790b0e8ba7ea283c32630.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd2fb63-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1622141517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141517, "uuid": "064006f5-cf28-48c5-95e1-0c8c3dc2fbaf", "comment": "Malware payload (Stop)", "value": "6363b3bab3526372ad619ec540fb8588", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141517, "uuid": "c9741e7a-26fa-4a4c-b5d3-835aeed09197", "comment": "Malware payload (Stop)", "value": "f88fe1b342fccf45f31b05388bbb7398da0f175ba15bf6f1d7ae367ef41aa200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141517, "uuid": "95f63deb-2740-42d7-9b53-dbd4b3cc843c", "comment": "Malware payload (Stop)", "value": "3c11db4e8472b457f5af322ecba242487c016a3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141517, "uuid": "74133fb8-ac97-44e9-9be9-6ded560f1114", "comment": "Malware payload (Stop)", "value": "69b886448f939923e9514cd9a6d3c4ae8b2aa231d755e88d95329c635f2165758a6cf4cfca9ccc98dafaf04692f33e81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141517, "uuid": "1b2c4bdb-2540-45f2-a182-389447349712", "value": "7D05F031A6E0C035F0F716B049BE92B8B52A7DB26B3480CF52D0BBEA5A355E59C70753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141517, "uuid": "9ebf6151-492c-47b2-bb6e-0c0d439473ea", "value": "bca4c139115857ba195befba3c3bfd5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141517, "uuid": "3794f097-e353-4092-91fa-966aea4b6a3f", "value": "12288:cQP/3zXkoXIMLY7y9gH7IKaKTBBF3rKQdfJyvKS7ubzD2AkNb4iDZXvedjvqzGxn:9/PX69H7IHKtrKy7SybzDfcbFt/8Zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141517, "uuid": "3672a4d3-281a-423e-bcf4-aee462945b9c", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141517, "uuid": "d2e230df-f428-4d6b-8692-c824fba43c29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141517, "uuid": "0744f043-24bd-455d-bd5f-52bd83a3e31b", "value": "6363b3bab3526372ad619ec540fb8588.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c5e6c4-bedc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1622113863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622113863, "uuid": "76c876c2-92f0-4f52-8a73-38212e00bfb3", "comment": "Malware payload (AgentTesla)", "value": "273da8ef023d8bd5bffde174a78a6c26", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622113863, "uuid": "54cb8c80-85da-4472-bc72-3c80352d493a", "comment": "Malware payload (AgentTesla)", "value": "f89adb62ec915a1b44b2859fb18e8fb8bca65b04c740a9e7045f0b968fd81e34", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622113863, "uuid": "1d50f542-5414-4e58-9f19-d45ca3595dbf", "comment": "Malware payload (AgentTesla)", "value": "4c432363e0810574a20d17e2ea719dce2a4be27b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622113863, "uuid": "c458a687-cbfa-4a68-8b12-9bb58c1cfa12", "comment": "Malware payload (AgentTesla)", "value": "5610db5990d0b9d0f301707d517e4cb34388be2eabf37e5703cffa4d44467aedb5f8ef7dd7f542616cec7992cc1302b1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622113863, "uuid": "f5424124-846e-49e0-8c67-838caaa53558", "value": "53D423969A51C90E12EC25FA0718D0233ED504C9829C379B9FEE87871DE6E8739CB719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622113863, "uuid": "d1c5818e-1803-44c7-ab3f-fd5bb8e783d9", "value": "12288:+g2wrtg+gB3wiEr/upd+9z8i3yYim/H5kZNX6r+LED1TnS:+g7oAiiOd+9L3FhRqX6r64S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622113863, "uuid": "86b4580b-c56f-4a1e-a655-4aa4faf19fc3", "value": 631016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622113863, "uuid": "6fdfe4c5-f10b-4f88-86b1-b1ea9b301149", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622113863, "uuid": "22e0e085-5167-4ac0-a500-b6077079dbcb", "value": "Purchase order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbe7825-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1622141462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141462, "uuid": "008d0ca7-a176-48f5-9d3a-9703b36d9934", "comment": "Malware payload (Adware.FileTour)", "value": "a68d49ece80078d1c2f742232f165b1d", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141462, "uuid": "f83f6f67-0991-4b88-9e65-6e8bc0152334", "comment": "Malware payload (Adware.FileTour)", "value": "f8b69bd4d7c6a8c131c5f9cd93ca7d0a3645f9cf1f207608bf8d209f3bcaa3b3", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141462, "uuid": "62b35e8b-53ca-47a1-9f0d-d6cb8f91706b", "comment": "Malware payload (Adware.FileTour)", "value": "34bf6fb1716f44c2078c49470ad35a816a11690e", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141462, "uuid": "22bd3009-5218-4196-bbca-4d617856897b", "comment": "Malware payload (Adware.FileTour)", "value": "28e6e373d77bc0cf95978b851056b62fd654ea6bbe20651be7e20e847446769288531926b8ebff3533624eb82c3824d7", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141462, "uuid": "745c425c-ceec-4938-955c-3f0a0f173977", "value": "000633CAF7A21863DFD2C57508A433B7656F53EA08A5D3E7A3E451843A0F634DE0670A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141462, "uuid": "2421f7ec-ec8e-4cfa-87e2-0a778c235d93", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141462, "uuid": "566b02e4-6ed9-47de-9db6-2065800879de", "value": "98304:JD5FGDH+SH8WxrvXY/3Yo9hzjL0MopwuCkkgKAOwd:JD52HTcWVghypzC0Oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141462, "uuid": "d29a21a8-303f-4134-bee5-2b4dd5ba588b", "value": 3886449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141462, "uuid": "f875288b-570b-4493-b67d-a3ad25071411", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141462, "uuid": "b3ac3287-0db1-490f-ae44-3652b3c82429", "value": "a68d49ece80078d1c2f742232f165b1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea25b0fc-bf1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622140788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622140788, "uuid": "2074ef54-c2d0-4e6f-9abf-1948806663ca", "comment": "Malware payload", "value": "ca09b19b6975e090fb4eda6ced1847b1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622140788, "uuid": "e9dcbcb2-c2f9-4be7-848e-7f9797d51f66", "comment": "Malware payload", "value": "f970630a41a2e8fe61fa3f2cf69dff87ac3fb272d006d6af866ca17264b14ff3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622140788, "uuid": "37beefe6-5868-4fb4-9ee5-2be8fd4c82fa", "comment": "Malware payload", "value": "a7a2f5f7a70dab85f6ee173b9cde4507ed723ac5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622140788, "uuid": "900fed09-eaa5-410f-aed2-f5cb2367746f", "comment": "Malware payload", "value": "1feb32d97125d6555595e4c916d44c7794e711141bea63dc498a3678185900a5da437b4e254ef562aee6628401c8599e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622140788, "uuid": "f0937f29-a227-4d19-9736-fbeae423a572", "value": "FA353916B949C72BCA58C5351D4B6FDC73BE2D819C6465ABB19C722E3CFA318DB02B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622140788, "uuid": "2cbbbdde-fe9f-4cb9-8d07-96a4060f9032", "value": "12288:fDmofgI7jf+hXEX62Jp7GqRCXCXCXB3ClforCz2XCKk2XC/kZnR99Wduz:fKCgI72qkZnR99O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622140788, "uuid": "14ff2d82-7509-4297-ae6e-a5a5fa2287af", "value": 1129472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622140788, "uuid": "e2ec27fa-21d4-48be-8ca1-39ce5ebe1fc1", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622140788, "uuid": "aec1157a-a28c-4e84-95c7-9114b880526f", "value": "f970630a41a2e8fe61fa3f2cf69dff87ac3fb272d006d6af866ca17264b14ff3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ce0c05-beac-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1622093454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093454, "uuid": "47be8f4a-7a9e-486c-985d-a8ad206237df", "comment": "Malware payload (CoinMiner)", "value": "ec7ed75fb6a680c4d65398170ba3abf0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093454, "uuid": "8ccce426-c531-49ca-83e7-7531f5b584ab", "comment": "Malware payload (CoinMiner)", "value": "f970fb9186f287b64997d76b1d4ddc5121b42e4bf697734ae1855a641e95b923", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093454, "uuid": "6f343785-fbab-4f5b-b35d-f118b7cace84", "comment": "Malware payload (CoinMiner)", "value": "970f92f3423fc966c190942efb774e57c41ace8b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622093454, "uuid": "9f484b13-ab6c-4531-b87f-8785682d851f", "comment": "Malware payload (CoinMiner)", "value": "6298a83cd40ad7a295e23650062913ede4c3564a0d45a183cc12558dcfd72942ba4c98eb68961a1275fa6faac6d5bce0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093454, "uuid": "dbeb713a-652a-4e5b-8ef6-b49b96a1631b", "value": "6BC533EC736031FFC89BC1F4C6580D68E551A0FB565BA647F86313887FAE8868E509D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093454, "uuid": "7cd700f1-f328-458c-95c9-22850b7778a8", "value": "49152:p35wpN6FjIAU3bLcDLk6/127m3r6m2RFsibWiF0tImLu8:w2pIA4LI/1Mzm2RFBr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622093454, "uuid": "ae425a82-aaaf-4d28-860c-13c4db385edf", "value": 2507776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622093454, "uuid": "747dcdd5-d0af-47c4-969c-02a41fe76fb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622093454, "uuid": "0f697cff-2a3a-40eb-8002-37494b7d63a7", "value": "CSGO hack v2.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00c66a9-bece-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622108129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108129, "uuid": "d0a66cf4-e302-4d71-b56a-43e64b179244", "comment": "Malware payload (Loki)", "value": "2deb0a3ceb4b28c4e1b1232a573b4251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108129, "uuid": "3c176f66-2cfa-4821-9e46-3d7dc4804e3d", "comment": "Malware payload (Loki)", "value": "fa65e886e4df52c1f48b8aca57d2610a8ceb3877c9a9a3bc86a5fa32b7a9040f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108129, "uuid": "4af2dff8-453c-4a1c-a3e0-7d45644d67cb", "comment": "Malware payload (Loki)", "value": "957b6f5c257a5b62652547bfed544d0845567c1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622108129, "uuid": "d581fa10-33ea-4ed9-8aac-de094f312efa", "comment": "Malware payload (Loki)", "value": "dee2bdcd93ff31678bc5f6a930b498736d24f0fb1277055c0e493974cc54a61339cfe1d2ec90062586eb733286e06a37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108129, "uuid": "d7f747fa-18ff-421d-8e86-7e04a91f6409", "value": "C064126E7724746BCBBD15B9A1B2124C87B3C0779A9DFB0F59C187E5A25B3F902420C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108129, "uuid": "e20ef574-4b04-4ad0-b546-9441274fed99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108129, "uuid": "fef1dd70-a9c3-4414-be06-28e5537f554f", "value": "6144:a8grQv4zyLph3zqCwecqlxOJZI+25OYVyvgohVvW7e4gLM3d:zn4zipdzq6VSIOqohVv1tsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622108129, "uuid": "16ae1d06-2103-4024-9bfb-6d236b5e18aa", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622108129, "uuid": "d5a485c8-3d37-4e29-8fbf-830191bd0691", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622108129, "uuid": "70caee80-beb3-4898-8649-f6a5481051e7", "value": "Quote JQ102474.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e36468e-bf1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1622141519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141519, "uuid": "5dea2a0e-1c63-458d-a36d-f2f0c6dd8da5", "comment": "Malware payload (RaccoonStealer)", "value": "58e2e7edce382e5dcf6bf862b5b0c420", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141519, "uuid": "7f2d3ae2-09c4-4445-af4c-eb708d181927", "comment": "Malware payload (RaccoonStealer)", "value": "fe12a8772f3bb4fc8eb97e4a4a5470cbdaf44178281318a73a052eb43078bafb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141519, "uuid": "d2a98ba6-59f2-40da-9485-774eab952f33", "comment": "Malware payload (RaccoonStealer)", "value": "63a1ccbb179eb690d1c126e74886b78f2c09404d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622141519, "uuid": "ccc03d4c-ae7a-472f-8fcf-7892bab5c10c", "comment": "Malware payload (RaccoonStealer)", "value": "5c7b4f69faacefd783111456d73f0c6e1eaf60f7b74ea01bb0283dc2ffec446fcaed042add3dee176bbf2c2266dc6271", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141519, "uuid": "df8d4e63-1832-4d41-b360-8960e38a7749", "value": "74C4D030A6A1C037F4F316B455B582B9A53A7EB16734B0CF62C43AEA52385E5BC31B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141519, "uuid": "fb0441e8-8a0e-40ff-9955-5b1a1ff0f3c7", "value": "a26f0e6bd2952037425bd22d2a7efb64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141519, "uuid": "a326fe47-7244-46a3-a279-8a2c8cba97e0", "value": "12288:Ap7x0EJnmJVtVS0Dc/R4bYjbRm48lb0fLHfVUaHc4:ApeEJmIB/Rm4wbAut4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622141519, "uuid": "fe4dddb1-6a00-40c4-89e2-380f9533e062", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622141519, "uuid": "9b25edd0-9971-46c9-9274-ec9b5e6288b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622141519, "uuid": "7da32db0-139b-44fd-ab3a-5ffb731e7987", "value": "58e2e7edce382e5dcf6bf862b5b0c420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3bf2ba-bef2-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1622123293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123293, "uuid": "3f89ac83-8365-4175-bee0-3a8df71e37ed", "comment": "Malware payload (Loki)", "value": "cb641802bb9a579f6a886f7f23f2c43b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123293, "uuid": "4474f41c-9cca-4044-95c5-2d78191f30c8", "comment": "Malware payload (Loki)", "value": "fe1e3e1a4b6c5da1155225d6804054bb7a95acd757b56aeed0369388ba4fc5f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123293, "uuid": "7f886bba-46b3-4c89-8205-96912243d06f", "comment": "Malware payload (Loki)", "value": "8bb22966eb5e66b1cbfc9344442931d107827bda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622123293, "uuid": "bc6d2eaf-3b8d-45ce-9c45-3dd44f6d376a", "comment": "Malware payload (Loki)", "value": "63b0a0a5cdb142365eb5c39c6471a7856c4db69061b48132f90e02e3b36f8496091e00fe7d50eaccfc2956134a04a186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123293, "uuid": "afb04dde-e7d8-41d2-ab57-5c9e60c7ac2f", "value": "9874C0DAE6EEC08DC980B9B77C0261565777E4E62F4CD2A2329C9F3B2E68433461D345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123293, "uuid": "3d7f5a21-12cc-4a34-956f-d1ea6278b16b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123293, "uuid": "6607002c-5b64-4ceb-b493-77b42e4f60fb", "value": "6144:BQqT09xu4g5rq533We2m+HqkelzJ6t4kEh/ewPnb0e9f:jXr+3me2m+KkelwikExVPb0Kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622123293, "uuid": "db79d496-07a4-4ff2-ae36-862ae8bf6e9e", "value": 350786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622123293, "uuid": "e74796b2-4730-4ea1-b452-3e9f243b57db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622123293, "uuid": "ba146988-d303-4aba-9fe1-3fffc5e98861", "value": "qbtotakew.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1541f7f1-be94-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1622082878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1622082878, "uuid": "a53ee52a-b694-4bae-a97a-58d7ba9cfc66", "comment": "Malware payload", "value": "91356ae30dea75de27cdf4b267ac989d", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1622082878, "uuid": "b24f2756-5995-436b-8d33-f6f13110b7f6", "comment": "Malware payload", "value": "ffe9dd829145b86a97ae01d98e6960c1a6621f3ac77d7fca62e17411af2158f0", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1622082878, "uuid": "a6af46a8-fddd-4aaa-865e-167e1b08ad60", "comment": "Malware payload", "value": "ed1b6cf6f4aa5fcbd9c9fd02f9a2766cd022ec0c", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1622082878, "uuid": "53214b7b-d7aa-4c56-b8a5-65a1f1b4b189", "comment": "Malware payload", "value": "d6f6c0be58cdc19de2d02326c7e2eb1a33c94a88f2e5bc192fa216d30d59ae41c1095362ab5057f94e33f532fefe20ac", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1622082878, "uuid": "6871c476-5760-459e-9c75-426f389d7995", "value": "C3119E30834462910D2013E6F615B8A6F101002B8DF17E6473CE9AD7DEA968D6BB0EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1622082878, "uuid": "eb6b60d5-a579-4ad5-b822-ec607768bec8", "value": "12:zH/yDvqTuP2rEBf79F7cOFsZnf/4dgD/V8a6mZE8OO0JQxutzxeomdWXbR8sys1O:mDvgu+re79x2ZfmgDmaiRJ48mdWXFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1622082878, "uuid": "9eac8e4e-c580-4709-9670-cdfd24b0bb37", "value": 951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1622082878, "uuid": "2fe78477-07fc-45b5-86b2-b7981f54fbf4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1622082878, "uuid": "1aa03548-42f3-4258-8500-fc67a1f5a4d5", "value": "wiwmVrR9.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }