{ "Event": { "published": true, "date": "2023-01-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-01-25", "timestamp": 1674691381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "6ef0fdfd-513a-42fb-ace3-7d5e65eebcca", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b19169-9cc2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674659315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659315, "uuid": "2bd4c6d7-24eb-4c93-9776-fb282253f5b3", "comment": "Malware payload (RedLineStealer)", "value": "6589eb08abc0fa6dde5c1be30c0ad145", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659315, "uuid": "1f908cbb-97fa-4961-97e4-961a7361e890", "comment": "Malware payload (RedLineStealer)", "value": "0058eab70f8057713b48a317692e05e710310784f8e02d33b646585551207b90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659315, "uuid": "3b7bd58a-3f68-409a-9d4e-92614b0126ff", "comment": "Malware payload (RedLineStealer)", "value": "fa94c2cd0e452beed43da2b6ff7b228c97dedd8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659315, "uuid": "1f69a768-e3c3-4eee-9b8f-a43e623f9085", "comment": "Malware payload (RedLineStealer)", "value": "cff488349e084226fcd8160e2a150bce47a2047380ae2651eb23e5e8869218c2fd8969b772f3cdc91d37bc0c572a9858", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659315, "uuid": "9e48d028-c17c-4151-8b66-fdf8be3f6c7b", "value": "T167E51ED9F7627764C094AF728206011C21A417A3AD23E10968FCDEDD0FB67E96E1EF85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659315, "uuid": "896ee725-ab86-4eae-be73-031a83631c6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659315, "uuid": "bec9aed5-cb54-43cc-9341-8fa4fb0daff6", "value": "6144:6U79B31HTZO1IxfuslzYx6fy07x/3J1QJc6T2vrkYLl1IP:979rFTlz8My07l3E0TLl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674659315, "uuid": "d14ff903-d3c9-43f9-a3f0-a8e26b839ea7", "value": 3207232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674659315, "uuid": "8c94a7ba-879c-4d82-b896-d4ab92f1086b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659315, "uuid": "7997e493-5bc0-46ac-8881-c68812587639", "value": "Antoni\u0301nGulinzkyMyroute.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93cfee2c-9cee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674678401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678401, "uuid": "b27da027-eba0-4675-b669-15a8d3edb8e2", "comment": "Malware payload (AgentTesla)", "value": "e1e6d658fdf7bb98d95f794d61793263", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678401, "uuid": "0ea317f3-ff7a-4869-a024-990066a61f6c", "comment": "Malware payload (AgentTesla)", "value": "0063c0564296cf678772016cfe969ae167ff29e1eeaa78702789beffb336e960", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678401, "uuid": "9d0cbb2e-e748-4025-8084-7b19ac0fbaf0", "comment": "Malware payload (AgentTesla)", "value": "59557ddb48c649870940e031f3614afa481bb15a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678401, "uuid": "06fd208b-6426-408b-97be-0c2aa9f866b8", "comment": "Malware payload (AgentTesla)", "value": "f24200d5aee6bfcdc25212a5f68a41663af19b7ebf10dfd71302c6e81604ebfb801d5c0a7faf7a35f924df5d8d44a9f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678401, "uuid": "6c52db3b-e0f3-4f59-b9ac-7b040544649b", "value": "T14E15EF50B278DB06EE688FF9101155A14BB22E6BFF24F3645C8272E71A73B903E50E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678401, "uuid": "a36bdfae-dbc3-4560-95c9-58166aa8eb12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678401, "uuid": "d4570138-c3d1-4ade-9d35-da784352f80e", "value": "24576:S8kyGyOkQzlGI6AAgZYDywR+6WGvUHIuh+k:S8kypOkjI6AM/EPIu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678401, "uuid": "206dbf09-71da-4fb1-baff-4ef255d48475", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678401, "uuid": "04083e7c-784a-46c6-963e-877c27099a48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678401, "uuid": "7cf310f3-a3d6-4d41-ac84-69bc84a958d2", "value": "UPS shiping docs.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c654bf-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674678961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678961, "uuid": "a73852fc-b9b1-425f-95b4-a46ce83772c2", "comment": "Malware payload", "value": "522d8b439d97a8edce36072f03123485", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678961, "uuid": "333bc258-7362-42ad-8b5c-4ab1782e27a7", "comment": "Malware payload", "value": "00676dbb4fea2cc49890514f62845218212222b70d0d6b5787da43541a049592", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678961, "uuid": "a81be785-1a17-4a1e-aa96-fcac852f5677", "comment": "Malware payload", "value": "3428a0d2c20e6521b0ff24169cc3dc5f4adc7cd8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678961, "uuid": "b0568b84-c1e4-47dc-84df-13ed67fd9ac1", "comment": "Malware payload", "value": "db15346af94bfc56e70ee63470dde03a32ad5f9485a1fbe6e8aecfb2168476627530137db65aa99fcdce0c059884fbad", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678961, "uuid": "ef92df93-4642-4cff-b6ec-2fafb246b5fc", "value": "T1C9A4CF45B669FC4FF99327388CB3D985733BFC482A05550B36603B2E6D723A0AB16794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678961, "uuid": "aa487282-c59a-4e4f-80d7-9e746dc50dd2", "value": "6144:Wh0k5eq1h0k5eqnh0k5eOVh0k5eqJZ+RwPONXoRjDhIcp0fDlavx+W26nABW6rvq:WykdykvykZykl4MYRqkx0q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678961, "uuid": "0d7f76b1-cc9a-4220-833e-8a0f45e0b669", "value": 477696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678961, "uuid": "be72c2bd-a7e9-4cfe-ac25-868c3229daca", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678961, "uuid": "03ca0459-f0f0-4c9c-8f5d-4cb1a216a577", "value": "1-7samples.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d86db2b-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674678713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678713, "uuid": "a61f105c-79d9-499a-ab79-4f890018e5fd", "comment": "Malware payload (GCleaner)", "value": "d14d7629bdf87c83c0fdae8e362d8bf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678713, "uuid": "1b300240-3d47-4bb2-8f90-0d4cd7615cf4", "comment": "Malware payload (GCleaner)", "value": "0115271447fc0909dd041bbdca7471b573fcbbbb563650458c4db5f35b2a8c14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678713, "uuid": "bf0cc3bd-673e-4b4c-afb7-8d3eb9595776", "comment": "Malware payload (GCleaner)", "value": "2be5005340dcdaee99d41df20cf77e9852f9a1f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678713, "uuid": "1ab1c04b-83f5-4f1b-89e8-44a64e50f0eb", "comment": "Malware payload (GCleaner)", "value": "026b17c5907fd33a638aca6675a4f83c1753f3796a703edb85d4c6a833705a910892787943e032f6bcbc53a69f3e367a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678713, "uuid": "0fc0affb-1a81-4b1d-b96e-60b15bd80826", "value": "T16585331361ADDA36C0578FF05A395510CEFA3A211130A625328DB7ADDFFEBC09589B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678713, "uuid": "c8697a0a-7067-49fd-8956-17445ececa26", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678713, "uuid": "7ff4ef3e-077f-4563-b564-69e1fc41e2e1", "value": "49152:ZnjvPv6QB5I/5+c+SCHEFcYuO8yLCgv2MR:pjvPv6Q/aZ+SCkTN8av2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678713, "uuid": "e15b72ea-c18e-4b9f-bff0-aac3c5ffce9e", "value": 1799849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678713, "uuid": "1b729ddb-5b98-4923-beb3-0104cb9ea5e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678713, "uuid": "ffdbaaa7-d1b3-44ee-b9c6-274dbf8782c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ebe3f70-9ca8-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1674648167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648167, "uuid": "2701b022-6e2e-4204-8c11-038411a2d42a", "comment": "Malware payload (CoinMiner)", "value": "89cb3146c056519574b2eb50eeb9df0d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648167, "uuid": "ca0ba030-a94c-4316-bd0f-81483290f135", "comment": "Malware payload (CoinMiner)", "value": "013c6ccc229afd4d5462b2b6cde067ed95f9b482609cfc90ca60cfadc45c4e4e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648167, "uuid": "e132e2db-71d2-417c-b55a-ab01d387d4d7", "comment": "Malware payload (CoinMiner)", "value": "243aa4bb74cf080cb36b67437bb5e50494e37444", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648167, "uuid": "eda7a054-aba8-45d2-8c2a-fa5845813ee9", "comment": "Malware payload (CoinMiner)", "value": "e6529b81ebef7fbd232828256516e649fa5112d5298d4a4c75e3d7dfd45f785a28d7a6629bd9dbd5eb27628f8100fce2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648167, "uuid": "a23289db-f4b3-4dac-aa50-66f2f7891881", "value": "T15AC5EFD0FF59B0B1F2A69038F56285BC0E226C25AAD281577D7EFE0D67383816079739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648167, "uuid": "518678e9-d2ee-4e0e-94df-bbc1e17d818f", "value": "fbfb19291301d8237e01d38f0afbdfa8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648167, "uuid": "094c84b8-88b5-457d-9003-bfbe6587474a", "value": "24576:OGAY+g9ZcgVAQM6dCshQ0WUfft+F7BZkXUuHpuQVHMu9Nd92Gkf:99ZcgVBUshA4ft+F1zqdG0MGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674648167, "uuid": "bdd79816-bbc0-4a3c-8fc9-773144180efb", "value": 2729984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674648167, "uuid": "04374c66-158b-4d30-a2d7-bc5f56f1a1fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648167, "uuid": "fcfa692c-f7fe-4134-8dbf-61774107f889", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353ad253-9c49-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674607375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607375, "uuid": "031989e8-9446-487c-928f-19479e262e0c", "comment": "Malware payload (Mirai)", "value": "43a9481b410947b3e269aaacb36d7802", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607375, "uuid": "ecd410a7-8569-4b80-a686-e93c67ef3e8b", "comment": "Malware payload (Mirai)", "value": "03bd0112a8f495d2267b07ee2606088c7438b48468d23e91ff35ef401fa9b113", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607375, "uuid": "fc5280cf-ed5d-4a19-b319-13694e7d4a00", "comment": "Malware payload (Mirai)", "value": "ec4d1e8ebe0e53ec3490d1ead9865c5feff35ad0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607375, "uuid": "c21b73e8-09b0-4997-a435-9dbad1eba34c", "comment": "Malware payload (Mirai)", "value": "9013aac0b6b70107737da3b13a578d4e7e20475a006461df6951c28dcdd378fdb2c6da41ffc6c486da36e6632dbccef2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607375, "uuid": "e512ca1d-c076-4974-935e-f938c738a6e0", "value": "T13913C4D3B8C11B3AC2E013BEED6E109D332177E891DB72278B255B05679562E0D7AF41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607375, "uuid": "b39c3a00-2768-4ff4-a3f6-6939b61c026a", "value": "768:HAELSo6RZK4GHRXqK28+1670794rnd75L7+8vTByg4hHpox:gEP6RZK4G49V1679e8vTBygMHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674607375, "uuid": "c7f872f4-3eb7-4bd9-aa39-d6da7889e6a5", "value": 43304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674607375, "uuid": "91dcff3c-457d-4010-8a7b-d0517cbeeea4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607375, "uuid": "e1ec65f0-8abc-42b0-85ba-dbb3ecc7e62f", "value": "43a9481b410947b3e269aaacb36d7802", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa86a18-9cee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674678394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678394, "uuid": "2d7a3329-1f0e-450b-b553-dc6f665727cc", "comment": "Malware payload (AgentTesla)", "value": "3ab6e07a446236281be3e00a8cae5257", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678394, "uuid": "da3f57d3-7810-48fa-a444-64c2a1dc4874", "comment": "Malware payload (AgentTesla)", "value": "03d0e5213b4534ed309e18d5a5ea61b36b112c30f6e651544d8746d4ba86e85f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678394, "uuid": "d5de01ac-3baa-4293-9533-eb3ef0403c71", "comment": "Malware payload (AgentTesla)", "value": "70f920967015260adb8f31842805482036605c37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678394, "uuid": "ce2bf48f-0907-4363-89cd-cb335f8ec5bf", "comment": "Malware payload (AgentTesla)", "value": "af9d5ba350ce62838af71a16200b2ff0edaabc29f0c6bc60ac3f2191632a9f9668ff41fddc952d5d581536972c3ee5fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678394, "uuid": "9d480858-a2e4-44aa-8c97-ce9fbca813e9", "value": "T1D615E040B2B8EB02EE648FF9101191A147B22D5BFB64F3645D82B1E71A73BD13E90E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678394, "uuid": "114a628e-19e9-4c9b-867e-99e680ac1287", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678394, "uuid": "37785850-cbfc-4d44-b83b-241628901a61", "value": "12288:Esr8kyGy+yssQzjkATGds3MtEwcU3gZ+A6GQIoZWbDtnx8ND/dpQPIVpM7pxxYNC:d8kyGyOsQzlGI6AAgZ/IZ+v8iI4xut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678394, "uuid": "48bc9821-ad3f-4fd9-8227-e9a20189c4fa", "value": 931840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678394, "uuid": "9ffab5fc-b678-4f7b-9923-9c4b8e051d36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678394, "uuid": "f31c6969-dddc-4ec3-af49-e023def1b1b2", "value": "FedEx Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228fa7a8-9c4c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674608632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608632, "uuid": "99c5052c-acce-4865-aa01-99b67b259d91", "comment": "Malware payload (Smoke Loader)", "value": "8eeb15e7c03141996dc19f084e1f611d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608632, "uuid": "a3738774-67bf-4e30-b3bb-c9508ba07bfd", "comment": "Malware payload (Smoke Loader)", "value": "044512069c1eead179676c9e1c6da9c79ed1cfb41a59a76e91f3f30eb39677eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608632, "uuid": "75191e79-9d2c-4441-9ba2-f115a7cd3ea4", "comment": "Malware payload (Smoke Loader)", "value": "0a47f0eae4fa745573f6d0a84129fcae1f7a23bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608632, "uuid": "05a554e7-5e16-4567-91fb-6ccbb68630d9", "comment": "Malware payload (Smoke Loader)", "value": "d23f27d94d33f6e42fa8e569f0ebfabc25e74ec4085161847fcde446c0066bc8a72246e2b283895c0206a20678aa250b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608632, "uuid": "542b9b32-c81d-49f2-b349-20d814278a5b", "value": "T14B14E1213A50C033CCA744396824E7D16E7AF97206D989873B690B7EDF306D17A7939A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608632, "uuid": "120bdc71-f6fc-42e4-b891-a5f80362822e", "value": "5eb8e9ebd49d9ccce156e2e9eb6d0902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608632, "uuid": "cfc44b79-8d79-448f-a56e-071d4dad4efc", "value": "3072:9LBN2/z2MLfYhrj5lmHZJtI2pnVokO0MQb2iEd9A:91KLwhrXWxIQVBMQ25/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674608632, "uuid": "3f516adb-4b7e-4041-ad54-272e0f0e7d19", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674608632, "uuid": "78c893bc-37fc-46a1-9a99-431b84c019d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608632, "uuid": "7cd5a813-e5ba-4d2b-9ca0-c3b8cd7e4400", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668c76ff-9c44-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674605311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605311, "uuid": "999e48c6-23bc-441a-957e-72a2edb8903b", "comment": "Malware payload (Mirai)", "value": "4153829888ad0c22ab40013d4577b947", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605311, "uuid": "4aa1474f-28c3-4a72-9c95-9144e8892871", "comment": "Malware payload (Mirai)", "value": "049f35ef924f712a3bfbcddbc5b94db74e8b60aaa072d1074f8b4c8f871a61db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605311, "uuid": "60cb2679-6ee1-444d-b825-d767b639bb55", "comment": "Malware payload (Mirai)", "value": "996898f4115032c7b7845ac59b109dbfb88a4f37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605311, "uuid": "4968955d-ddb3-40d9-bc23-b539c3bca8cf", "comment": "Malware payload (Mirai)", "value": "334c4db808d3286ee26beba6fa514bbdd7d4ec2a3e0d8bb49c2d9dfa5c4360adf7ea224695687eae279bcc613befa395", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605311, "uuid": "561d9fc4-0ced-43e1-b493-cd17a4c7868d", "value": "T19BE32A70D018671BC2D2137AA64B4A6D3F261FDFD3A733114A38BAB81BD57892F65D20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605311, "uuid": "a8fa9480-3046-4d08-8490-480d5574fe78", "value": "3072:9SJq2Xavzf3Hf/pO2oQYKGIqbhxBkmIxQjVlSuNu:EvavzfhoQnGIq5kmIxQjVlSuNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674605311, "uuid": "ddac70a1-459d-44b7-b033-1a27101d83aa", "value": 151597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674605311, "uuid": "59bb177c-f065-43aa-a263-a3eaebc238c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605311, "uuid": "4c612bed-243b-44ac-abd5-7afe90ff183c", "value": "4153829888ad0c22ab40013d4577b947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740474d5-9cb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674653437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674653437, "uuid": "dc3c5a5d-b400-4a0f-a512-82e85a206994", "comment": "Malware payload (GCleaner)", "value": "b05f7b06aac4282a4840d04146d79812", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674653437, "uuid": "ee4a7527-5800-48d1-809b-72b237369c6d", "comment": "Malware payload (GCleaner)", "value": "04fc156f28d750e1493137dc1e9dc1c261a228c25a0928ea6ef8c0f998808289", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674653437, "uuid": "4919ced1-bc1a-4b41-8072-756afcfc9b9d", "comment": "Malware payload (GCleaner)", "value": "dafa1fd403e0476bbe5d21e741525858a0f3c0a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674653437, "uuid": "cb344c24-92f7-49f8-a988-0fc1eb55fc04", "comment": "Malware payload (GCleaner)", "value": "dbc45fc2bc8aba77b8fb4898446d5d17f845d6e907b1d16981e0c8fad0d5826751409edd521cfa02cd6bc5d8744a2da1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674653437, "uuid": "f0dbdc55-6be6-4a78-8479-5f5f10abe25c", "value": "T1418533129079A032D0A0DBB65E15D552AA33FB391470335C714C67CF7B97788E2893AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674653437, "uuid": "4b75e204-3d78-4bad-997d-eeecd235337b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674653437, "uuid": "b2f53029-d3ec-4697-8712-b4063b895bfe", "value": "49152:Z5KV3SiH2U9RUEc3qW5UQTl9+iiiapLCgv2MR:iVCipRw5UQp9+ikv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674653437, "uuid": "f52a4b11-6114-4d05-8e5b-ecdc64d9cc60", "value": 1819250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674653437, "uuid": "cc833914-60c5-419f-86f8-85b5b6332bc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674653437, "uuid": "f6ec2ca6-8f65-406b-8f87-92361860c48e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42962b2e-9c86-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674633597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633597, "uuid": "e4f802ae-5764-479f-812c-16d3e369e53a", "comment": "Malware payload (AgentTesla)", "value": "8ed5cc05860ca8793cc499528eb5cf6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633597, "uuid": "fc7a751b-a583-4eb6-a39f-a292295afedf", "comment": "Malware payload (AgentTesla)", "value": "056de7599202ff1f467d396f528f15be6e9e92d30b3ce86dfc993528b2df01ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633597, "uuid": "f72dc2f5-d436-4719-a552-885d7179a361", "comment": "Malware payload (AgentTesla)", "value": "8f060723f466c4f97456e467fb714c3786fb5aaa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633597, "uuid": "4044c6d3-0285-470d-8dc1-726fd61cbd14", "comment": "Malware payload (AgentTesla)", "value": "f9c179e6b32214bfae79f48b28c53ce4a55b855825dfa64f18452409e8d44155d9b518ce11d97e95133c456c29905da6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633597, "uuid": "b9bbfa31-3a2c-4c0f-a502-ab58b1090217", "value": "T132B271C1D79805E5ED660BB15CB7AD22016BBE7DACB1A96D681EB0359F732C3007390B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633597, "uuid": "45cdf751-ef4e-4d30-8781-6e672dd44afc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633597, "uuid": "0a839aa7-f95b-45eb-8a5a-68070cc9caef", "value": "384:XNubLsRtxGuhHzVZJq/S8frSo62tCT+UuSvwiFawn/:XAfeJhHzIfrS8fiFaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674633597, "uuid": "fae366b1-b248-41fa-b270-2d239656443b", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674633597, "uuid": "5ee573fe-ef85-4f86-853d-cc1b1628e889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633597, "uuid": "c76db373-8c6a-4976-945d-0d80f50583c4", "value": "PI_NBI-2250123(MECH)_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31970080-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674678666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678666, "uuid": "6b01552f-c6e2-4a46-a4a5-4569ccab1306", "comment": "Malware payload (SnakeKeylogger)", "value": "221514f138376a969265458807b18b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678666, "uuid": "e262d25b-dbba-49ee-a3a7-5c4da0a8315e", "comment": "Malware payload (SnakeKeylogger)", "value": "0571847ca3a64915ecc956c5234034721080bc373829cac9a6b0efda2cc30831", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678666, "uuid": "7c81f16c-05e9-4659-9563-6d2147680b20", "comment": "Malware payload (SnakeKeylogger)", "value": "2b2847e3d5a3324d648ea1d5340bd6be4289d713", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678666, "uuid": "1b15e4ff-7298-4730-a40e-9b76f2c3dd62", "comment": "Malware payload (SnakeKeylogger)", "value": "66eee29e5b8c85c6a30dc87206dbfb1fcfe5c34bfe55f11eb8470e9f3262f4a079080154dac2b9921ba958c713f8afb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678666, "uuid": "c4549c4b-e02c-4283-b94a-37c6df20b071", "value": "T1277412003769C963ED65057A0FB6A6D7F9E1F6241040DB1B27C1AF4DBF36682DB2A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678666, "uuid": "8c4257e5-fc26-4ce6-bfaf-f7c28457efd8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678666, "uuid": "74599f74-c7d4-4610-b11f-afdf4c563a44", "value": "6144:/Ya6Ly8N7xGJDSk8429LISvXrSpKGBjQ06XKao2QPJ3iUVm12hQ:/Y5TNNGD29cSv7SHBs06XKL3LmoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678666, "uuid": "52246c76-287a-4efb-935b-225b976ddad6", "value": 340580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678666, "uuid": "e55b506d-c70e-4261-8038-8506d21d7ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678666, "uuid": "93e22763-e8b2-4e5b-b550-3c61dd1c2778", "value": "Signed Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8c2d6d-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674678957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678957, "uuid": "dca6529e-5bec-4351-b50d-cd42f6d15165", "comment": "Malware payload", "value": "4d88d8bab90627f965f64b4606110aa1", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678957, "uuid": "3b09bb95-c219-4805-aca1-82e698badcc7", "comment": "Malware payload", "value": "057fc3038f986ebafce53cdac1b82e82b3633cfd4ac45212e86c74d7b25408d3", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678957, "uuid": "d5a28aa9-fea4-4a7e-b336-7e571658109c", "comment": "Malware payload", "value": "aba2fa3704f577fe618b03f4100995520888f22b", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678957, "uuid": "8409319d-65b8-4d2f-85af-d3ac612d5f72", "comment": "Malware payload", "value": "32528fddfc58b21c38aae47b47488ccf17ddac3527a996b6de8c83024ce3813c2ea40feb58a4be99268341d207b76991", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678957, "uuid": "8bf19167-6c6c-488c-a68f-26202362ea74", "value": "T1DEE41207F9C4FA0FE1AB233884D341D18A3EBC275A67D3532984B3BE0B71A629D65255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678957, "uuid": "6f8609bb-9ecc-49e1-8169-b6b5ee822449", "value": "12288:ca0ri4XjlvXp7XXXXXXXXXXXXUXXXXXXXXXXXXXXXXq7PklHklkvKvY/YSlDlSnV:UrpzlvdXXXXXXXXXXXXUXXXXXXXXXXXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678957, "uuid": "d2bc866b-245f-4027-be7d-a45c95207722", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678957, "uuid": "bc57bee1-57ab-48f2-9295-b97ca281ea09", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678957, "uuid": "b8929490-bfd4-49ba-aa27-84a1283a9a4a", "value": "125.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bf17df-9c4c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674608629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608629, "uuid": "b48aff19-6898-4801-a493-38a5810ec60c", "comment": "Malware payload", "value": "176cfa8f212018e51609f5bce0ba7ccf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608629, "uuid": "82a761f6-f230-4dd6-bf9f-a7c62b9d4c76", "comment": "Malware payload", "value": "05ab718bd1eaf73a3a0a53d4d1fd460ea56e0d12856605424ae0eac0e3e115bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608629, "uuid": "b273839a-fa64-4eae-a063-06a69e292205", "comment": "Malware payload", "value": "132c04fc2a4c4b1d0d1b9762f0e9bb1221bfe239", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608629, "uuid": "4554097a-4d09-45f2-91d9-d73d055cec74", "comment": "Malware payload", "value": "3dd0035956f464e0a3221d8f1824454c7476dadfc136243ea48c7aac16f1c6cfe3ab699baed75664b1eda36e5d0eaf42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608629, "uuid": "3c12132c-a02d-4187-a549-6d9834deaf43", "value": "T1AFD2E138B5D5C6AAE751D47E2B9E61CB1EF8E263E34E67D1D987040E3F652C5C000C6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608629, "uuid": "d81bd842-00c6-4d41-8bed-08d7677df69c", "value": "384:M4AdB0+KUIwpNvyQGvwG+AI1txEvn+FVDn3gYdp9PpAPXpXznqnBnLMkD4wB8ESv:+dS0lV2uzdEvqVLgSiK4k4zk9+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674608629, "uuid": "20ab06b2-91ba-4c80-b9fb-0b23f2d46478", "value": 29872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674608629, "uuid": "413d2b83-f9bd-4627-b324-8e725bf980b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608629, "uuid": "6e52eda4-214a-464e-b2fe-04653b482082", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a94daf-9c7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kutaki)", "timestamp": 1674630780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630780, "uuid": "6be8130a-13ca-41df-9724-4a8bf3175285", "comment": "Malware payload (Kutaki)", "value": "29a1336972c4f6795521d98e50e16403", "object_relation": "md5", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630780, "uuid": "f5d13c8c-a0df-41d2-8ce2-0a05b80d03ed", "comment": "Malware payload (Kutaki)", "value": "05e49ea92a0ae4f6fc3e40bedcb18a4a6b63bf2de2acedf04e834ba59116de4b", "object_relation": "sha256", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630780, "uuid": "815d14d3-ef03-42d2-8c86-8b387306d4be", "comment": "Malware payload (Kutaki)", "value": "b93df72910c771765e4d6eeeef4c2711ab86c9ae", "object_relation": "sha1", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630780, "uuid": "c26a2a76-51ed-4e4c-ae78-adc2fcd80fc3", "comment": "Malware payload (Kutaki)", "value": "a0f77b75f71035f04db6bfaf4cad843f37123ee00ded913b804697e623dc9cded90ef2e76a1e9ce78d995527f033e32f", "object_relation": "sha3-384", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630780, "uuid": "9826a2ea-5054-410d-b08b-eeba9cd8dbea", "value": "T13C8423685ACF0B9F6AED2CB45A63E16607D206FB271271005ED7B3EBC019943F25B11B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630780, "uuid": "70775309-f16c-4c49-9e37-6ed5d9932a6e", "value": "6144:RAm7gB4v9iG9FvOHuW1S4GnA9j2HH/VCSY3hwjlMVkYuDQMSWy+lqqHTon+1yHDt:RAm7Q4FiGrvOG4iA9j2n/KhiBEMSW8KG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674630780, "uuid": "a3e039f6-04bf-42fd-a8f7-fb23b82f6f8c", "value": 373658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674630780, "uuid": "7d6cc16b-1920-451a-b040-51d937e80241", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630780, "uuid": "8c332ef2-2254-4882-9dd4-2b71090ea304", "value": "29a1336972c4f6795521d98e50e16403", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49abfc0-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674678912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678912, "uuid": "033229bd-b77e-4af9-bd8d-e0adba1dc608", "comment": "Malware payload", "value": "e1b23488fc73bfa63ae39e9f2238ee01", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678912, "uuid": "78b17003-33e2-43db-b477-805a715aac60", "comment": "Malware payload", "value": "060952460ebb4018dc4aee46a8d59d79d801c9f30137167cd992009a6e0ae7e7", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678912, "uuid": "cb51e58d-59c1-43b5-9ac0-4ee2ae3f8b33", "comment": "Malware payload", "value": "170b4c92bb18d298b52aedf514698a33e19d987a", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678912, "uuid": "2fa33b4b-767d-4b53-8492-a111e94d573c", "comment": "Malware payload", "value": "55a98c05814fa375f551ca7e980b7da3f739150a1038ad2d1c7fcf1d2ffc1e02be6323f9a197617b39f62d69b4ec27f2", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678912, "uuid": "0e6b5a16-5f3b-4c71-9607-f3cdb324508c", "value": "T1A03584F8905B45B4E207D8AC9456FA192CB6BD83B9D284B053AEC5708F75EF19FE001B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678912, "uuid": "962f2d57-57c4-4706-9b53-1e5304f44cbd", "value": "6144:Gab6QYdSvtJTRnUuCVT8j8PT0DSmS54+VzFt1RDAUww:GaOQ/fKuCN8jB+b5fVzFHRsUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678912, "uuid": "e3213ffa-2e75-47e6-b5e3-f5dd847fea93", "value": 1160990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678912, "uuid": "802afa38-971d-41ca-9b4b-eb7849d0c575", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678912, "uuid": "7b552ca3-bd6d-4dc9-a227-5a67c5525d6f", "value": "Payment Prove No. INV.10047033.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7009dfef-9c49-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674607474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607474, "uuid": "d3bcb3db-3f0f-4d94-809a-c072e0077e8a", "comment": "Malware payload (Mirai)", "value": "8711e3dea5da84961aade5d6dcd75911", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607474, "uuid": "f6f511e8-b63d-4758-946c-720f88fdd20f", "comment": "Malware payload (Mirai)", "value": "0624db2f004b9ee4196fa57c1cd92e24e6c9fa4d48f4f948d5db6e1a2dd44376", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607474, "uuid": "96415ad8-4f4c-4ac5-8b58-9e13cb57172a", "comment": "Malware payload (Mirai)", "value": "6c5ee02333957993801d3d349bc4c955beabf739", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607474, "uuid": "6117a1a6-7f98-4c2c-a60c-826685285811", "comment": "Malware payload (Mirai)", "value": "1144461128d8a7800fdd71b5cde0b95d6d6f112bdc4683f092076e284959303284da5ff02da05e99e8779377d17b80e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607474, "uuid": "7ae9a465-d419-4397-a8f9-d453eb01d4ec", "value": "T1E1530886BC814E16C5FC12BEBA1F518E3312776CE2DF7222D9105F91278692B0E7F912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607474, "uuid": "2b6a04c7-4ca8-4bff-828e-3245e39b5269", "value": "1536:ZxnRPVUTxyXcedXsxMtHkbuXzxIyipJwXB32888:vUlyseXKMoJwXB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674607474, "uuid": "37ae1f1d-b181-4db0-adae-591528f29a99", "value": 62764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674607474, "uuid": "3dca1a51-ce6a-4608-af5e-c01c6198dc4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607474, "uuid": "41218135-c9fd-415d-8e53-9008f6210476", "value": "8711e3dea5da84961aade5d6dcd75911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e2cf2b-9c43-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674604825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674604825, "uuid": "76a0c9c6-604a-4135-8d9d-89169bc76f9b", "comment": "Malware payload (Smoke Loader)", "value": "7c40b6ed30dc56b6c8a2800858fd88e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674604825, "uuid": "8bcd4fbc-e79f-405d-9364-86e49bb79dbe", "comment": "Malware payload (Smoke Loader)", "value": "0679c8eb4296b6a6dad9c4fef044cbf6370400f97752f804a81f609edb5b0599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674604825, "uuid": "4f7a7036-a1a4-481d-9a2f-5640c99df129", "comment": "Malware payload (Smoke Loader)", "value": "174d82d81ffc79a07427304f21c7386c21ddc63f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674604825, "uuid": "4febc836-34e6-4860-be90-5601095a4a98", "comment": "Malware payload (Smoke Loader)", "value": "451023bc7fe673343e4b15c785cdf8045343000f864182173de4e99199e48abd5f11b2a365fc1f89e439a13d651d9450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674604825, "uuid": "098847ae-67c0-450b-8f1b-b88709efc82d", "value": "T1F114E1327560D232C49A45740C75D7D46E7AFA320BE884CB3B740BBE6F30AD15A7639A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674604825, "uuid": "7fa228d1-f0f3-42e2-82ba-dc74d11ff634", "value": "5eb8e9ebd49d9ccce156e2e9eb6d0902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674604825, "uuid": "a6f45f3a-163c-4493-a22b-d641d7a5f597", "value": "3072:U/LBN2FdYiAPLlTXhM5cL3mwF3mMXfoev7V6BblrgRxff7:o11LVXh33mwF3mJu2bJOff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674604825, "uuid": "e16323ac-8f64-487b-9682-099710e673be", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674604825, "uuid": "da387565-2f20-41a0-93f8-bb3c5c7040bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674604825, "uuid": "53836602-e1ca-4e13-a785-e04f45057770", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784af34f-9c44-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674605340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605340, "uuid": "0582a722-aab4-4fa3-9bb2-7749d70a1e75", "comment": "Malware payload (Mirai)", "value": "5743ceb4e9974a114472000a1f9c448f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605340, "uuid": "5ef8d844-fdc4-4b1a-9be2-4496089ba515", "comment": "Malware payload (Mirai)", "value": "06a505c3a88c0f2e0ad844ae62af9823b363f968e68c458e8f289e157fea4259", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605340, "uuid": "6fba6540-c37c-4468-8a65-b19b4431323e", "comment": "Malware payload (Mirai)", "value": "94bbfa4ccb95a5a0b39cf613744f54207ed98410", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605340, "uuid": "acbbbfde-9642-46fe-8ecb-72c661030f7d", "comment": "Malware payload (Mirai)", "value": "01c58199eb8f510282355086675dc62e671566543843c74a5b42fdda37469d97e8e7882f47ea0c3f199896e042e1f69b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605340, "uuid": "655e1818-024f-4cba-96f6-9c13c9cc29e8", "value": "T11EB3E6B1A248E577D14301B211979F310C26FDFF9A6A5E06E3687CB88A3D0C5F7A1E58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605340, "uuid": "ea03133f-075f-4d1c-94dc-b68bdf30b8d8", "value": "3072:UB8al7EUDqajcxNHdXRkjJr4KoZKpPG+nmXFVc5nkGn7HT:UBXE+qftJgvoMpnmXFVc5nkGn7HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674605340, "uuid": "c741572d-e482-4235-bc75-59c895209e3e", "value": 108537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674605340, "uuid": "fbfdcf90-c114-4643-8512-4e760a8da51a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605340, "uuid": "7d3ffa96-619c-40ca-8943-85823bc998b9", "value": "5743ceb4e9974a114472000a1f9c448f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b7697b-9c88-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674634564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674634564, "uuid": "7c02e260-3c91-47ec-9847-e44345465111", "comment": "Malware payload (GCleaner)", "value": "c397651d23b13ed5b52273bbe8054303", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674634564, "uuid": "aae2eaaf-696a-432b-a853-6b28287436b0", "comment": "Malware payload (GCleaner)", "value": "06e2d2962506abd62f9cf1d85d500064b996ddef2362fe479850c81e0303207d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674634564, "uuid": "3c66c338-6a05-4b0d-bd10-88c7ecdf28d1", "comment": "Malware payload (GCleaner)", "value": "9b1b99387ef4d59b1b745161bb15e1aede4d84be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674634564, "uuid": "5506ae52-328d-422e-b1d1-cab8701a7a36", "comment": "Malware payload (GCleaner)", "value": "c9bac806d434dab0f1218222d39c39333ababfd54b2716165c8c6eeb6f29ddf9b05f7156fd26226fdc92e123c5b29be9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674634564, "uuid": "851f0b40-04cc-4bfd-80e6-9581ed8f1567", "value": "T14E853306112948B6F6A3AE711C2B41439E7B77648AF8513932EE731E5B3BFA4D46CF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674634564, "uuid": "01c166ad-3321-42fa-82db-7c7e624edbfa", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674634564, "uuid": "32e41047-8b5c-4688-ab8a-565e2a080569", "value": "49152:ZpToIG+Ff+deCoGLXqfEN+vR6PwKV1Nk2ALCgv2MR:LCmGLXCEMYIKV1Nkxv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674634564, "uuid": "5f0b3cf9-45d4-4fea-87ca-b4756348c06b", "value": 1787163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674634564, "uuid": "57c87228-5d36-417c-979d-8878e0f16ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674634564, "uuid": "a6c4f659-b9c4-4c9d-8d96-f6a19456984a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73bebac3-9c44-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674605333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605333, "uuid": "962d5cc7-7bfe-466d-9ddd-819db31d434e", "comment": "Malware payload (Mirai)", "value": "2d594392e6798f0338537cd7956edbc0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605333, "uuid": "ac30da94-e9aa-4f6f-90b8-986be13d99ce", "comment": "Malware payload (Mirai)", "value": "071d1a27a6a95040b9701a0e5c5773d607238849295f54e5b50f38e1d8ae475b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605333, "uuid": "b715b50e-a47b-4a1d-b62c-87b18905ef95", "comment": "Malware payload (Mirai)", "value": "13931915975636e7f152ebd410fd5ca6d547b5c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605333, "uuid": "5f62404b-a452-46b0-912c-e0fdb4d23f7b", "comment": "Malware payload (Mirai)", "value": "fec672e4dd940ad0c308b8461b11b3a365d377885bc922ec1debc6acbde84075c4d0ed79517ca24d85ef98db602b5f7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605333, "uuid": "21624705-5591-4047-bb2c-e965662e0c50", "value": "T13FC329B7661C174BC09B05B02C772FF04F5DADEB92A215806219FEC8077A9F1B692F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605333, "uuid": "577a54bb-2ff5-4616-bc7d-d3f4f9d70288", "value": "3072:cSgtA7LN8/vsZ9DwtYK26rmX/QcNwsHn6FNb:cSiAF8nsZ9DEn26rmX/QcNwsHn6FNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674605333, "uuid": "ef4cfc5d-7b37-47a6-bbe9-f14366800309", "value": 125556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674605333, "uuid": "ae2fd3e3-d73f-44c7-94cb-8c179168daf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605333, "uuid": "2c36fe71-8f5e-4a01-9996-4ab9dacb9946", "value": "2d594392e6798f0338537cd7956edbc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd8b676-9cf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674680483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680483, "uuid": "495580b7-9ace-49e5-9da5-9100dad0d72b", "comment": "Malware payload (GCleaner)", "value": "0817bbce1a8c870087c1e7e5452e8857", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680483, "uuid": "22c06e07-1aa3-48c8-9288-5c151d5b9c58", "comment": "Malware payload (GCleaner)", "value": "08702bc6047a2df8f64b3682366b0600f108c1836e094ce2eb6521fedc8bb83d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680483, "uuid": "1fcb29a1-e434-49fd-9ffc-98c7d2c13490", "comment": "Malware payload (GCleaner)", "value": "31587ef4d32997e43d4c78700ddea22934884d90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680483, "uuid": "6b281ad0-1111-4698-a3b0-15e7fbc0f2b1", "comment": "Malware payload (GCleaner)", "value": "0c02d2eae58728733c6217cd5a039edcb23a61286797d7728239b6fa06616aeff3b6f0251f583c4d4a9084c2a40b05e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680483, "uuid": "b25b02cc-36e8-4e00-9764-72f612df7859", "value": "T1C885339A14529470F4F35BB60A7E7120DAB37A7801385088FB5C748CEF867B1A5867BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680483, "uuid": "0d931922-1091-4913-bd7e-9e229a0c7425", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680483, "uuid": "8c8807b1-5e68-48a1-9e69-5309c1470cba", "value": "49152:ZHkxIUp2R4+CtF55FgMj5u/The97J9E3LBLCgv2MR:2xjB+yF55OMNAc99q3Ltv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674680483, "uuid": "667cf0dc-35f7-4196-a2dd-023099e2ca3a", "value": 1791264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674680483, "uuid": "cecaa02f-fbff-4f64-a60a-9176c822900e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680483, "uuid": "36acdc6d-1d57-4cc6-b73b-71b36073c8bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a5eb6b-9ca6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1674647311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647311, "uuid": "19629edc-2b59-4a3f-b493-546c6e187b94", "comment": "Malware payload (RemcosRAT)", "value": "d2e33e372b199abb6f30afb3ae157eeb", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647311, "uuid": "c0a34e2c-ed78-400f-9f89-7d1532d31d5e", "comment": "Malware payload (RemcosRAT)", "value": "08b1feef06418988ebe21c6b47c7a0d9b593d5de5ae65f23c41c7092006d2261", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647311, "uuid": "fae476af-11fe-49f4-bfd8-94ac30ff3f25", "comment": "Malware payload (RemcosRAT)", "value": "ab16a88d0947e0322d4926bf70653ff411677015", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647311, "uuid": "3d756ba4-5cb2-4fc0-97c8-1bbbfd3fe6e9", "comment": "Malware payload (RemcosRAT)", "value": "f65c7ad675ed220690e3e5e918fc22ee82bef9fac13094c07a5b26b732be57ac1b12d378c3e589d70925ab1c46a3792b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647311, "uuid": "c6d2e4d1-3f4d-4467-be28-784ee32e88da", "value": "T1601523AEC026A49CF18FCA29C8BC0C3C5AFD69AD54C6203461FE6919837655DE7FC712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647311, "uuid": "d3500a36-312c-4975-859e-663353fae496", "value": "24576:ef4XG9y6Y9Tijb/z47hMGXXlYH3HPdGKkvU2XJfvEJq4:PXGYj9TAb/8VpxKkvUKfvEJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674647311, "uuid": "2248076f-deb8-4ec1-b29e-8462fd83382c", "value": 884012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674647311, "uuid": "074d8ffc-981d-4c60-bc8d-abd68c22a20d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647311, "uuid": "a11b1265-5cae-488f-858b-017915eb477e", "value": "Roshan Basnayaka CV_1.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3db5e1-9cd6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674668132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668132, "uuid": "b62f0f6a-4767-40fa-8ff0-150e9ea94059", "comment": "Malware payload (Gafgyt)", "value": "6d323e30fd1745a74bf27924bf25ce5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668132, "uuid": "54fb98f7-f1a3-43be-ac37-2aa03bf0d836", "comment": "Malware payload (Gafgyt)", "value": "0948924d72d14cd4224f8c36bb5f620da23f9d308bc761f1c0802326fb005316", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668132, "uuid": "7948e9a9-c0f8-4e80-bcdd-bd2166ab66c9", "comment": "Malware payload (Gafgyt)", "value": "6fb770592158d5899cea0277560cb1261498ba4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668132, "uuid": "ef71217f-2a08-4c1b-a2d8-26073b860365", "comment": "Malware payload (Gafgyt)", "value": "2ef430f0215e90768fea22a8e8352155a5d2215dfcc34bba9798e9eace903eebe0494e887dcac8079162cf78847d2ab1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668132, "uuid": "626f8f96-e239-4c03-a4b1-9befc6c84605", "value": "T136B3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668132, "uuid": "0478c524-85f4-4c49-b5fe-1b3ddbfd218e", "value": "3072:R/4tNF9U4vv2Kw6J73x8UmkiSFxfKxbXe:BUNFK+28T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668132, "uuid": "760d9d98-3245-495a-a693-52a8fec86fe7", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668132, "uuid": "dbe079d9-2beb-4441-8b2d-19cf41e2380c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668132, "uuid": "aa839c9b-aeb7-4700-aa6a-5a43bec7b9bd", "value": "6d323e30fd1745a74bf27924bf25ce5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427bc575-9ced-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674677835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677835, "uuid": "c4707bc2-7d28-4b11-858e-3634d9fed75e", "comment": "Malware payload (GCleaner)", "value": "77149b063da322b58e71cc31cf12af52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677835, "uuid": "18488287-91fb-4a28-9f4d-61152c9d2aa2", "comment": "Malware payload (GCleaner)", "value": "0c5979eb0b88e02c4cc3646ffb23685bda4392cf28a5efc154fd799e72224102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677835, "uuid": "ab50f0c3-e201-41c8-b5e0-404a2cffb2a6", "comment": "Malware payload (GCleaner)", "value": "45da407eaa45b0058ba671adc7aebe682a42c4f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677835, "uuid": "93ce8884-5ca7-4c56-bf7c-8746e5a22d6b", "comment": "Malware payload (GCleaner)", "value": "3da5a0f62b5a969ccb93718392954b3531f33fa9588ca2d7977f9e7d4b2fb01752f643cf18e9abac43c974c10ba7ac64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677835, "uuid": "673c2fc1-e4d4-46b5-b17d-d5387efb8e90", "value": "T1E085337A8054C030E197CE71A825EE53AC7FB637AD71394112ED9B9F1B2F3661339A90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677835, "uuid": "da9dd8ce-61d6-46fe-9d60-a72dfd9e48c9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677835, "uuid": "197b06ea-8dce-44e6-a436-0b806b9596da", "value": "49152:Z6z+wwF71SktVPBRIcVCiJc4B1hpO+3iQaLCgv2MR:yyZ1SktV5RxVRJVBpO+3Av2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674677835, "uuid": "60bc67d1-1fd9-4b33-aaa3-73db8d8e405b", "value": 1770680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674677835, "uuid": "9b2e633e-fe19-4932-914d-0af09e2ad4b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677835, "uuid": "927f4512-2262-4a26-b1df-29c50e429848", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad0adf1-9c6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674623115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623115, "uuid": "aba858ac-80ab-4234-920f-fe7b21362311", "comment": "Malware payload (RedLineStealer)", "value": "9972eddf2d72b74ee348a3db68d1dcdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623115, "uuid": "912f8ade-4b31-4644-894b-783b1ddaad71", "comment": "Malware payload (RedLineStealer)", "value": "0ca708b61027e0a590e0d84338985ac862e8188226325763a7249fd2473c7f64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623115, "uuid": "d8149dcc-bd46-45ce-b436-d90802f69b56", "comment": "Malware payload (RedLineStealer)", "value": "b1c64d9e38a0efae7052f670e40f367a7898a19e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623115, "uuid": "10f66249-c67d-44b1-aea6-38ab7fd02f46", "comment": "Malware payload (RedLineStealer)", "value": "6fe2968e9958a5cb9f0b8974b0cc8a1716c4e384d7bcd7457761413a1f87e2983048a37763d61792b6446f5cb794a022", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623115, "uuid": "c7e4a8a1-4463-406c-adb1-f9eb40fd5e45", "value": "T15226338496C2BB12F055963C04D72E28FE2C56C7F4968E20B2D8D634B7F36DBA356E11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623115, "uuid": "a7bab08f-a211-4e03-b7d5-42ee10edcf01", "value": "98304:0Pbajd2+xwMCFbH37BFaGv9SR0nR+NR6xccwtE1C:Dg+2MCxLBFrM0aRQwtEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674623115, "uuid": "805bdd62-f5a6-4d6a-861e-16d86058cecd", "value": 4428654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674623115, "uuid": "7648475e-3959-4989-b1bf-b4512a2e8200", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623115, "uuid": "9fdbc83a-17df-4606-901d-f24008cd5a8b", "value": "Installer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a0ce3e-9caa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1674649217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649217, "uuid": "42cba2bc-0929-4da7-a9eb-e8f04e8c0b78", "comment": "Malware payload (Fabookie)", "value": "6e7a0b3199263c35b19f7e4c129d3460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649217, "uuid": "e2d42be2-a580-483b-bf48-294b160cce24", "comment": "Malware payload (Fabookie)", "value": "0d5785c534c6d2a4bd5fe6c7a6d06523fa85511be1d950515f1be68516295b48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649217, "uuid": "6e7ae74b-4576-4f40-91e5-0b5055a0edc0", "comment": "Malware payload (Fabookie)", "value": "168fb1c154d0eca4dd386932a7a218c6bd3ca392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649217, "uuid": "9a1eda5c-64e2-490f-91ad-327b580fdaf9", "comment": "Malware payload (Fabookie)", "value": "03b2cacd08d14f6825ee1fdc493c0d11fe583fbe3d0d7c94ec4445ee754935fe662fff336d57ce192616a06bc2e5426a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649217, "uuid": "3595fb4b-e086-4223-958c-f946ec36582b", "value": "T1FEF512AD5088376CC41F80399527ED54B1F6562F0EE59AFA72EBBBC077EB810D641B08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649217, "uuid": "f253b893-c82c-41d3-b357-18a36599cdc1", "value": "245fbb05d3da4d7c6badd5cc3e1f9b98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649217, "uuid": "2bbc8381-7b38-4aec-b1a4-acc58a1c9237", "value": "98304:Oj0oe6TkRPUp00DgPpP1DAymfZFT5+/W/jZu:OjMj+YpPZA1Rh5+ctu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674649217, "uuid": "d112be66-030a-45f4-9bb1-80ffac6a2762", "value": 3649536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674649217, "uuid": "9f6d5c95-d791-4f52-a0f8-16fc481aa1db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649217, "uuid": "d78c59dc-4f7b-4c7a-a64c-355881f1fa9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d753b553-9c79-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674628263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674628263, "uuid": "d23dac76-a076-48b3-85b9-e59bf401e2d9", "comment": "Malware payload (GCleaner)", "value": "fd22e53028bffa156c5e5c4002a47f8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674628263, "uuid": "c4f0313b-ed77-467a-9723-c960c41f8092", "comment": "Malware payload (GCleaner)", "value": "10700786cf8408479a8992de232a4c99731d18dab67424bdd58fed2b0f7e9999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674628263, "uuid": "4bca88de-4b21-4839-b3ab-f632bd355963", "comment": "Malware payload (GCleaner)", "value": "0f110ba16e370dff7ecfb1905775a99868be85f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674628263, "uuid": "258a5f84-28b3-4e86-b8cd-27501f6d0365", "comment": "Malware payload (GCleaner)", "value": "afc9de599cbe192dab4f0ef52653bf8c2be667c0ad3c2cbe3f61c72b16773e9ba46b0a8b46a39ce55e27c594e1d1cffa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674628263, "uuid": "d664cbcc-dd8c-4a36-bddb-73775be77248", "value": "T19F85330B8281D633DA47EB301ABB59150B6BED1E4034751AF18F6A4F4F733A1E52E762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674628263, "uuid": "f04efc2b-a006-4030-b7ff-e7a6274bbc6c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674628263, "uuid": "dc64aba3-c89e-4c74-8fd6-7078b6a29b6f", "value": "49152:ZIW2tsQJh+uhmriwsZ7cGA3WIlIxnLcBwro64mLCgv2MR:KOIpw8cxWDCTWv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674628263, "uuid": "ff79df7f-c053-4a76-b1ac-67a7beeeac12", "value": 1777793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674628263, "uuid": "87774780-1b5f-4fc8-9c53-a0b8cd7d6ba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674628263, "uuid": "431bcd7d-3bde-4ca7-aabc-99e1a9535453", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146e2d08-9d00-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674685918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674685918, "uuid": "5da5a635-d2c9-4154-a502-fa8feb4a9eeb", "comment": "Malware payload", "value": "e4568e63ab052b054cb6cbf4d696d54b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674685918, "uuid": "ff187128-bff6-4f9e-9ecc-a6a7119b6856", "comment": "Malware payload", "value": "107ba2cd9618983b65ec56c54b18177853b847cfdebe89602aaaad939434a6d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674685918, "uuid": "df098cf0-0451-4d0d-b8ff-0bbad2f55d1b", "comment": "Malware payload", "value": "cd4c90ce94ff55d47bf6d15143d3d12783d0879d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674685918, "uuid": "aee8dbfe-6818-4044-af7c-e03519f5eb36", "comment": "Malware payload", "value": "4716418fbd99833dad061702539c7e10baab6eb253f6ac94dc2785300371acdf7d4372f0389243249b7e3b0222a98f05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674685918, "uuid": "4edbc22d-1142-4e85-b677-c55398637639", "value": "T1D08533616DE88836C222DF3D2A75899E7F327725643C2024311C576E7E2BF24F46E356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674685918, "uuid": "c5ad8c25-af45-466f-a5db-24adb37aadbf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674685918, "uuid": "65ddb671-cab1-4dd2-98bf-4682eb502657", "value": "49152:ZhuMoEcbLRVtD2vn1ZKQyyHalA1MUV/TBLCgv2MR:buMfcbLLtDUXKly6lKTtv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674685918, "uuid": "a701b155-21df-4871-a862-89f86f52c05b", "value": 1788030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674685918, "uuid": "95cb0ea1-4054-42ed-8eb7-9f36b6d77852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674685918, "uuid": "16a66853-052b-4151-86b9-51a1bb47f593", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb918aa9-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674679005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679005, "uuid": "c262ed22-a9a3-410c-87e2-487ccf228de3", "comment": "Malware payload", "value": "54a0857ef1b0d0833d4f8d907b6586a7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679005, "uuid": "baee7025-2291-4f75-bf1e-2cf1cb55f34c", "comment": "Malware payload", "value": "10ff7959558189167db85dd91f6741befe3b5505c6caddfd259c4e3e864c1056", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679005, "uuid": "2e458691-1bc6-4c57-a971-3efde40040d3", "comment": "Malware payload", "value": "b7133b4c386b415ecc3897eff44f424d9f079575", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679005, "uuid": "96ad035c-3bc0-42e6-acd4-9e8c482470b4", "comment": "Malware payload", "value": "80780b622313febb252cfc612671107699b5f70b9ca42e083aac66ec33240d9deb4af916f25a0e83ce5391a21c7285a7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679005, "uuid": "31b5c762-dfb1-408a-bf2d-5cc6486bdd46", "value": "T14FA4CF55B669FC4FE95327388CB3D985733BFC482B05550B36603B2E6D713A0AB26788", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679005, "uuid": "9f9c82ea-67dd-45eb-986a-858fc54e70f3", "value": "6144:uh0k5eq1h0k5eqnh0k5eO6h0k5eq7UZ+RwPONXoRjDhIcp0fDlavx+W26nA4W6r6:uykdykvykeykf4MYyqk5q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674679005, "uuid": "5cf6fed2-41a9-4f0d-be8e-513ff9f01306", "value": 479744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674679005, "uuid": "bbf16568-b9c6-434f-89d9-d52a3cdaa064", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679005, "uuid": "473c829d-567b-4e81-a56d-a68d29bac9e1", "value": "1105-2022 .xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa591b2-9cfd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674684855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684855, "uuid": "b16b585e-fe04-4c0d-92cf-cbe2892cd659", "comment": "Malware payload", "value": "77fa2f927c5cb06a10d52f8b7d9e1b9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684855, "uuid": "d3e8d351-4308-4d26-a08e-ebdf1cb84cb1", "comment": "Malware payload", "value": "110e47aaeaea6592c8976ca151de6c0239befb9f77e8be152f53de18d72c55b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684855, "uuid": "cde98ee3-569b-469c-af20-fcdc7d03bac0", "comment": "Malware payload", "value": "f2892fca22a0bc14722bfb8e232da11a01335a0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684855, "uuid": "d0f6f049-0233-4b15-a3bb-7ad263988591", "comment": "Malware payload", "value": "a43b2061b131381eeb0ba1f8738e3cce3c826e250fb2da506f83e0c104a22a2da37f369f48e33e2d645d25e355925cce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684855, "uuid": "d36950f1-b879-4ce4-afbe-79ef987fbdbf", "value": "T1EC84CE1275D06C60FD2A5536CD2ADBE4396EF9C28F3C735B32D8AA1F1C732E19522216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684855, "uuid": "a6c5e894-dcf0-43da-ada2-01499f72658d", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684855, "uuid": "d76c3abd-9db7-4f5d-aae2-8c1b97f70cff", "value": "6144:NQLlR6SUV+xVr293Awpgal4RgUJW1vERyBT0+MOKXA6fUT:NQnhzxZowKl4RgUJW+QWE6fUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674684855, "uuid": "d9170d26-d9e3-413f-8d09-fffff7ac4708", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674684855, "uuid": "5719cfdb-7481-4391-93eb-533fe5360be4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684855, "uuid": "5949e305-45df-4c55-b669-88868d5e23b3", "value": "77fa2f927c5cb06a10d52f8b7d9e1b9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227799ef-9c95-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674639986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639986, "uuid": "1367be06-30bf-402a-af35-3a161092089e", "comment": "Malware payload (RedLineStealer)", "value": "8e1817aad041490d07b28fa78665b641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639986, "uuid": "8c48455f-8cb6-4a1c-8681-118a94d01302", "comment": "Malware payload (RedLineStealer)", "value": "116934a7b29ac10fb8a050f5cbf37553d567c331d6fbdcadcac1fcc87c34c004", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639986, "uuid": "1b7d1f67-c827-4fd5-9f97-64c76aa0852a", "comment": "Malware payload (RedLineStealer)", "value": "a8f933b537abb932564f3097d21c94eb4468e39f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639986, "uuid": "d32532db-1a68-41cb-a882-6fbb3ac0eea6", "comment": "Malware payload (RedLineStealer)", "value": "2c0f17ac555ea9daf96c0d675c83d6cf7a4b1354498ed1536069c2efa94ea39c5b3e906784d034a87f89986b40fab3bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639986, "uuid": "11625a86-dc8d-418c-bd16-dadabafb42c3", "value": "T11C14E04C938D6F25D6A909BD90E326500372E07BAB63F36E5C4D4576AF03BD50A82F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639986, "uuid": "3e1afa93-358b-4ae2-b387-bca2e26c1019", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639986, "uuid": "97ed567a-b7b8-43b3-a4da-a39c2aa51733", "value": "3072:0x8rd4nkHb203utzBjcZIvwghOxfgdp/tMxu6ySA7JtvtYJW/Ggkgjdqn:3SkHb2tBQ++AMNySItlY4ijn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674639986, "uuid": "59a4f64d-fac3-45a4-9779-9ecd21143872", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674639986, "uuid": "7c768cb9-1383-467c-a817-b5386b2a2859", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639986, "uuid": "ebe17da3-b0cb-4b23-816d-e5ef99e3bd70", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfcf2d1-9cd6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674668026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668026, "uuid": "126ff9f0-a83e-496f-afa1-bdaadb0459d8", "comment": "Malware payload (Gafgyt)", "value": "51f80272e448fb116dbbe45fb822af4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668026, "uuid": "64b0d01d-ba96-4a65-b3ac-96a2b2196d57", "comment": "Malware payload (Gafgyt)", "value": "1199e318f4d6fccbda523358c6b12add7ace5b0b219cb96bd90f23efa4ef7535", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668026, "uuid": "95319dac-b0de-410b-908f-bb42f7b36861", "comment": "Malware payload (Gafgyt)", "value": "c4d8871c2990de0a652d9c7a43146636db428308", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668026, "uuid": "fa714761-389e-4881-80e1-4b4cdbde9d68", "comment": "Malware payload (Gafgyt)", "value": "3526448c62125fe697e6c5c566fea4bf2aad6438c087f35a42617d275677fb434fe99f3b3a91ac63492a71962b28dd68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668026, "uuid": "2ce8dfe0-bca9-4c5a-8d72-697d15bff094", "value": "T183931A41F9408B27C2D227BBE78F439D37366A54A7D7330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668026, "uuid": "25a50de7-d41c-4660-8451-41e34155fad9", "value": "1536:EIkg9VQPAWeMTEb82Mm3xDKMsF0rOLcvWNPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQaMTDWWFGWNPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668026, "uuid": "00da361e-57cd-46ce-8e0e-41485b85abc6", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668026, "uuid": "68a14cd4-2a6d-44e9-b266-a9924dfc5236", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668026, "uuid": "89530b97-6924-4368-acc4-46a3021394ca", "value": "51f80272e448fb116dbbe45fb822af4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ddcc2b-9c74-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674625851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674625851, "uuid": "b2632553-8f69-4727-a04e-a4562e565bd9", "comment": "Malware payload (Smoke Loader)", "value": "5e941f07ebe595f4eb47faa71b4c56cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674625851, "uuid": "5954c83b-3b62-4943-ae25-cbd847a786ec", "comment": "Malware payload (Smoke Loader)", "value": "12aa30ce1c4222c8be57438c93b154f7e23b668740ecd54a1872a41b645f7ac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674625851, "uuid": "e5cdde0b-b162-4b03-b619-e11afc102000", "comment": "Malware payload (Smoke Loader)", "value": "a0955921bc1963c776615761bae7d5eb044c479c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674625851, "uuid": "4ad73c5d-69c3-46a4-af6e-2770493652ca", "comment": "Malware payload (Smoke Loader)", "value": "2ac540103bf94ab79d79541199a24afed2d5033795bcc7a1119a7917fd2a8df3085d77979c19ff5eff0d671364399afb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674625851, "uuid": "8490c292-90dc-424d-9c92-d9bfd1c71bfe", "value": "T192747D01E2E8BE91F499CA318D1EA7DC763EFD505E142626322D7A3F29701E1C13A76D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674625851, "uuid": "3f3b9896-759c-465e-b165-a9db4e89527a", "value": "861af707b319724b1132a7a971c54bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674625851, "uuid": "6bc8231d-23ec-4c6f-ba68-4aebab9bb7b4", "value": "6144:adzLqf2PfnGKPkTTH5IJ5jq7VWRFBMolz90nr4:aBe2PvfkTr517VWR5lzaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674625851, "uuid": "12f75322-50a5-4ca2-a29c-64a187914318", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674625851, "uuid": "678fdfbb-2bf5-41fd-b6c5-c9241c6cfbeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674625851, "uuid": "0e1208eb-1d61-41aa-a1c7-b68268e26713", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0641b9-9cfd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674684941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684941, "uuid": "16193ca2-2e6c-4fec-bb73-6f70d4a81c94", "comment": "Malware payload", "value": "61478500c021e4f68f977838797a5c42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684941, "uuid": "ade21ebb-1e18-4131-8a8e-79f10b6680ef", "comment": "Malware payload", "value": "12c2017ec0d376d417567b498d091679e5b151d60a62a6085d328331df124f96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684941, "uuid": "fdbaec56-11f3-4a7b-9971-9c698b185de4", "comment": "Malware payload", "value": "22c04d586ba5dd60b3f9b21da01ea74c44a1dd3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684941, "uuid": "0a3cc449-dffc-4561-b7e4-ffa0f9e31f19", "comment": "Malware payload", "value": "31025458ee7b0180a4e9a53d89f90dfd0a53183481d5f204716e7a8c942bef224cf81a1ea2b3f977adcf28543808d6d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684941, "uuid": "9c055430-012f-447b-bfcf-641270ec37c7", "value": "T1C264BF2675D0A863F91A0A36CD2ADBD4792DF8D38F3C735733C4E61F28722A0E566215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684941, "uuid": "1ed5e4b0-1330-4bd4-9ebd-4f7984caa691", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684941, "uuid": "4eb61241-874a-4993-8653-7de351a8ce88", "value": "3072:cMcpdELonMK4YgfLReTHQRPZ8JWhWeeIFL9bvjL6g0+L4Oi/XcLYHfHQafUT:ICLRK4YT0pZ8IMaFtL6g0+MOKXp3fUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674684941, "uuid": "0a13261d-fa8e-42a9-a64d-4f4cefbe6a38", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674684941, "uuid": "22190912-fede-45a1-9a6b-9ed8857654f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684941, "uuid": "15f8ac7f-89b9-43c8-b428-061506dc5c74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f3cfd2-9c94-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674639642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639642, "uuid": "7af0ad85-8de9-4127-af8d-c9d367b835f3", "comment": "Malware payload (njrat)", "value": "bfb9595d41e726e7f998b787fde15fd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639642, "uuid": "61aa74d7-c758-405f-9b3b-adfb65685330", "comment": "Malware payload (njrat)", "value": "12fd0e3e4e6aad3b58924c8c7cdf9a8d5e2fba3624f679f32f9a0231d8a23a62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639642, "uuid": "e2bbb8eb-4101-4a2d-9015-7c7b3d04d835", "comment": "Malware payload (njrat)", "value": "eebad9fbff85ee5196519f23e618d3338337ac59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639642, "uuid": "04147c6c-dab1-4c53-a582-923b32cbbaa0", "comment": "Malware payload (njrat)", "value": "36e5fc857fd77b6c0bb6ff0ac4f2dc5436b734dbb9d2ecf916589828fcc3a2984ca3c8cf85a10bad6c137a9ef8927ad7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639642, "uuid": "e9fa85a7-e7c4-4161-94f7-42491a41b57d", "value": "T13F13E78CB784E175D5FF8BF1B492B2890B71A017A902930F99F154D98FB3AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639642, "uuid": "acdf2310-3665-470d-9f28-a02b71e93dcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639642, "uuid": "b862534b-3141-474d-8f9b-ff9d707c6431", "value": "384:MZySi5ctOnwtOyW6Z/gc2iEwPmAMcCb2IDa9D9O5UE5QzwBlpJNakkjh/TzF7pWJ:qqqAwt/W6dgc2iEweQCbpvQO+UD+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674639642, "uuid": "af961899-9f6f-48a2-9385-06c5f1fa031e", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674639642, "uuid": "f43cdf30-1df2-4f8d-a54c-55e8aed9b882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639642, "uuid": "fbc99c70-bd27-4ce0-8cec-bc3d402b6fab", "value": "bfb9595d41e726e7f998b787fde15fd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad30894b-9c45-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674605859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605859, "uuid": "8b45dfdf-4101-484d-afbf-7ab034c3b0d8", "comment": "Malware payload (AgentTesla)", "value": "26402c195f6e5faddee7ea4bdea570ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605859, "uuid": "90c5be84-fc6d-44af-bc84-b0d1678e5254", "comment": "Malware payload (AgentTesla)", "value": "13ce2a2475f885bdfb92a435b03175972bb84b1efecba3fac3339105ab9c62a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605859, "uuid": "606becc7-9be0-439c-afff-51dcd7bdeb8d", "comment": "Malware payload (AgentTesla)", "value": "b8bc8d25283e790562fc664d664c722a3bea9016", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605859, "uuid": "e4d7dc49-6226-4351-bf9a-9c38941e5088", "comment": "Malware payload (AgentTesla)", "value": "4af874bc8db7c4c72656b938fafcb2b910a3d780e2ae94d763cf2de23e5642fd3446cffb006c37322a0941476efaf595", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605859, "uuid": "36762686-6ecd-4fd0-bdac-35c8b0e1e609", "value": "T1E3157C557191C6D5ECB14E7802B8F9242789DE57A32D41AE7EC7343A88F378B88643E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605859, "uuid": "fbb312a8-fabd-41a1-aead-eee1559235b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605859, "uuid": "c04bdfe3-a1f2-4de0-9900-bb626108a654", "value": "12288:6OZOBEnJFilzPwN5Sea/11nPmvEEsMj9Wuc39D5aAPS6JGBeo7g:P8BEjOPw3SXbmfsMj9WZAAq60Beo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674605859, "uuid": "2ee720f8-2628-4932-907f-57289e13e482", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674605859, "uuid": "c3c1aa51-26e0-4a83-97fe-796237bf1a5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605859, "uuid": "a95b4141-4136-4495-a5db-ce11fa8529c9", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b827c2-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674678671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678671, "uuid": "18d13e4b-6834-4c4e-80e0-b99c49b00583", "comment": "Malware payload (Smoke Loader)", "value": "6c3bf0ff8d423fb579197d62477fa193", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678671, "uuid": "6f4d026d-e750-4d2b-b275-2626bf89cadb", "comment": "Malware payload (Smoke Loader)", "value": "13ef48752f718076ea729b6e4ce3f130bfdd8ee9496b8803c2177561b3f1f4c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678671, "uuid": "b5355bbd-34dd-4e1d-9396-e694d5ade145", "comment": "Malware payload (Smoke Loader)", "value": "ba4f11a97af719f93325dbe8594cda2b74ae3780", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678671, "uuid": "f9767998-d4ea-47a2-85d7-66ec88aca6be", "comment": "Malware payload (Smoke Loader)", "value": "46dc48ecd6fb7c83f2e9a70ee2b60f4d8ca2dcfb1604e90076426f984ff367a275cb526a23d9e234452f4bc3ce703de8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678671, "uuid": "e602b51d-b937-4f59-b463-afd59a7a3f2e", "value": "T1B364B02276D0B850EB164A76CD2BDBD4392EF8D28F3C736732C4A61F29732B1C566215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678671, "uuid": "6fa480f4-a071-4f09-ac03-7b361b0ec19a", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678671, "uuid": "ca768b99-f38d-4d98-a9c2-19a3d1092b89", "value": "6144:6lL39F0bFzzOcIw9D/wodfg0+MOKXZWdUTV:6lZFeFOKD/MWdeUTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678671, "uuid": "63e83510-fef4-49d3-9385-ae42413c0b1f", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678671, "uuid": "ae097fd2-07cb-4ea1-b6a3-fa8d4ac3a57a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678671, "uuid": "566df052-8e9c-4bfd-b288-9e3cbf12b861", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4827725b-9c49-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674607407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607407, "uuid": "fdcd1159-0309-4158-88f0-dcc0d8cb0f98", "comment": "Malware payload (Mirai)", "value": "98ceaf936a88b2c7dc511a488eb3144d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607407, "uuid": "d8a0f12a-eb1f-4fad-be53-9984312fb718", "comment": "Malware payload (Mirai)", "value": "140f45c2de25585076951809bb3f085446698a1df51676b4474390e85d0ad8d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607407, "uuid": "8d923d4e-364e-4fc3-ad1c-a54dfceb8155", "comment": "Malware payload (Mirai)", "value": "562bd1c52afcd2218a446197c383f2e39455ddc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607407, "uuid": "70b88403-8097-45bf-a288-3b6c4b4b0f4d", "comment": "Malware payload (Mirai)", "value": "68b7c5a30875c2a8d5a2fbc046c10df83d3fa1a8bd04456567f963fc7c580345ffc7a747bcdeb091e8fc9f0865872b47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607407, "uuid": "1c07c5ea-4ae2-42bf-9159-75bbe88d57f8", "value": "T1D9C33B86FB404B27C0D52779BA9F42863322D755A3DB33069518AFB43FC2B6E5E63502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607407, "uuid": "cdc6ae85-962c-4ce5-b0a2-149b76b1ec9d", "value": "1536:oRnlGVCUtYr2X3S5sGocvtSU/ePzv7tdlxJiW3KGmEWvaiCDA+zw/9eciPzj55:ZCIYwi5DpSU/ePzfp3K5NarDxM/9WP/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674607407, "uuid": "8b9709e7-48d5-45d4-a697-38e2707d1801", "value": 123473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674607407, "uuid": "475f6554-e7d9-42fe-9d8a-46f6a93f0db8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607407, "uuid": "af706c6c-06ea-4957-861f-410d9cd86d95", "value": "98ceaf936a88b2c7dc511a488eb3144d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ebeddb-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674678673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678673, "uuid": "6adf1393-7ce2-4fe8-8c7a-976c193ef26d", "comment": "Malware payload (SnakeKeylogger)", "value": "6d99d0a76ab5272459d6ee6bb8b409b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678673, "uuid": "ea9ebefd-3688-4ddd-9dc3-2886ff714955", "comment": "Malware payload (SnakeKeylogger)", "value": "147c29adbf122889096027028d540086a6169b75253174383d4424d66e364a12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678673, "uuid": "7c04e0db-fa1f-449e-a33a-82fada32a6e1", "comment": "Malware payload (SnakeKeylogger)", "value": "91114e9caa1138ceb9879831c05ddf0885a56beb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678673, "uuid": "2baf9d29-aa08-4b63-86b9-fd18914d6c93", "comment": "Malware payload (SnakeKeylogger)", "value": "bb91f9b7c5a3b6304c19bca7929df6d99de09f545746d6b802d20de19307333334c2de0d89a1cf66c8cb01a4c9a43d6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678673, "uuid": "7f34c037-bfc5-4c26-b4c1-66aabb38fdf2", "value": "T1CDA4D063A142DDA6C585493D46B4FBAC826CCF621E5BB28971793222EE73C072F0CDD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678673, "uuid": "7efc2b4e-5a07-453f-b069-6f89557b24bf", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678673, "uuid": "44cec6c1-8f52-48e4-93ca-b5c430317ced", "value": "12288:yYRmJxRHHE6mRsc9gC8NLhPtD/fJomIA1lPUfro7jKlrtaKlwPR:yYNO/fJHlMfrE2KfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678673, "uuid": "6f7b04db-8832-4848-b329-eb814b0a2786", "value": 484456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678673, "uuid": "b949c702-2c96-4acf-abcf-2157309445ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678673, "uuid": "ad58c6c0-2d7f-4fb3-8992-d8a37a8f5560", "value": "hesaphareketi-0.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8b85f0-9cf6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674682014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682014, "uuid": "16c29fdf-db30-43b3-9738-94bff68488c5", "comment": "Malware payload", "value": "21ea20b8468dcd98280d3487980301f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682014, "uuid": "61624fda-0353-4324-a3ce-3d92e436164f", "comment": "Malware payload", "value": "1582570447dbffc963c07e99b9b723c399042e5ff352c9dc54823d31a026ab6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682014, "uuid": "80a725a7-9c63-4758-89e3-eec650617fa3", "comment": "Malware payload", "value": "796c9d70a708f630126bd2c66b8c33b68c12604e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682014, "uuid": "b61fc079-c70e-451b-87cb-e94a8e65a7dd", "comment": "Malware payload", "value": "75be62a7fddd6e5be1383b3341a4b9c9511045a4d98e1fcbaae70070eb6f759c384cbb06035e36077bd8183084d8c788", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682014, "uuid": "2176cac4-ad6a-42e6-af9c-9ad1039af31e", "value": "T19776332A35A09D7BE1909133C86A5ED5E1D783258B234CB7138E4BBA7B7D0A0D335F94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682014, "uuid": "9478e5f9-a13f-43e6-9630-dc4e6b93e4b4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682014, "uuid": "21f2278c-a4e0-4f9e-86ff-d06b95cd4880", "value": "196608:91OzRd1Zf7jb3QHh1R0EohFPFiYfjg8TSn9/xWkCKd9I7Xi:3O5dQHvGTpTf/2txWeUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674682014, "uuid": "92a40f51-e1c2-42ea-8a76-8ba14cf25195", "value": 7632708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674682014, "uuid": "9120cd68-14fb-490c-86ff-17fa0ff882c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682014, "uuid": "5fbcf767-b3b5-48d3-a56a-281075693641", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "572df15b-9c86-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674633632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633632, "uuid": "b523a73f-15ce-4c5a-b80d-235262bb678e", "comment": "Malware payload (AgentTesla)", "value": "a38712e3f26d2eb21c9983e2593be008", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633632, "uuid": "73635320-b737-4d8f-81f8-0250ca78d15f", "comment": "Malware payload (AgentTesla)", "value": "15f19567c38f8fbcb6558534d190dee7a640a4a0f5d600acd490df87f543761e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633632, "uuid": "4b5eb4e2-e2b6-450c-a66a-0d80faf58ee5", "comment": "Malware payload (AgentTesla)", "value": "b39f685b85d242458e54e41f0e51a951a049b650", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633632, "uuid": "3832487b-1e12-4316-8710-275d5048fa61", "comment": "Malware payload (AgentTesla)", "value": "774fd9a27895f5eccd78ba05c391b61461aa3a834c1d98f90d5b5a8fe2353a6e26ef5064ec2702cb70b74520aa56e326", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633632, "uuid": "cc8a65aa-2efd-4b2c-98fe-0b639d74fa30", "value": "T12845AFBD7B5BDD22C0285677C1C7950013B09A62A223DB9B3BCE11A51702BEF5D897CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633632, "uuid": "c9b71255-f668-4bd5-9159-407b99324ce7", "value": "12288:RiRpPsdFZd2r35wVWg7FbrFu7JyNbU2/O+cYg:uiBdY3yhdFu7OP2+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674633632, "uuid": "058292b5-3f65-4457-8203-3575e7fae690", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674633632, "uuid": "b7a937c3-9276-45b3-95e9-d32e7b00cf07", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633632, "uuid": "534d5002-ae83-4b05-9eb7-d5601814d5b6", "value": "Pagamento01242023.jpg.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf38622-9cfa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1674683409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674683409, "uuid": "6dded48f-8c26-4c41-b183-408d97b95869", "comment": "Malware payload (RaccoonStealer)", "value": "7c3f572e750e5a1030f8df1c695d6149", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674683409, "uuid": "2bcc7b0e-ec38-4dc6-ba04-5a12a4ed5e65", "comment": "Malware payload (RaccoonStealer)", "value": "162490faff9602b5fdad6aa9f94475dc7ffad2b9e5eae1d9e7ea894bfd590eea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674683409, "uuid": "1e09e5cc-ff88-4e73-be35-76d6f27e28f5", "comment": "Malware payload (RaccoonStealer)", "value": "b6ef5eee0ad4dd06389dcfb4db5f6fc61feaa18c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674683409, "uuid": "6a0bcb82-9cdf-4c07-a800-dbc08f57d502", "comment": "Malware payload (RaccoonStealer)", "value": "e868ec920ff53f190a907e7a54f11f133a18dcc6c865f9bc3db6684c24ec167c149851dbd2618c30dac16a7476f19e23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674683409, "uuid": "f55bc44f-82e3-40e5-9496-02dbe8776220", "value": "T1D396F172693C1277E6BAA8359113F9B821E23E45BAD0D43CB2E37771C6B131D0157AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674683409, "uuid": "6a7c0a62-7369-4d75-a145-be6672ce4843", "value": "9f95eae0e562cdd8c0f94b7ddd3234c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674683409, "uuid": "b191bed4-afc3-439d-9ad6-9ab0ccefab4b", "value": "98304:BO9jJ6V9sYsPY/pzmhFfQZN3KrBy++7cO5AMemZ0Eq1Ugo3K0E8sZ0U2hVIao++1:AlAAYsNhFssoHIO5AgZs150jsZ0ZIx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674683409, "uuid": "dc699191-ce43-4179-9663-978f83de2628", "value": 9108410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674683409, "uuid": "a879ea50-f072-41ee-84f5-599468d467c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674683409, "uuid": "8b8275d5-b26a-4f94-a390-b2c944b79882", "value": "S\u0435tup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b010bf-9c5c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1674615699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674615699, "uuid": "b942ef28-1e06-4965-94f6-478f924e5ef1", "comment": "Malware payload (Rhadamanthys)", "value": "0617800237b3e1b52c7cfb8192a6cb3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674615699, "uuid": "b298895e-fce2-4fba-931a-6d5cecc7ddd3", "comment": "Malware payload (Rhadamanthys)", "value": "172e91d25ee7d9a15918f905332d0e7cc6188e302d54a07eecb37dd1acc84cee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674615699, "uuid": "0f268daf-74b3-4f8b-9cc6-a5824a3d1df2", "comment": "Malware payload (Rhadamanthys)", "value": "2e5e1e11ff79babcb882bba23a4363b2d6399c06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674615699, "uuid": "4d4ac6cc-7f0b-40c4-90b7-6a65f3410438", "comment": "Malware payload (Rhadamanthys)", "value": "4280c4f9fdfa8293a6a2d52c3deeac330028c2c86b8dc1cdd5b6ddb8180b6abfea02ae4347e12903b3eebaca3e35cf0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674615699, "uuid": "5be5222c-771b-474a-b5ab-2189e75c1e90", "value": "T1E914DF3279A0C032C59615391C70EBCDAE7AF93146A9885B3B580F7E6F707D1663A34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674615699, "uuid": "51a16ad4-a265-4ff9-9f4b-b929ca3c5a72", "value": "5eb8e9ebd49d9ccce156e2e9eb6d0902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674615699, "uuid": "cedd9acd-78bd-4c88-9a88-14e5a7bfd851", "value": "3072:YLBN2S4RPhLVNPbljA5rnTpXola9qJ9I6GMqh+5S:Y1iLLDljoFX+a8ZGOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674615699, "uuid": "73de6b10-6af7-4b06-80b9-acf6986aaf2e", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674615699, "uuid": "09f763b2-2bba-4c08-9855-c5cc475dad7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674615699, "uuid": "a2407c47-d472-434e-9d8d-91de128e2288", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9cdba4-9cd1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674665746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665746, "uuid": "f8b3ad50-d6d3-472a-b237-b29855135bd0", "comment": "Malware payload (RedLineStealer)", "value": "f119fe10ab6aa94d3abbce77a5fc79ce", "object_relation": "md5", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-adobe", "colour": "#1B236C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665746, "uuid": "dccc7116-6291-4f51-a839-49d26e9d8076", "comment": "Malware payload (RedLineStealer)", "value": "1742c56ca409a77277b71cf22e8b558e546bef7909c55dc75ca1485bf636ff33", "object_relation": "sha256", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-adobe", "colour": "#1B236C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665746, "uuid": "d8bf2b42-b6ba-4ca7-850d-cca65d81534c", "comment": "Malware payload (RedLineStealer)", "value": "2f1e0517168500da8adbd42998693030a5fc50d5", "object_relation": "sha1", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-adobe", "colour": "#1B236C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665746, "uuid": "8f97f39c-70d0-4a0e-87c0-45c981f5d1d9", "comment": "Malware payload (RedLineStealer)", "value": "bc1b3d74e74d681888a30cab3cc167a2d09741029f53b467798d65542d63708321987cc54698f963da0744af05b34688", "object_relation": "sha3-384", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-adobe", "colour": "#1B236C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665746, "uuid": "8bbb049f-76ae-4ee3-afab-99d21b3b771f", "value": "T11AF433100776D179068008FB5A7BA7E2FCB6B00BD5B2C6AD346D5BF6BE7930E4B29045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665746, "uuid": "99aade4a-fc2c-43f8-81e2-43dc6dc92eed", "value": "12288:Xj4PH0v2UYcK7DqeqgapymQl5jWqG5H1qnFHaCGMzuyhijKZHDWnI5dNs74:Xdv2UYc4qMxHjWqgEnF6C0yhiWZHh9+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674665746, "uuid": "ed5b4f7d-4b29-4c17-845f-0c661cbf20d0", "value": 772579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674665746, "uuid": "90a3ee47-0702-4edc-a2cc-966c18697e96", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665746, "uuid": "84206290-2e78-4c30-99f0-533dea180ece", "value": "AdobeInDesign.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa51bb74-9cda-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1674669849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674669849, "uuid": "67e3467a-5155-4dce-9044-3f18e906ac1a", "comment": "Malware payload (IcedID)", "value": "0f9d853f54ed0d1a800051ec718f16db", "object_relation": "md5", "Tag": [ { "name": "2546188793", "colour": "#0EF98D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674669849, "uuid": "622f17b7-cfbe-4093-b9b3-84c03c797ec1", "comment": "Malware payload (IcedID)", "value": "18ff52ee24dbdf6593324b52250115b6c5314e159b681a3a437e3b163d3bf6ab", "object_relation": "sha256", "Tag": [ { "name": "2546188793", "colour": "#0EF98D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674669849, "uuid": "04ee9ec0-e46c-4023-8677-9d4e45cebf4d", "comment": "Malware payload (IcedID)", "value": "a12bd8f8edff0743e92119527673c91d2d0888e0", "object_relation": "sha1", "Tag": [ { "name": "2546188793", "colour": "#0EF98D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674669849, "uuid": "3da9eba3-871a-4cd6-b14a-0c085b08a6d2", "comment": "Malware payload (IcedID)", "value": "71e8bf529129cd5cd07dcc517b5f98f520aaf7b82020b3d66b11c095949924bd3874abe89dfdc442817c627861d96c35", "object_relation": "sha3-384", "Tag": [ { "name": "2546188793", "colour": "#0EF98D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674669849, "uuid": "ebb0127f-a29a-4a4b-a7f5-24de79d53d08", "value": "T17C658D57A3A542A4C2ABC23DC65B8B07E6B1700503319BCF01698E593F63BE3277E756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674669849, "uuid": "586cbb29-0938-4d80-8503-aa2e4d409926", "value": "c06ad75dce0e6d9df61a58f133ad8cb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674669849, "uuid": "cff54cf1-ff93-406b-93a3-8029fafc23bc", "value": "24576:mTfaPo9UzJSUrZMrZjY57tj2OM8SC/XPt8JGfZb3GW2:8fKo9uJSUrZgwtc8SC/uJGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674669849, "uuid": "fa54cafc-be80-48eb-9149-c1d2434d7574", "value": 1485944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674669849, "uuid": "75098d7c-5d1e-40e5-9cec-0dc13d7f2b28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674669849, "uuid": "a7079937-07d3-4452-a50d-5ec07c719a7d", "value": "desktop.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b756d34d-9c4b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674608453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608453, "uuid": "58a8d1e2-ff22-4cb6-a066-0fe0ee3eab63", "comment": "Malware payload", "value": "090bd26a161baa81ecde4b1ea903c014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608453, "uuid": "b58c423e-90da-4fb1-9713-6d687aaf44ef", "comment": "Malware payload", "value": "195db40ab22909e05edd8691cf608a80b66f87cb7d578ad8d07e82e90d3406eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608453, "uuid": "14394256-6d91-42a9-8828-03c4140e64f6", "comment": "Malware payload", "value": "f9dfdba124d1ebb8b7edca37426a6e189354da6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608453, "uuid": "89689180-58f5-4f69-9dd3-658a9294365c", "comment": "Malware payload", "value": "efb4e954f6608806df9d860e2ade111b16ac9934095045d917c607f8ffd027e47814a97d1d3c2d70120e1e0417dbd834", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608453, "uuid": "a7e3f9b7-359a-47f4-8fc1-879e99e58dcb", "value": "T10864129066E1D097DD7341717EBF01F6BAE99F1D71048E0B27201EA93927681A64F3F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608453, "uuid": "0d36c3e0-5967-44a1-9bef-f98b5f599a6a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608453, "uuid": "3ec54c4e-c5c0-4b99-a282-b4a33c9f80b2", "value": "6144:/Ya6k9s8ojywOGFfckmRe7ZAekFgV4JiLRyTzt9o3XQP8ME3GSYc/98AWBkqzJjf:/Ya9aNOC0kQJgbyPncC8ME3sLNzJjEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674608453, "uuid": "89cc3230-918b-4ab9-b42e-8315f448e377", "value": 309833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674608453, "uuid": "52dbad10-152e-4267-bffd-db5993191c45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608453, "uuid": "603dcbe1-08d9-438a-8d6b-da44c137bc95", "value": "Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a2f212-9d09-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674690049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690049, "uuid": "6275bcdf-8ec8-4535-a2f9-ad9e98a0a8d6", "comment": "Malware payload", "value": "0472a6dbde8b9111f0419fe4985d5a12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690049, "uuid": "61a87efe-4a4d-4ae2-ba2b-edef154892d9", "comment": "Malware payload", "value": "1aed4467199b979cbd3db16a8fe43bc77a2018d37b991a1082dfd979bf807565", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690049, "uuid": "6b3a0c0d-db2e-48ac-9754-4436470a4df5", "comment": "Malware payload", "value": "7c73b828e849f8fccc2bad2da8c2118097ea4cde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690049, "uuid": "a034c069-a5b8-46e8-91b1-1556a769b2d1", "comment": "Malware payload", "value": "de7f803d0d6b58a28cddbba7276d3899c3cf4c81a5d65f50bbf2a7d8c9fbbd1badedea4215560a1dfd307e3498f55b63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690049, "uuid": "e5e2ac90-a684-4dbc-bb05-d4dd6785a78c", "value": "T16E64AE2175D0E850ED3A4A35CE19DBD4392EF8D28F3C735B32D4AA1FAD732A1C926215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690049, "uuid": "70316ec4-3ca9-4131-8fca-56dbd685664e", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690049, "uuid": "b2c85d97-9336-4bb9-95fc-72396dcc6579", "value": "3072:Oscy2JLYnlEumvfLRtOW5WScv1nJrseqz13WytZs5dg0+L4Oi/XcLYINeSUT:ZsL0EummWwvBJCWQ+dg0+MOKXIUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674690049, "uuid": "ac8eb7fd-3fd8-4d9e-853c-cf458deb7d47", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674690049, "uuid": "165c039b-51db-4cc9-8735-6e851b490024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690049, "uuid": "bf050f93-d52b-4dfe-b77a-2bbce3c42410", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ba87ed-9cc8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674661969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661969, "uuid": "830083bc-aed1-41f9-a202-22044bd18d76", "comment": "Malware payload", "value": "b78d7697eb0144fd7e5918942716c9c9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661969, "uuid": "fda41171-1916-4046-b627-a5856a510d70", "comment": "Malware payload", "value": "1b1aa08061f3e879248ffbacec5020b930c90ab08ce1b29544141423efe52e1f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661969, "uuid": "9c4ea2c6-a9d7-407e-9ca2-6bde9a3022f9", "comment": "Malware payload", "value": "839b16682067a4b092e1092025fed510a16c80ab", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661969, "uuid": "c3070867-1151-4a6a-8793-28bb4e04bcef", "comment": "Malware payload", "value": "b927b60980d2c57e1c0a3b34a4e868a47b0ffa6958c7a5508365a6864568c821ee65e3913ec022316850fe2c51a0f75d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661969, "uuid": "84d80eef-0542-4f90-b554-5fb395d31618", "value": "T188A58C227986C632EA7F4330252ADB7B21F97EE0377344DB63C8992E0E715C14276E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661969, "uuid": "1ff60736-1f14-4e25-a9d9-39cc82ac5dc5", "value": "49152:JlYYdMV3eVougTzAsPsJ6ma8zotlmfwrgxMy+y29IAan6Drt4vLNgmUESIEjPMNy:EYdMV39xA6Afwrty24veHjPMNa+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674661969, "uuid": "8f0b8adb-205b-4437-b681-0f05f543af8b", "value": 2258432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674661969, "uuid": "4b3bcdb0-a6f0-41fb-b16e-63cc60c5ed4b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661969, "uuid": "47804172-e2ef-4e4d-9e47-1d317c96f9d1", "value": "Rufus_setup_3.21.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a36c9b-9c43-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674604900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674604900, "uuid": "2b453b53-6cc7-47b9-8d30-ced9504df42f", "comment": "Malware payload (GCleaner)", "value": "dc3d5a4b4684a4e10475343d9c8f3570", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674604900, "uuid": "6640ecfe-eb51-4583-86fa-b0ab8667edff", "comment": "Malware payload (GCleaner)", "value": "1b3583c9130908bbae5af7b5ed7234b089aa954cbd719ae1ddfbf1e561f06e58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674604900, "uuid": "a98ed7c7-ca2f-40eb-aa51-a516ae4876b5", "comment": "Malware payload (GCleaner)", "value": "ae7e02b162cc74889d56890b91bd51fd50514f8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674604900, "uuid": "1c88b8e9-44ce-4d9d-842f-fb89dc6cebbb", "comment": "Malware payload (GCleaner)", "value": "62886d48ceaa3968c4aee353a9d2dd21f96c6fab2b932f10be9d76918d431b45b0b87bfaab54bbda8e4c1fa68bcaa183", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674604900, "uuid": "acae2d1d-e042-4e3c-ae1e-3f05f22fef3c", "value": "T14685334FA8264074F371DE3826A6DB54D9FE3B332834E201394D379F3A5266AD41E297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674604900, "uuid": "ab04eca2-4ec1-4745-99c7-5bbcf05f26e1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674604900, "uuid": "860c431a-77f3-42b9-8d54-4f1bfca95b12", "value": "49152:Zxk3TGrcwYmAsrCLGTiEyJgPmLuS1C8RFU6Qj1yYUqR88LCgv2MR:I1EiEyyUCmU62yYf88v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674604900, "uuid": "339f03e2-743e-4d4f-809e-f327d6e726da", "value": 1788404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674604900, "uuid": "2d01be3b-f331-4c56-9b75-2661b2b29781", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674604900, "uuid": "3e5120e7-5e67-427b-b70d-ebcd6f17ac6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3accd03b-9cd7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1674668373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668373, "uuid": "c867d2d0-02c1-44ed-b3e0-a75570cbfd23", "comment": "Malware payload (AuroraStealer)", "value": "f3c011b55d32e48b420abf0c2525a44c", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668373, "uuid": "3900729a-a0db-4ce2-aa6c-554607a01064", "comment": "Malware payload (AuroraStealer)", "value": "1c8e9a2f5109f0f5215cc16926c8147a6136def1ed5759e508e2aefaf31410a6", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668373, "uuid": "bb6d2a5e-2bd1-4524-b58c-5a5dec77c881", "comment": "Malware payload (AuroraStealer)", "value": "a8a77c3f05dae1b8cbd0413e923dec8a06e4d55d", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668373, "uuid": "baf0ccaf-5e6d-4919-bbd7-293ba11c5214", "comment": "Malware payload (AuroraStealer)", "value": "526435ffd95977181261a6ae47483c15b3160b9beea1d7924a8e48543868acba33c199f43cd70302b1237ed9ca8c705a", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668373, "uuid": "0ab5d7b3-91cc-4d41-93c7-04eb32355916", "value": "T18C262847F89580F4C0AED230CA669256BA713C894B3063D73B65F3B82B77BD46A79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668373, "uuid": "37790c84-dec4-422d-9051-976a9da09d49", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668373, "uuid": "5399514f-d071-40b7-9f90-0e179c836ee2", "value": "49152:JBj9ybH3dYuRg6lJguwP4C2tq3lZ11tkWa45EHD+tGH5RDHW01k:4bHLRW4C2tOzEcGZRDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668373, "uuid": "1fdc4f9b-53b6-473e-9d0f-2dde31caf387", "value": 4694501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668373, "uuid": "eb7330e4-4c4a-4ca6-9954-0d389717ab43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668373, "uuid": "21ce8ac6-4df3-49d5-890e-d839e1f7633e", "value": "R2401.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867296d4-9ceb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1674677090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677090, "uuid": "6ec37ed2-ec49-49c6-a509-52c441b2b58d", "comment": "Malware payload (RemcosRAT)", "value": "d2fa9a3b74c8bef6f92fc95335b53f48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677090, "uuid": "0afda859-e119-43ac-8a98-1caacb573057", "comment": "Malware payload (RemcosRAT)", "value": "1d2f2d684eb25205c07a58d9268d0c69a6c506f9eb14e1473a39306aff9f5a1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677090, "uuid": "5d0a43eb-978f-4837-88d0-43fe8b643f68", "comment": "Malware payload (RemcosRAT)", "value": "23ab21fb9047b45577e29ef975b2766a03e8a88a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677090, "uuid": "0f541a3d-b5d4-4180-b5b7-035f03b32817", "comment": "Malware payload (RemcosRAT)", "value": "372147d0d29e761b8d63fc17dfd51f03ff1faa39ecab5e2052aad13426789b473caca66dd7f508e73965e3c76f6ae338", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677090, "uuid": "716f63c6-0d93-4945-89f1-9ada83929fde", "value": "T1C6F4CF0762AC9AB8F4E387314CAA86111A167C9B5E6CD34F50D532532E703A9B07F79F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677090, "uuid": "0167a55f-9d3d-4235-bc20-442f6f0023ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677090, "uuid": "f769325a-98ae-4762-94fe-9f367cd79f22", "value": "12288:l4j/qakHa5fb5I0Zk2DSf5pWI7nVoU9WPfvsubDuz5+aIclOhgL/i6CQKhTD+gvP:l4jSakHifbjZs5pWoRtua5Ljl9L/5SV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674677090, "uuid": "5793f898-9e69-4f89-a8c8-29e5166443a1", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674677090, "uuid": "266f1eb4-a022-4ebe-8ab6-393b22f6574a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677090, "uuid": "f2e6f7ca-38e2-4590-9b34-5e0bce82a070", "value": "Boletin_Fiscal_Caso_Proferido_Judicial_N\u00b0_5992842321..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7587f976-9c92-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674638836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638836, "uuid": "bf2ef8be-152e-470e-a5be-c5c69a01a0e9", "comment": "Malware payload (Mirai)", "value": "1ad01221d27cdc148b81dec9a9d3681d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638836, "uuid": "d1582bc3-2ee9-4d7a-90d9-8b544e396905", "comment": "Malware payload (Mirai)", "value": "1dd741652916702485a4c2f5629ad5451eae220a5a7501a219b3b2a97e5edbf9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638836, "uuid": "153b74c9-212d-4990-846c-cfa26fcc9dd2", "comment": "Malware payload (Mirai)", "value": "f99f28e0f3e9745cbfaf07433e075e03d860866e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638836, "uuid": "2ffcf68d-ddd2-41be-ae24-41ec1a7cb3ff", "comment": "Malware payload (Mirai)", "value": "dedc1213b89f504233183257e2d6ef090abf61731bfaec8e55f34fcb730001a35a015da1c8583c32951afcd15ab8cec4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638836, "uuid": "7094ff72-c31e-497a-b882-b1af1607d832", "value": "T1BB634B21B9792A27C4E1B57E22F78325B2F6270D25B8C61E7D220F4EFF106406653AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638836, "uuid": "6f789015-e540-4cee-98f3-e13e5ebfd9c1", "value": "1536:W9aF2HB4WmN5zC/WDSHHIUFy+g+OxLub04jA50c3t:Y64Q+HHtP/OxKbl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674638836, "uuid": "61e46964-924f-498b-9100-7dabf234036b", "value": 69464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674638836, "uuid": "0c88c45b-3d88-4378-af96-53976846e948", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638836, "uuid": "94a2ce08-223a-48a0-92d9-9b66f64746ec", "value": "1ad01221d27cdc148b81dec9a9d3681d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eea29aa-9c6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1674623417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623417, "uuid": "62cb8b3c-7b8b-48da-a38a-bd9b207753c7", "comment": "Malware payload (ArkeiStealer)", "value": "41aa262e5b2447167c224ecf5255b41a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623417, "uuid": "04346351-19c3-430d-b73d-7f229efc608a", "comment": "Malware payload (ArkeiStealer)", "value": "1e541865a04427fa9332909c5bc6a047a0e592e2bdb2b6fe94e48098f2ba4845", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623417, "uuid": "f71ad799-8fb7-4d58-ab0e-e2e5b3871bc0", "comment": "Malware payload (ArkeiStealer)", "value": "b02fba229e9f7f5ece049452e563c4447444ad97", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623417, "uuid": "ea7220bd-519d-46a0-8990-56322967c677", "comment": "Malware payload (ArkeiStealer)", "value": "9b92cf3e03a5215fdbe53940f6c098224765cf576fade231301b223810510f1c1d40dddd97d4bfc6d6a0e29699618f4b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623417, "uuid": "786e685e-f2e4-4ff3-9660-1cecc2324b4b", "value": "T1762633D266402EE6F8C952F2E2173F69C278FB29F24C16D719078A24DF4721137B62D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623417, "uuid": "6ff8e540-fee5-4900-bc62-48f935745ee2", "value": "98304:heV8deIsf1QMaFe3amUPsNNLf08KkOQXVS34dN+l6:rEIA1zHqmBNBsVkw34dN+l6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674623417, "uuid": "7e32ae89-24c6-47cb-8543-b6d50db84435", "value": 4645353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674623417, "uuid": "58e79438-25bb-40b6-8235-921f1e06084e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623417, "uuid": "31ef7737-2867-4328-ba76-5f792092948f", "value": "AdobeXD_activated_setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8ca650-9cee-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674678546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678546, "uuid": "ba41e28b-1c15-4834-a024-7c21fd5c0786", "comment": "Malware payload (SnakeKeylogger)", "value": "751397784c04320013d21af64afc94bf", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678546, "uuid": "66b80700-443d-4fc4-9a73-d379d647869e", "comment": "Malware payload (SnakeKeylogger)", "value": "1e6108492bc7de8e41b0442ae2e8d3186a06d9c2ba12cb7b85bd74c845785e36", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678546, "uuid": "4a81805c-13e7-4cfb-ab10-01f3616c25f8", "comment": "Malware payload (SnakeKeylogger)", "value": "9b12b71cd369abc4239d0f9116dcaa2b69c5b3cd", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678546, "uuid": "d7c26350-e8d0-4d0e-a51a-0df3effc54a2", "comment": "Malware payload (SnakeKeylogger)", "value": "55aded8e4339250277705c543ee38733fe0d8886552ab29a70a2d479fd1f8340f68b9434bb207ebf822b7f642a68a2de", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678546, "uuid": "dca6fd6d-fc44-474d-b12c-747bbb5a31a8", "value": "T109D33C1D27F89800E5FF9AB305B15122C775BC42192ACD0D4AD2F9592B3DAD48E1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678546, "uuid": "c6ea3bce-e71c-4a20-be22-c56de4a020f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678546, "uuid": "b36a3481-0948-4e41-ba9c-8cc144177c9c", "value": "1536:p0lr8Vcaz+vwiodRZTx+vBUFrlYY2jk93D5XUFPnrUMFOl5sK61ebrb/UVPlSUZB:p0lgVL6+RZN2jOYv0b8rdowBIU2FbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678546, "uuid": "2560fa5f-09ab-42ce-92c3-6c7481405580", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678546, "uuid": "d161ee5a-88cd-4ecc-9f98-21929bd4e61c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678546, "uuid": "3647f8fb-f939-4e5f-9a1d-19aa84884de0", "value": "NEWFILEoreno.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0efe2c6-9c82-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674632172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674632172, "uuid": "022fcc3d-56af-4289-a600-9a27e0103608", "comment": "Malware payload (Smoke Loader)", "value": "a3222cff30bf3a1faec326e1854ece66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674632172, "uuid": "56767ee2-9f36-4719-bb72-4199c2f2e716", "comment": "Malware payload (Smoke Loader)", "value": "1f4dcfa104fbccfb258673f88be7fc06df8bb50fcbf1062f0a1d7c968f9a9fff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674632172, "uuid": "85c6663c-a287-41e9-97f7-fee689811fb7", "comment": "Malware payload (Smoke Loader)", "value": "6f8e3a0e448166d9ff4f584af82324f475f5a2e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674632172, "uuid": "8f43ba31-2091-4680-a43d-37336ffc5d56", "comment": "Malware payload (Smoke Loader)", "value": "6437d3b4790769e9a0362297548c2bd549441e679263f834b5318e0191c53697851e6715ee2abc0622f80dcf9ac0942d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674632172, "uuid": "bc753c0a-7395-4987-8125-4711b204ac51", "value": "T108749E01D2A8BED0F499CA318D3EA7DD763EF9504E196226322D7A3F1D701E1C56A31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674632172, "uuid": "731329b3-63b2-4d85-82d9-109f05415327", "value": "861af707b319724b1132a7a971c54bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674632172, "uuid": "4f66ee38-3ba2-4dc4-b38d-86d0a675c35b", "value": "3072:oluRe7yLFAhNVvcGERLRn58GaW+Yuet2UZ2uS1C1Rjq7NokzSRFBMolk03zzS+Xx:4uzLFAbhq58h55vC3jq7VWRFBMolz90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674632172, "uuid": "803a8145-d4b2-4d7b-9258-abeec0ffa66a", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674632172, "uuid": "d38f6780-1b0a-4b29-9082-36020940a427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674632172, "uuid": "6695cac0-5a88-464a-8f25-510c0b6bf52e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82aa23ab-9ce1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674672789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674672789, "uuid": "7b96a8e7-72d6-400d-b0f9-1af141e9ef16", "comment": "Malware payload (AgentTesla)", "value": "cb8d3d57b808f08013ce23edddd0678d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674672789, "uuid": "11d538cd-4283-4f32-a0d0-12bb35166181", "comment": "Malware payload (AgentTesla)", "value": "1f5d9074ca3f0cb21ca2e31560ff93491a57ea74466b5ff5a6ac0d63774029c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674672789, "uuid": "d06822bf-ff63-440b-9851-c869aad968a7", "comment": "Malware payload (AgentTesla)", "value": "289f87d3993f71367859ba2fcd0dc6653100a7e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674672789, "uuid": "892c00c0-f0f4-4882-b340-51034eff041c", "comment": "Malware payload (AgentTesla)", "value": "9bf14da3ecd1a38a2121a68d08e6203aa6d32c63da484e9cfc75f3d673896da7cfb99df1d8b49623189e6519ef7072f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674672789, "uuid": "5fba9776-a18f-48d4-b54c-71495d90788d", "value": "T17E05019C22D34F51EBB7CB3DD0E2921153B5F7166673E30A258812E89D13292FE85BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674672789, "uuid": "dc572b73-c7e3-4342-bb76-8cb3be7d2494", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674672789, "uuid": "47e1b3c6-bc72-4554-ac77-7eb021a9e49e", "value": "12288:3BVXmwOSP4tEPJm0fVL+tpx69xs8sBjcNN/KY7eAf4aGSIU017:sSc6/vBiTbPa5t017", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674672789, "uuid": "0b8f800a-f69a-4eaa-a526-b82f5d5d84a2", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674672789, "uuid": "92bfdf94-9ba4-4ca0-aae5-8baf6fd55caf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674672789, "uuid": "ae852713-26dc-40a1-a98a-08825481e8d6", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0deba1c-9c90-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674638158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638158, "uuid": "fe6dfd67-70ea-41e3-a194-cfd1fad68392", "comment": "Malware payload (GCleaner)", "value": "209dca1a9633807b9cf36d6447f972da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638158, "uuid": "94c617d7-d00c-4161-9c7b-991102bc19dc", "comment": "Malware payload (GCleaner)", "value": "2004da2c60d73a66c6feffe50f130483750da799b90a78c76da90f61208101e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638158, "uuid": "2833e918-efdc-44ac-8f7a-90b4e3435e2a", "comment": "Malware payload (GCleaner)", "value": "c4235ac91cd8e3c0e70ede54e43f857709f00859", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638158, "uuid": "70a025fe-5a0e-49d4-8279-f5dc2b361a8d", "comment": "Malware payload (GCleaner)", "value": "7acc0be23b78e8d8f4113e2a7d06be51683de42ad9d8ef4eef656043eeba23ee81f9d3bb8fba4cb66528b90664e87e6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638158, "uuid": "bbcf89b9-d6cb-4068-a832-a37f8eee4d43", "value": "T1DD8533454E82D871E0236D76583E81DACD77BF2B247471402B4CFB9E37EB2D6920AB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638158, "uuid": "bdbaa15b-0401-43ad-94db-907f7747c364", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638158, "uuid": "cb406526-1760-4f8b-83b1-7c1ee08a3aac", "value": "49152:ZLlc1oFvcnMNVYwUblC5LPUuQ6iArG7WUD8aXBCLCgv2MR:TzvcMjzcJ/qqTDLBqv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674638158, "uuid": "11f5d57c-874c-44d3-94f1-e5b78491ba12", "value": 1825141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674638158, "uuid": "445a65d0-b774-4e90-b42f-d048681a72d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638158, "uuid": "da3caabe-b74c-4239-9f81-2c0d40b49616", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7dfabd1-9ce8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1674675992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675992, "uuid": "8ffc9a4b-e957-4a61-91d6-04829d41858b", "comment": "Malware payload (AuroraStealer)", "value": "03e3bad71e31f6b4269f07a14300a1a2", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675992, "uuid": "fe480f0e-f75e-4c5c-8541-c0809b912a9e", "comment": "Malware payload (AuroraStealer)", "value": "21baf3dbca077ed7a34990db99eb22ea6a085977af4e38436002b06b42cfb96c", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675992, "uuid": "b7550530-d5b2-4dfa-b652-13b3fc5872fd", "comment": "Malware payload (AuroraStealer)", "value": "b9ecc7cc12c3f2ca94615a3d68331cdb0c659076", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675992, "uuid": "213d2d96-80bc-40a1-9b45-4906d7553f91", "comment": "Malware payload (AuroraStealer)", "value": "b316bd2db8fc498241f3a1457ae008d16125ecfaa1eada61401fc1ba36718ce96499df7dda46e57a6e02010336bdc332", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675992, "uuid": "bbd9ab73-0ae9-4550-b44b-7aac3c1c6e94", "value": "T15DE5238B5680FCE7F0BD837964770D820E19A9767B102AA0D18FB3A1347557C9F36B29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675992, "uuid": "faad75e8-8cc7-4b7e-90ec-854e1cf75ebb", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675992, "uuid": "f9b13950-91ae-4454-bc53-ae9b45395c84", "value": "49152:V1fsKJAccz1yNySqWj1ev4yFJzIosdgj7SzI7eM5jWglagRwQRPYcE84HjSdepEH:b7cz1yjySjdgj7Sk7bjpRw2HiSde6DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674675992, "uuid": "5b91150f-3259-4cf0-a3a2-5e730b638233", "value": 3091456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674675992, "uuid": "0a93077f-22d9-4781-a48d-7f9a16b27ae8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675992, "uuid": "f16cc353-2b37-474e-a4c5-ca02928c793e", "value": "install_win64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de08813-9ca6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674647306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647306, "uuid": "d6a061be-ff1b-49c9-98d5-9d054a02b0dc", "comment": "Malware payload", "value": "c06ad7f65d1f638122b9dedc1dd71cc4", "object_relation": "md5", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647306, "uuid": "0e249e9f-17bd-40bf-b2c8-3a900184afd4", "comment": "Malware payload", "value": "22c4a9d47db8cf8183a9b91032c08e9592f37aa4e64a97e3059339698fc0e415", "object_relation": "sha256", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647306, "uuid": "81d219d4-1b6a-40cd-85ea-1b2dca62694e", "comment": "Malware payload", "value": "b84133ef92c4eb754c513f7007ac5461095f7b28", "object_relation": "sha1", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647306, "uuid": "b9ed34d9-c76f-443a-999e-eb7c9d22de1f", "comment": "Malware payload", "value": "bd367bcdfc5f076a0d63ca89825020984c426aaf947c4e35e2c948a6df4e50e60718dc29a56a2e486dd271c679524460", "object_relation": "sha3-384", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647306, "uuid": "4377cc3e-8d6d-4dba-81fe-35e3aa817276", "value": "T14063F12AD5655C50C9B4CC3D648C1EEAF90704D4D0F8D83BA936F88C1E4CE1A6EEA8DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647306, "uuid": "00184b3a-f53d-445c-9c18-0080ad42eda5", "value": "1536:aIiQNO5u1KONGK2R06OlTq5lTZTJpC5rQ+MBkri1:aIiWO5ulN8R06OlTqxzCFQarC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674647306, "uuid": "55a2e9be-26c6-4f8d-917b-193d3a274edf", "value": 69393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674647306, "uuid": "dbd19844-1f99-4273-8101-a1258b4ead5f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647306, "uuid": "e800a8f7-6f64-4ddd-b1d1-8a48d1b12e5c", "value": "INV-27-12-022.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4298015f-9cae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674650777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650777, "uuid": "6eb98904-0262-40ea-994e-3de716836f38", "comment": "Malware payload (Mirai)", "value": "947c2aaf78ae25cdc9c0da03eea99a10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650777, "uuid": "ffc949d1-ebd3-4e45-a884-5aae3ec29a15", "comment": "Malware payload (Mirai)", "value": "235c600742c4fa7a5e6c035537697c191b66d789ce9b9e7cc962fed160e9c69f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650777, "uuid": "803f0c9f-2cca-4f86-b3d1-13d92e702af7", "comment": "Malware payload (Mirai)", "value": "96b1ed81eaa9ff205b86e33fe059cf9a285e3216", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650777, "uuid": "2f6d3822-2d41-4f01-9a51-96264a54329e", "comment": "Malware payload (Mirai)", "value": "25a5815c2711df6241c87014d15a32336697d1286722559d68cfa7300f67e56b7ab1dc04577d4c43ef8d62b37b707b28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650777, "uuid": "33c367f4-c79e-453b-a4ec-96f34a96cf6b", "value": "T18243851E6D168FBCFB59863447B78E219A5833D627D1D542E16CDA002EA038E741FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650777, "uuid": "ac04e070-30e7-4a29-9987-ac581af6e3e2", "value": "768:bvaLxUxyQpPT5rhmuTrFtJmSnoh2Lt3ug+f1QZi0e4fyMnup//dujgtywfz:bvJFP1ntHF+f1l0lk16gtLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674650777, "uuid": "3da06b7b-5380-40a7-bc64-6db35ad71429", "value": 59768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674650777, "uuid": "2c5bf380-0b3e-42ec-9cae-1cb47eb6a03a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650777, "uuid": "a57484d0-4b16-4da4-9c3c-5948c59c48bb", "value": "947c2aaf78ae25cdc9c0da03eea99a10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e010b21-9c86-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674633697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633697, "uuid": "3bf181d4-4ee2-4d5e-882c-2a59168912b0", "comment": "Malware payload (GCleaner)", "value": "844d3e531fa93c4d7f8556f7143c72c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633697, "uuid": "b26b1693-c219-4eb2-805d-5eadfe5811df", "comment": "Malware payload (GCleaner)", "value": "2480f4f153b21917592d40a7f68a7cab0f118b6f2deff403ebb57c4882cc1612", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633697, "uuid": "6a424230-2950-4542-9e21-454c507f4c64", "comment": "Malware payload (GCleaner)", "value": "010ba9b0d2c009ffeb75d87cda5b3802abf012c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633697, "uuid": "43e4348b-2639-4abe-ae83-c1f34caf9599", "comment": "Malware payload (GCleaner)", "value": "a9b9527691dd689bb700f9120081d1c4030a7934472bc2edc5ffb10b93100368a0a0e8d690e9233faa866b6fc40aa917", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633697, "uuid": "dcc9cd4f-ce1e-4935-92e1-59be9bc8239a", "value": "T14185336595B68973E3F6973C6D380013DB33FA063870B872B2DD591B8FB22D0494D2A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633697, "uuid": "9744f267-ccb6-4594-9484-260c3b083614", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633697, "uuid": "e917adff-ed2e-4033-a770-fc1763f2dd1c", "value": "49152:ZHpyy9nsvX3kwsURr/zsR+DJBcyRJaSdMPkHP+LCgv2MR:1UWsvrJRPVncqB62ev2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674633697, "uuid": "0ed1c8b0-e035-4a42-babc-d9b494ec3842", "value": 1819607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674633697, "uuid": "9f1bc338-acea-4f5c-973b-8d91c41e9d98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633697, "uuid": "7f431865-3854-497c-bae9-7a203f125e80", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcaf18f-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674678770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678770, "uuid": "12811345-1615-46ba-b4ec-0a3feb36de69", "comment": "Malware payload", "value": "642c51e3cd42e7a0232fb8e5c5f54b74", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678770, "uuid": "94f5a2c8-022c-4847-97b7-62977599f465", "comment": "Malware payload", "value": "24efe7018724237d731ff3adf177fa1f027bdc94a1fbdc4c053a0539b5660de5", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678770, "uuid": "6f262a38-fe78-45ac-824c-147c339a25a0", "comment": "Malware payload", "value": "72c00ed8a6afd3b0d1e277881d697bc4d5227ddc", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678770, "uuid": "cf4640c6-126e-4a60-aaef-02b47a1331d2", "comment": "Malware payload", "value": "15620d4f107172f376afece719cc8e2fcc7501cde90883ea4e9e0e9102eaf62f092e6f2cd3be3761e46746669e34cc47", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678770, "uuid": "5890806f-79bf-4f06-93e7-e08e1a9c9114", "value": "T19CF423FE8064CBC3FD27D4118C92A720AC6E01E889B594AF89B1D259F3D86D8F15537B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678770, "uuid": "e73ace6d-5183-4bd8-8225-8595736600ef", "value": "12288:c5KIS1W2v1XJGMO40rS85YZ/457cqCkvfqfuppdOBWtrWbJn/tz+219iiULFc/zt:cVSH1Xw5rt5XcqCkvCfuppdtV0VFr/hx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678770, "uuid": "587466c6-ed31-458e-8ae6-7dc2b67051fe", "value": 736298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678770, "uuid": "a6df1fec-2fe6-4f61-8f67-bfcf818ce217", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678770, "uuid": "ee1f4f17-4616-46c9-991d-a1a3261d75a5", "value": "Docu106-700-113007.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e6d30e-9ca5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674647164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647164, "uuid": "42e14af7-cd3f-4caf-852d-6039b2d8c906", "comment": "Malware payload (GCleaner)", "value": "88a19944c337a51b8618e42d6aa46267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647164, "uuid": "3ebaa7f0-4026-4c66-b232-5871220393af", "comment": "Malware payload (GCleaner)", "value": "2520eb2fbf94b298ecb3c1e81bf74b82eaff1ec1477dfd7b317d53ddfae896d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647164, "uuid": "86222de4-b3fd-4402-b554-7d3cbb66fb48", "comment": "Malware payload (GCleaner)", "value": "4c20dfb41d94b97f080b7a62521eb34c5ea2bb9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647164, "uuid": "e8298c81-186f-4614-8c3b-8d21f31c9145", "comment": "Malware payload (GCleaner)", "value": "43996fa111dd786506058da80cdb3a09c247749752b30e0efb95bdd0b00efb030266f6c1a1c66be94a4f9767fdaa1bf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647164, "uuid": "9308d5e3-9ca0-4fa7-a4ba-3beb1dcf67a8", "value": "T1328533075F66D131D2C1DB354B78B022EA7AFA666874530076DD9AAC3F3B3D0A40BB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647164, "uuid": "c3dac824-af14-46e1-97da-550ae9b8f45c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647164, "uuid": "afb4042f-6057-452f-8ef4-c10c5500535a", "value": "49152:ZOwNLyWPHqrnBFMWrairwyohAFtETOKC+IOLCgv2MR:AmWWPc9xrwy6ATPo/v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674647164, "uuid": "a0af282c-9a16-45cd-9a9b-c3d1fe4d8a3c", "value": 1784691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674647164, "uuid": "720958dd-9326-4a1e-9ce2-76adcc1d8493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647164, "uuid": "43de6d89-6cb6-4f02-90fe-c8ff88c97850", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17848baf-9cd8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674668743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668743, "uuid": "cbbcfea2-d860-4482-a51b-abab9933dcfc", "comment": "Malware payload (RedLineStealer)", "value": "b464f5d03cd60af609a6a3247ff05298", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw - Proton2023", "colour": "#145D34", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668743, "uuid": "a897d3e2-5e57-4553-b947-6c3ebda1266e", "comment": "Malware payload (RedLineStealer)", "value": "257d7b7b2e1d11628791107c460c8949d6e5d07f519880b92e184ee8c9d7ad65", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw - Proton2023", "colour": "#145D34", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668743, "uuid": "91810336-12ee-472e-800f-95bd916998b1", "comment": "Malware payload (RedLineStealer)", "value": "722622a1e5800305c2cd1c63bc76b65845aeafc4", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw - Proton2023", "colour": "#145D34", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668743, "uuid": "0dbbce69-81cd-457d-9480-6ad5258aead4", "comment": "Malware payload (RedLineStealer)", "value": "b97a69f0b8d9df26d55c0c986a32c2b58e32334bf04aed3c2b352bf272bb28f7d4a88101573f8213c7b683229fb404b5", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw - Proton2023", "colour": "#145D34", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668743, "uuid": "d6331079-8c16-4390-b18c-5aa746bc0611", "value": "T1EB8633C835A8C3DCA4661743BC26954F0CE4A08B6FE0E29F2BE99D4FD5FC545478EA81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668743, "uuid": "b9f737ee-56cf-49a0-a6c8-30595050fa2d", "value": "196608:vhaPPeKtQNDWori3r3RuCJTq9YUBFAFBfQ8HOcuEB1dQ:qPeKtQpWoUrM99YUBKZN3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668743, "uuid": "087bc6ec-73bc-4441-a08c-3feeb2d70886", "value": 8481426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668743, "uuid": "6568af55-c869-4940-beaa-d56a249f851f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668743, "uuid": "d43ed401-9a74-40e1-8a20-1f59f10f8bfb", "value": "ProtonVPN Partnerships.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19c9ae9-9cc1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674659150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659150, "uuid": "e2fc526d-d5ff-4184-b788-6cae53124a53", "comment": "Malware payload (Formbook)", "value": "e99a34703c132183790056d8c9c51be7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659150, "uuid": "11dffe18-7822-402c-a5f0-19b5f78251b3", "comment": "Malware payload (Formbook)", "value": "269801775bffc7e0a249e9accb7ae7c3e766d44e079e3366459a0df44e1b4b5f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659150, "uuid": "bfb3e94a-1f7d-4b79-a536-0e0d3d9d001a", "comment": "Malware payload (Formbook)", "value": "1986f8aeb975e054dc64ae45aa753d51cd96976e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659150, "uuid": "15b9aa58-631f-450a-a29b-a38ae356d4a5", "comment": "Malware payload (Formbook)", "value": "94c5bae32e558abb5731644356309ca58b6d3cdd4d66259d859cfb724e87413fd2698a07c7cc89aad44d964cea170a29", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659150, "uuid": "7f24f3f9-8b76-46c5-a80b-10d2565c7cdb", "value": "T1049533A9ADD6C052CE2DCF7388943813853FB970B45C911A9E5FE1806B52FEA4643FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659150, "uuid": "924c16d1-dba9-4231-8e98-0f6bb875e506", "value": "49152:R+TkOejT3OtJQNOlESE34h3vDHBOXjNVdY+9zwCwr:R+TkOeWzQoh7HcbqkEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674659150, "uuid": "b1291c70-6b6a-4dd4-a4d8-fa7035fbfce6", "value": 1891334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674659150, "uuid": "f99f69fc-939b-4321-bc14-13c65f793a44", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659150, "uuid": "607ba7cd-2d2b-434f-8ac4-c70bf9ca128c", "value": "SO-sales order Tematsi.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e24b3d2-9ce0-11ed-88f6-42010a9c006e", "comment": "Malware payload (MedusaLocker)", "timestamp": 1674672217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674672217, "uuid": "d57ae4e1-695d-4513-bd92-37a6e900da7a", "comment": "Malware payload (MedusaLocker)", "value": "646698572afbbf24f50ec5681feb2db7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674672217, "uuid": "d24f8972-36c1-4b66-adc7-58b33988a182", "comment": "Malware payload (MedusaLocker)", "value": "26af2222204fca27c0fdabf9eefbfdb638a8a9322b297119f85cce3c708090f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674672217, "uuid": "4a043637-43f2-4b85-a842-8866e0055200", "comment": "Malware payload (MedusaLocker)", "value": "70530bc23bad38e6aee66cbb2c2f58a96a18fb79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674672217, "uuid": "78292518-2ec9-41eb-a597-e558dc6dd558", "comment": "Malware payload (MedusaLocker)", "value": "d568f87590e7b4f90814176fdd6ce9002a2e9fcb851811082afb439dc95a7199df439b548ebf1a767ab4f33da2ff80ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674672217, "uuid": "a50d0e0c-4088-4578-897e-930daecc9c18", "value": "T139E49D1035818132EAB301718EBDA66D517DF9220B2A58DBA3CC656D4F7D9F27E32237", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674672217, "uuid": "7041a2eb-0a99-4c25-b0ea-0c9d63b80369", "value": "1a395bd10b20c116b11c2db5ee44c225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674672217, "uuid": "5aeb5563-d27a-48eb-b7e5-55c605996b87", "value": "12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8D4KD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWdKrKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674672217, "uuid": "7dba4b97-dc95-491c-8ee3-92fec11da6ee", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674672217, "uuid": "f5ebac76-bca2-4457-9254-f492899a9da0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674672217, "uuid": "6dfa1a5f-60c2-4510-8d52-98a510e6195c", "value": "26af2222204fca27c0fdabf9eefbfdb638a8a9322b297119f85cce3c708090f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c89264-9c89-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674635134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674635134, "uuid": "51f02ad9-47c4-4883-a3d1-906ca6a89596", "comment": "Malware payload (RedLineStealer)", "value": "6def34b7d9603c4fc7953f177f73c21a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674635134, "uuid": "5bfd64cb-022f-4029-b55d-d7d2b009962b", "comment": "Malware payload (RedLineStealer)", "value": "277e1518b909735b16f393b7077e453735eb4d2dd651891f9f73da605941493b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674635134, "uuid": "d99099a3-67da-47c4-ae0b-2a91282c860e", "comment": "Malware payload (RedLineStealer)", "value": "82d464aedae69e9fa5ad521ceed3840595f3ad2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674635134, "uuid": "e9613f16-fc2e-48c8-b7a3-a90aa38543aa", "comment": "Malware payload (RedLineStealer)", "value": "6624360264e3763c3e480adba30a0a1a82d18938beb24b0522f9fbf42772faeb1ffa44d21e9a555f5e0c95583cd276f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674635134, "uuid": "632e37d6-8d61-4719-b06e-372b9defe97d", "value": "T1B1749E01E2E87ED0F599CA318D2EA7EC363EFD514E156666322C7A3F29701E1C52A31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674635134, "uuid": "b1de8c09-4626-41ae-8034-76cc52ec9815", "value": "861af707b319724b1132a7a971c54bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674635134, "uuid": "91b5eb90-7f82-416e-b034-a31689510791", "value": "6144:OnCLd9hqCWtvCuWxtt7Tfq3w2YJ5jq7VWRFBMolz90:OC/hqCJuWxttHn+7VWR5lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674635134, "uuid": "788f25e0-5705-4282-b971-734c9cb48e6e", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674635134, "uuid": "dd195f0b-ac1d-4224-9c1e-60c14327c91a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674635134, "uuid": "4f706a01-eb12-4f0c-978c-b335ee6384c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4da0d4-9cfc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674684514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684514, "uuid": "1dc5fd34-ac75-4d1f-b681-ec2fbfda7f7c", "comment": "Malware payload", "value": "d4e0c7110645a67183c07fa48f42cc51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684514, "uuid": "f193dcb4-748e-45cf-a6bc-34eae24fb5cd", "comment": "Malware payload", "value": "27a9990b8f18b919d9cbfdac37f30e214b45092e4627206d033a5d9f3090ed28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684514, "uuid": "9360cfe8-1d48-40cd-946c-43fed0a98606", "comment": "Malware payload", "value": "0364e3183a63d6e54ddd629932853a1448dde33c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684514, "uuid": "9dcedf60-9507-4dc1-9f21-e6aef4cf8dc4", "comment": "Malware payload", "value": "43ea6ffad79938fef92da8720d514427be4d6d26b19cf1c0d07c1ca1b0c06b82710d74bfd1c2a21eb465344e37f3fea2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684514, "uuid": "0414ddae-70db-41f8-9dbc-a8709ac463cc", "value": "T11104D51437FCDD11E1BA5A3F6921A01086BF9802A852F75B76C367CD0E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684514, "uuid": "fc87de97-c79a-45e9-ad28-16c65c08c904", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684514, "uuid": "24272fed-aa9b-4aa6-a65f-cf254fbe671b", "value": "3072:TxqZWGNaDUSkP0VJHsse0UFihVvrxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOd:lqZf0VJMDihx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674684514, "uuid": "bab1b3d9-89be-4675-ba93-d3e5c070e980", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674684514, "uuid": "832d5127-a1ca-4cf5-9beb-8ddaa59da821", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684514, "uuid": "ddc13ac3-9992-4ba8-815b-885f2ead29a4", "value": "dx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8aae8b-9cb9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Shikitega)", "timestamp": 1674655572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655572, "uuid": "6a9d137f-be62-44aa-bc8f-b1bd239649dd", "comment": "Malware payload (Shikitega)", "value": "eaeaffee6e1183ee54bd0b5a4506e24f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Shikitega", "colour": "#C8F58F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655572, "uuid": "6e542384-203a-4398-8b78-6f7ec07d3803", "comment": "Malware payload (Shikitega)", "value": "27f767ed8bed3964b339f87aa3b22ecea93220d74374b8075718dda9a5b646fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Shikitega", "colour": "#C8F58F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655572, "uuid": "dad86af1-1611-4279-8828-6517fc20b307", "comment": "Malware payload (Shikitega)", "value": "954cc3e355a6f72c0a1d5cab871fa2588d4f3155", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Shikitega", "colour": "#C8F58F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655572, "uuid": "9fcb6036-5543-434e-8cf8-1b4da6d455f2", "comment": "Malware payload (Shikitega)", "value": "7ed58d9ebafc6e4a95f87ff44a2e4c6d858b28bdd70c54135ede4c2d3fe5018b17e01ba5eb423d4f259a61e5185811c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Shikitega", "colour": "#C8F58F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655572, "uuid": "5486ba75-3dc8-41f1-8a3e-62284c47b7fc", "value": "T1A841D8EC552F6734D5852DBDB1854FF891300891412B7F0EE786B2899A14D15657B0C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655572, "uuid": "def296f1-55bf-4773-abd8-55510d3d821d", "value": "48:f3LmTFh/fLyWmzEo5BnkP5QONIQEjbbX0v+24UhTdu6e8I:fbmBhHLyNb5BnkeOXEjfXM+24idzer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674655572, "uuid": "5fbf01e1-4367-42a2-be28-94146cd97331", "value": 2054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674655572, "uuid": "fbf4b42c-293f-4048-ab8b-59a731ec0868", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655572, "uuid": "d1b657a9-5fee-4516-991f-79053e334a9b", "value": "sinax", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc358cae-9cbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674656591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656591, "uuid": "8a953e19-499e-416e-8d88-2cd80ce3b75e", "comment": "Malware payload (AgentTesla)", "value": "a00f18425eb47bca0914a469f2e92c3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656591, "uuid": "496cecdc-f96d-44fc-b64a-63ebb3620d8b", "comment": "Malware payload (AgentTesla)", "value": "284822e2a8acc0d59138076c42efff67ec39954f12a4af283f895334ad2fdd59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656591, "uuid": "18d51a45-720a-48e5-ac5c-10ffff9f67ec", "comment": "Malware payload (AgentTesla)", "value": "671aba401d79ea505ff56dd06a62e5a80a9444a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656591, "uuid": "8757a8d8-721c-4cb6-ba44-f853b0cc4c80", "comment": "Malware payload (AgentTesla)", "value": "547a9a2e94e830e0105196d2e693c6e873483d29cabf797c0607aeaa01aeb1a983e1505b09b7f7e1f9ea65befd86e55a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656591, "uuid": "fdf2597c-7e22-41e5-93d6-42ddde9bca46", "value": "T1A1752384A38865F2C554FA7237AFBBB527AB3CFEE9603541245EB23E5D7E1304016C86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656591, "uuid": "fb5ef320-1e73-478e-a295-9e4523ab2ccf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656591, "uuid": "f1410b9e-fcad-462c-8488-4403034258de", "value": "24576:gkcG4mGJevk8kfXUpG5teDHgX8E2Irpzc3/DUtGuh/jTMCLTAR8/yYCWL:gV8iCeeHgXF5VziXEbACAq/yYCWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674656591, "uuid": "5233107d-e269-451b-9c9d-e9f02dc05b03", "value": 1668608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674656591, "uuid": "ccc7b221-a257-4363-821d-48d2ab81ff35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656591, "uuid": "fa79d9af-e29f-42d0-b15f-95e931d38b1b", "value": "a00f18425eb47bca0914a469f2e92c3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d372a6a-9cd6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674668109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668109, "uuid": "e5b83240-b3c9-4d06-bcf6-fda1a6bd7f93", "comment": "Malware payload (Gafgyt)", "value": "ca20244b946f8aeb6bf5f85d5366f360", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668109, "uuid": "b6de708c-1a81-483c-aec1-942a5912f14e", "comment": "Malware payload (Gafgyt)", "value": "28655a1aef99a7929333b7d6b43ff653bb0820c735432ed310456fcf34ac7f7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668109, "uuid": "1a7bffc8-4584-4d57-886f-f5d9bd51b21e", "comment": "Malware payload (Gafgyt)", "value": "7a3e365b86193592ea699fb62652ff7001fbde3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668109, "uuid": "97825b17-525d-4f07-9044-208b3ec14307", "comment": "Malware payload (Gafgyt)", "value": "0cf12b22c725a6dbb5c8775f7e7e14099f4add3ab77abeac167ab1c4617e8c9a5da3afc04b593090140dfdc2f676ef57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668109, "uuid": "765d1ded-a97d-4ce2-9aef-0bbeef627cae", "value": "T122B3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668109, "uuid": "905d03c1-c34f-423c-98cb-f80b287d5e78", "value": "1536:ZLeTikthhSMOCMQS+ZjN4pjuIxreg2OMN2eDo/TUmkiSFxfC7xbXe:ZhHC3S+dUreRNTDiTUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668109, "uuid": "79a066dd-132b-4d9e-83e1-6c2ffe33b25a", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668109, "uuid": "3ac62a63-2e32-4820-a7ee-f7d059dfc16a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668109, "uuid": "734e0731-7b31-4c4d-bf6a-cde6a51d80d5", "value": "ca20244b946f8aeb6bf5f85d5366f360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b68774-9c45-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674605737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605737, "uuid": "8b763b2a-c612-4f6e-a2aa-16f6008ee3c4", "comment": "Malware payload (njrat)", "value": "dd5a6f65dcc5b6595bf000831d7c2613", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605737, "uuid": "b26e9aa4-7884-44af-95cb-969a813eec22", "comment": "Malware payload (njrat)", "value": "2989c95702c726bad521685756bc42ee78442b5e7e5a28367f6039ccba03fda7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605737, "uuid": "06bf5716-f5ea-47a1-a2d4-767664a24be0", "comment": "Malware payload (njrat)", "value": "bedc8dbd808946f7c58dbc294c6191388415512b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605737, "uuid": "e2e179c5-9513-4f99-ba0b-5f88f5c16aa3", "comment": "Malware payload (njrat)", "value": "bb34712331040c56120d43ff5e314e4832b66ab2345d80ef23033c1e4ef366d99acbe1d75e9d551bbd1d5eb7d44836ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605737, "uuid": "e9fd1bc5-f4e2-4f4e-ae8f-742dd7e40e71", "value": "T1FCA3C61B3E00DAEAC87E8977E46BE5F50B22BDAFC5615347B2C07E157873411C13AA62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605737, "uuid": "aa73385d-8057-4953-8c10-73f3bdf67d66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605737, "uuid": "661ce7ee-de4f-49b7-9050-2f1e7b8acff5", "value": "1536:4BM5o3zQNxi+gRJNIUp00liOJcv4r+RvDd52dH0O:4BYojci+yJSUp00lHcvdDd54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674605737, "uuid": "f7646240-3d19-49a5-aa88-18153071262b", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674605737, "uuid": "9f45ee65-319b-47e6-816b-7bcf96a78e19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605737, "uuid": "019f3121-1f1d-49d8-974c-323042f6a9a0", "value": "2989C95702C726BAD521685756BC42EE78442B5E7E5A2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df846599-9cc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1674661778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661778, "uuid": "b5d2de3b-7118-4ed5-bbc2-ef6258594e7c", "comment": "Malware payload (CoinMiner)", "value": "6b9ac49509f2e5e556134887d2ea1f94", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661778, "uuid": "38bc7d37-f350-47b8-b8e3-5f5df99aea3e", "comment": "Malware payload (CoinMiner)", "value": "29b85c61e7724d1e4c33341e5bfe85519bf85ab4ec8c590d44b559d66532c495", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661778, "uuid": "37546b8a-c706-4143-9cac-8d9e051903ed", "comment": "Malware payload (CoinMiner)", "value": "8437eb1ddacaabec85b6f907a7604a84b8af1832", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661778, "uuid": "c48aa907-15dd-484f-9b99-83e5d6707548", "comment": "Malware payload (CoinMiner)", "value": "7a0d3aa70731287f92175cc05e2dc9fe6ab317753d9df3d7a709e060401cb209570b35ce7ab6c23e7a72dd762557fba3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661778, "uuid": "fd4135a2-f451-4d24-9e33-c9d5b1f9cb96", "value": "T14FD5E050FF1DE4B1F5AA9138C56385B80E206C25AAD2815B3DBCFE4D6379381707A73A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661778, "uuid": "bacd4d91-0c8a-45a6-8307-761c7a03922e", "value": "93cb92ac2088d8cf24bc6fc4c90872bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661778, "uuid": "563b3c84-78f1-4f2f-9f23-d842a5dc008f", "value": "49152:wzMe+rA39Z8gVFMuXu1h3D43/ZrfH8Un3Xk5BS:wzMeUWZ8qu1lD4vZT8U3XS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674661778, "uuid": "9d9804c5-23f7-498b-a538-75a7c9212fcf", "value": 2903552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674661778, "uuid": "4fe22b00-c1a1-4a8c-978e-cdb03f56dd65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661778, "uuid": "437e7a71-8939-4d84-9fb4-b7094768c86e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22159afa-9cf8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674682505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682505, "uuid": "260fb596-a3db-43bf-a06b-dd9aa8188661", "comment": "Malware payload", "value": "4f6a3eb4cd65260fbd0a6680fbe87967", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682505, "uuid": "d4acec25-de22-4546-844e-811c4f2bb6a3", "comment": "Malware payload", "value": "29f1ce283d917aa14182dba819117465a995069b1a5913a99f9fe80c9bd8f8d6", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682505, "uuid": "4aa189c2-4f65-4c4f-b748-90ba905078eb", "comment": "Malware payload", "value": "8ac83c7b7758812bda7324a55a363a272e77d0ca", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682505, "uuid": "00a30e7c-12bd-4935-9ff0-485e5fea5b21", "comment": "Malware payload", "value": "b279433325e17291c6298ed240dd7215c738937d01a25f115069447516bcf41b69c2b92e87e70d3e53378f38ecbf7ebd", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682505, "uuid": "9511f745-6d90-431e-9a73-883296df73d1", "value": "T1C2E2E148FAEC98ECE66F893CE15951003C983D276F88D8C44ED53869A569E440BF3AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682505, "uuid": "7705301d-858f-4d30-b144-c80c050325a9", "value": "768:8D+ZsIHSXAIAEcqNGmyjdscwKqVFPo2wghKZG:8D/IHSwITcqNxSw7PoMhKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674682505, "uuid": "4c940670-ff89-41c4-ada9-81e219cec0a9", "value": 31468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674682505, "uuid": "d97843df-23d3-4953-9f55-4679c94056b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682505, "uuid": "8eac934f-8b1b-4471-b23e-3ae001b28421", "value": "TradingView.msix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f865dc-9c4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674610276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674610276, "uuid": "1ceb6627-78cc-46d5-9c53-b83e36322f8e", "comment": "Malware payload (GCleaner)", "value": "a2f5f0156f636274a21d7e6610d9469a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674610276, "uuid": "06f0ffcd-51ef-4465-b38c-be9e1ed49d30", "comment": "Malware payload (GCleaner)", "value": "2a2cda3142c4f7cc16325f17799aafa9008b8e27cb117809cb03045deaf77dbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674610276, "uuid": "f82b182b-4ec1-4717-b8d4-aa4f794bf0ea", "comment": "Malware payload (GCleaner)", "value": "f9cc64dc5c838c46aafd96a5e8595c3f42596ef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674610276, "uuid": "1facad45-b48e-4b76-bf71-120acf29b7bb", "comment": "Malware payload (GCleaner)", "value": "50b312094ea2727ed2635dd8b19a32a820af88bb48b360c751e1eef9e2257f3e293bded6bac6dc2fc16e671e9c081f40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674610276, "uuid": "1e5b1d46-06cd-440f-8ad9-679ac262bf28", "value": "T1DC853306DB31E471E040CB7C2F258876777A7A2F093511C421DD7B2DAF7B9D86E2A622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674610276, "uuid": "2ca2d38f-16a8-4cfa-a51c-1b6fd0b91951", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674610276, "uuid": "adc7a86d-4b6b-4e42-a92e-209a6350ed68", "value": "49152:ZcjLIoZdr4VJmTDD8Lvku73myMf8T27Pz/dLCgv2MR:KS+38ouSNf8y7z/hv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674610276, "uuid": "20afaec0-728f-4773-a4f4-26ad544583dc", "value": 1783500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674610276, "uuid": "1b9d47f3-77e1-47c3-90c5-2713265f840e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674610276, "uuid": "a2503e74-d5bb-4071-afa9-c581765b77e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4cd3c0-9cee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674678388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678388, "uuid": "c3434e40-c89a-452d-bb83-c97ee8f6abd2", "comment": "Malware payload (Formbook)", "value": "f53e5f9ab78a7332322a98152a66eca8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678388, "uuid": "cfc80c65-07c0-45d2-a945-3409c7a27b8b", "comment": "Malware payload (Formbook)", "value": "2a83317fd8334690d5cfd9784d6ca6f3a99fa95a05c81c8fb94edac7b7f06306", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678388, "uuid": "e0d79747-77f8-462d-8eaf-2354d24cd344", "comment": "Malware payload (Formbook)", "value": "438fdab98a57763d5e20ded10acec16239cee62e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678388, "uuid": "7b67209e-3ea9-431d-bb61-b93b3bc52d9c", "comment": "Malware payload (Formbook)", "value": "e4292437919fcfd29f4fbe44227b6ee93bc105f8fd6cdaa6404bb0cd480d3134ed0ae6795f2741d0890473395772c259", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678388, "uuid": "97861ce1-b905-4ca5-891c-3c14e739b637", "value": "T11D84DF87F2AD931EEEE945F2347E02B046D59F2B54A05E81B5CAFF3E007245D26282D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678388, "uuid": "37696d8d-21c2-4565-a848-bd359c64cdd2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678388, "uuid": "65c8b24f-a14e-4b52-b5bb-2ba4775c0879", "value": "6144:IYa6DP8XKjcRan8DKCSTP9kr3SG206C6TRR12W3ocpckv+m6Y0tYfc:IYmajc52CYqz231lWkvFI4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678388, "uuid": "f36aa412-57c3-4602-b154-7bd5ed0a9f40", "value": 374939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678388, "uuid": "6d7ca785-7db1-4bd8-9746-f6639b9c9e0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678388, "uuid": "11a5a28a-0c35-4586-8658-2b819f8b06af", "value": "FedEx Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa172b1a-9c4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674608135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608135, "uuid": "09d3e7ea-3bb1-4d2a-bfad-826a5012227c", "comment": "Malware payload (njrat)", "value": "e0fe63fb9944a973ceb9faa7bda6362b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608135, "uuid": "806e0a2c-0c3d-4b66-8892-84bc6b2abf06", "comment": "Malware payload (njrat)", "value": "2ab61719148cfecf6b29911178e433509c28e052873c6ab25b319b49b483693a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608135, "uuid": "956a0a9e-89f5-4f35-b3ee-0350b42ab432", "comment": "Malware payload (njrat)", "value": "f78b461910d7f0556cee6bcf7c5b5343c33cc04c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608135, "uuid": "6a32e9ea-7e1b-4250-9bab-15a2f612b2a4", "comment": "Malware payload (njrat)", "value": "c2f59e32088e00cc4354cafbd472358f3f40448feb3777ccd9e62d931e25dc7cded9be87f57a91f8403af4ce7ffb3953", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608135, "uuid": "fbfd9914-aa58-43c2-8266-ab4a9405cdc7", "value": "T1BE13E78CB694E175D5FF8BF1B4A2B2890B71A01BA802930F99F114D94F73EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608135, "uuid": "1fcdb4b1-f0c6-413a-84f3-e1c1dc91eb24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608135, "uuid": "2c62f25a-07f9-453d-9ad9-4d53ef3c8bfc", "value": "384:oZy1TiVK7U8yr55+/s0EE8V5z9fmzAIij+ZsNO3PlpJKkkjh/TzF7pWnYkaeT0p6:eoicY5r7+/xQVZ94uXQ/oU+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674608135, "uuid": "1575f44e-870a-4917-86c4-2ba7794cc1d5", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674608135, "uuid": "07bc6f19-aabe-43b5-bfee-546b517da6ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608135, "uuid": "a921a673-4bef-4f09-b31e-e3c685e02145", "value": "e0fe63fb9944a973ceb9faa7bda6362b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1fc1a7-9cd6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674668077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668077, "uuid": "e415e0e6-49be-453e-bd00-715d6596cc23", "comment": "Malware payload (Gafgyt)", "value": "ffa10046bd8ed799a6a8205cf3eedc06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668077, "uuid": "d9af55cd-e3ed-48e4-8076-424e68c2bb15", "comment": "Malware payload (Gafgyt)", "value": "2acb7c09756b2e1fc208506e3ff5ef210b600ada2c0cc63dc409dc24917ecf85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668077, "uuid": "6ef3d66f-78e9-49d3-b5e7-b208834e73e9", "comment": "Malware payload (Gafgyt)", "value": "d2593e1c2c34b755d79f9121535b57ac13b69eb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668077, "uuid": "8158fe6c-882c-4d5b-9539-394b82cf6fad", "comment": "Malware payload (Gafgyt)", "value": "6e4d7823c1e62f8549701802dd92b0aff355a4ed89fb43ca1d7eb1db65853ca40a510495a0b01df45641e7921c171685", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668077, "uuid": "58ae0b45-90a8-4419-847c-7334f8028d12", "value": "T152734A47AD628FB7C146AAB525A759300723B8215F0F1B89713DAAF8470F8CDB80F765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668077, "uuid": "fd9b03f3-d585-427f-a931-f0be22f4a945", "value": "1536:kAmbedEfIKy1BABWWNxiEVN/Ci3yzTN7mj9VqYLe8f26e:v+eefvyoWWF/Z3Mhmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668077, "uuid": "e3248301-90b1-4d08-b1de-b645e5ce7ca1", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668077, "uuid": "6f22d1ed-8fb0-4449-b6bf-059babbd96a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668077, "uuid": "49dfda03-d75a-451b-8117-2758b797a045", "value": "ffa10046bd8ed799a6a8205cf3eedc06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b35048-9cc5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674660904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674660904, "uuid": "c217142a-4548-4b2f-9534-ba4f2aca9608", "comment": "Malware payload (Smoke Loader)", "value": "9d9ced00194f22bea97c21f421a67832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674660904, "uuid": "a6f19f46-e77c-4536-83c6-b547d6a4232b", "comment": "Malware payload (Smoke Loader)", "value": "2ae29fff50afc21422c12b4e64b055df4d342fb493a667e18b6dda7ad3403857", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674660904, "uuid": "5977557a-425a-43d4-9f5a-2b515925ea81", "comment": "Malware payload (Smoke Loader)", "value": "8e8b04c4a2debf3ddebf23cbd38f990bde8e2e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674660904, "uuid": "9b8603fb-74c4-4eb5-8650-361185753a75", "comment": "Malware payload (Smoke Loader)", "value": "74c32f560e63d7c2a2f1a58f4ddc92f2a5cbe3acec553b5c0891dd3a702bf27bdc4787894739b8c1be7624f7d84a8ae2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674660904, "uuid": "38132788-f636-44bc-822f-9ae2394b53df", "value": "T1FB649D11F2E4BCE1F56DCA318D2ADBDC7A7EB8518E14526A32BC761F29702E0953E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674660904, "uuid": "a0718b2b-fb7f-43f3-9f26-a8a8da4ec414", "value": "8f16ef841269728457dd532b4a807550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674660904, "uuid": "64ca0718-1ef9-4c4d-8ed5-a8ad643075d2", "value": "6144:mLL595Z8Fo2eRo144PAXGq0VvRFBMolz209+2By:eV3+ekzPA10VvR5lzK28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674660904, "uuid": "28d1f394-eaa7-4745-9ad6-0423fc6252cb", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674660904, "uuid": "da2557dd-55b7-453d-a6fe-a2656d9897a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674660904, "uuid": "c05743ff-d2cc-4d60-92a4-589383b85ee1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078d7909-9ce9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kutaki)", "timestamp": 1674676018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676018, "uuid": "dad6680b-19b5-408c-8b7e-9875af239425", "comment": "Malware payload (Kutaki)", "value": "4710472a59fc98d7368b3aa1b719f024", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676018, "uuid": "bd6e8aa4-20ec-4479-8428-3dbc7d539e22", "comment": "Malware payload (Kutaki)", "value": "2c72daa02805c43f5a35ebca409ad1ddcad3c4b244a9a0579d529b722fea9e6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676018, "uuid": "59e0e372-36fb-4606-8281-2599d4455707", "comment": "Malware payload (Kutaki)", "value": "f37094d763df983afce0ab20b49cc4afda0abedc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676018, "uuid": "722f2cb3-615c-47f6-abed-30d422eaa93d", "comment": "Malware payload (Kutaki)", "value": "422e7577824925db5eb3d42fd7ffa55b8bf963fe31056df249f447f41ea84874e3532a7f5ce52705da5a1140415d4968", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676018, "uuid": "d5d15596-21eb-4e76-84e4-7f16e8da8d28", "value": "T19CA4E10B7A910E53DD9E29705E93A6B112B3FD5A0F0A13573594B2AE6833FE14C2934F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676018, "uuid": "82a88957-621d-4bda-a54f-91dc6133647a", "value": "9d1a8964466dde6dc9f777a1e4489421", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676018, "uuid": "0e7bacf9-b11e-4af7-98df-501d390ba9a1", "value": "12288:8U4Tisi646A9jmP/uhu/yMS08CkntxYR/L:rDsufmP/UDMS08Ckn3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674676018, "uuid": "61acde6b-d78b-414d-8314-79c1260523da", "value": 464082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674676018, "uuid": "de618e11-40d4-428b-ae4b-ef69f1a174a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676018, "uuid": "4b7af6a1-8722-489c-9353-d9ceaaf0e3bc", "value": "4710472a59fc98d7368b3aa1b719f024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8329b35e-9c6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674623397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623397, "uuid": "251a33b2-9822-45d2-9a4e-833113247674", "comment": "Malware payload (Smoke Loader)", "value": "37aac94b735f09e835e855e253be577f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623397, "uuid": "aa9c1d64-75f9-4cbc-99c4-d9fc2f7bd541", "comment": "Malware payload (Smoke Loader)", "value": "2c8778095f5579265badc77cac17232acf24ab81af329efdefa98d74d5324fae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623397, "uuid": "3c78b69f-1880-45c3-8910-fe85ee75b6bb", "comment": "Malware payload (Smoke Loader)", "value": "4b1f09ee140257f2367d6b2033ef531e30365b4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623397, "uuid": "978eac10-d8f6-4a25-a84f-48032a81fabb", "comment": "Malware payload (Smoke Loader)", "value": "4477d3017c0b0463f2f296bdd6376c5e2701b4fab786a3e1c2d44b547f96ddd30c208747d75e5d329c5aac57eebc921a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623397, "uuid": "ba01788e-822a-47ec-a7e0-e33e7031b26f", "value": "T10014E0223651C033C9964138483CEBD17F7EF97246B58C9B3B580AAE5F702E25A76397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623397, "uuid": "81c9adb8-e40a-43ff-b14a-3974dd57d330", "value": "5eb8e9ebd49d9ccce156e2e9eb6d0902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623397, "uuid": "31c65771-70fb-476a-8178-9586b47727d2", "value": "3072:4LBN2fTRybpcLYoNra5O8fuOlGIA+vrk7+4wyeRzQ:41KLDNrH8frl0DC4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674623397, "uuid": "a1e774bf-3a11-47ef-be95-ff269ec35e45", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674623397, "uuid": "7c6e2775-dd5e-4875-9c18-51a56d4479e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623397, "uuid": "5abd88d6-8da8-4c25-ad20-fd5d47872ab8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec383c7-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674678688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678688, "uuid": "d5523e77-c2bc-4d96-9668-ce2576092484", "comment": "Malware payload (Smoke Loader)", "value": "5f16061d80003847a5357a8457a556d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678688, "uuid": "e103afbe-862f-4d06-86b0-67b7d4b40d9d", "comment": "Malware payload (Smoke Loader)", "value": "2ca9e2712098e5b6a7e425f1d99c1df463922aa5b67fe587ee0406c8b4b38d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678688, "uuid": "0b440e3c-8899-4031-81ae-98b9eec44384", "comment": "Malware payload (Smoke Loader)", "value": "433c95a69857387778dfd759de0159e9ff6e6971", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678688, "uuid": "7c2ee0cd-fb30-4385-96ac-0b3039af7a08", "comment": "Malware payload (Smoke Loader)", "value": "79f3560e1e257927b0ab808c1d17fe0f1c31b774c4dd24b1f0d844cdca1b715a47bd7b414e102252da78398425b3d646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678688, "uuid": "9a938f1e-2f89-4632-800c-9df1e577abb2", "value": "T19BE4162D1D7A93F2D474F97157E5A4A0FA9F4092B3A7C8A8CDD61BC05F021426DCE12E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678688, "uuid": "234882c2-76f1-4bba-ad9c-e31631f8fb23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678688, "uuid": "481725f5-59f8-4f57-9a06-470e39697b4c", "value": "12288:7bzyOeq+pXp8irmdjXHNOrAe/IuRXG+IF8zISjkKYrub0UAbWtKx7UNzM4VM029:GT8irmdjXHNOrAe/IuBe8dolr60H6tKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678688, "uuid": "ad3cdfce-20c4-4d63-b41c-8a90f524bb61", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678688, "uuid": "2b353314-f549-44f4-916b-cbc225ea3044", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678688, "uuid": "cb82ee8f-695f-4c0d-95eb-72977f515a58", "value": "UTOPIA_PHOTOS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ba6860-9cf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1674680317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680317, "uuid": "f418c393-05fc-4c88-81f9-fb92e7d8d63a", "comment": "Malware payload (TeamBot)", "value": "18bdebe6e0bda0dc91a1b748f3932525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680317, "uuid": "86a97ceb-770e-4816-aaac-b8226ee09595", "comment": "Malware payload (TeamBot)", "value": "2cfeeb0b6fcd50c5ffe0989cbf63230d68bb2c25dfcdf9b56a4bd9f244524607", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680317, "uuid": "07f399f8-e19d-4177-a32c-9a36327896b7", "comment": "Malware payload (TeamBot)", "value": "eb83c5c76d770084d60148bfbb7804ac898470ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680317, "uuid": "7aa05db3-2997-4e8d-9854-f49d186dccaa", "comment": "Malware payload (TeamBot)", "value": "52feaaf3ad3f621ee1238e007cff9985131ba166f243275d5134a2d35a60ec29a91b0f8d026b8941ea344ca63735cc1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680317, "uuid": "b7622a66-591f-49b3-bd6b-68e760d1c7da", "value": "T12B64AE2276E0B8B0F9264635CD1BDBD4392EF8D28F3C775B32C4A61F28722A0D576615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680317, "uuid": "8b52a592-7b2d-4b60-86cb-56bc74f001b4", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680317, "uuid": "a5c40121-4775-4b53-9e5c-54a1f4cfaacf", "value": "6144:8zLMFNUVhp7TcklQUSKw0n++ygUGzjMT3WGg0+MOKXA0HUTV:8zWNczckyUSmnOglPMT32WEeUTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674680317, "uuid": "7e0515d6-6b72-41b7-a1e3-eabc4f164741", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674680317, "uuid": "8a9cfaba-2045-4c6b-be8b-adb689a4f5fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680317, "uuid": "41bcdd12-8969-425c-83ed-ea0d15f3bfae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917fecb5-9cd6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674668089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668089, "uuid": "df38f300-a0c2-436d-9831-a9003db71a91", "comment": "Malware payload (Gafgyt)", "value": "5b78f3c69e76121a6bb30f4e0e007006", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668089, "uuid": "49fd834e-fe2e-4fdf-ad26-cfe825c39d1b", "comment": "Malware payload (Gafgyt)", "value": "2dc57082a28c2d7626dd949bf2a250680d791eca5a1fe825484813c81f647ee5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668089, "uuid": "682eac4f-7993-45e6-a15b-a5931d0d2399", "comment": "Malware payload (Gafgyt)", "value": "2fbe5f5d8555a3e3c2766eed686fafa5816f1dfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668089, "uuid": "37bd471a-ba3c-424f-962b-a14b8e7f2436", "comment": "Malware payload (Gafgyt)", "value": "1bdc7e71eb6b4b60a87386b59f7a245852ac1e5ff864a4b9ef916d30102ce349c78f30e7d68abd08d89e2b7dbfb6bc85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668089, "uuid": "62e96d41-fd6e-421c-a598-a22dcf29bc0a", "value": "T145733A02E652CAB3C8930BB602AB9B664631FD2A1E2B9F59F31C7DF49F124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668089, "uuid": "f6099af3-e63c-47d4-9cc3-26638a4436a4", "value": "1536:nm+c5osQWiKLoxKFn6pD+OTxzMxMmLI2VOCjXUfJRk:45omr0xKFn6J+O6MmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668089, "uuid": "dfd2f98e-3563-47f8-b9f2-b4a6fe92f4d6", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668089, "uuid": "edc2237e-65cf-49aa-b35c-9db1b5040fb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668089, "uuid": "ba7871af-f935-481b-8b73-fba96464e6a5", "value": "5b78f3c69e76121a6bb30f4e0e007006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d6ee33-9ca4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1674646405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646405, "uuid": "97c8a075-926b-46c0-9634-7336baa460b4", "comment": "Malware payload (Gozi)", "value": "519ad22388358bdb0502ab9967c1985d", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646405, "uuid": "b8b2c157-2764-4419-bda5-119e60b9c7c5", "comment": "Malware payload (Gozi)", "value": "2e0c96752e9c4df1c816efb473071c9d962fb5fd0f86d456824778492ca6bf36", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646405, "uuid": "bc7a754e-bc35-40d8-9c57-1fbf948f8580", "comment": "Malware payload (Gozi)", "value": "825da04599b0ad508dcb08ae0dd906ad36d5df28", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646405, "uuid": "bde86334-45e9-4ac1-b614-a59d21deac21", "comment": "Malware payload (Gozi)", "value": "c8e839c1bf00b8f229fb65bee60752962f0501abac3e1e4682c3ab0cd68076c08239134ba7285c7740972d305c99115f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646405, "uuid": "7e14edde-f498-4e16-9db0-bd7d56f3cc92", "value": "T1F134CE836EE4BC61C9264A328D1FCAEC76DDF9025E1867271739DA2F25B03B5C273118", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646405, "uuid": "94ed71e7-c0b8-4240-b29f-9cfa44da34fd", "value": "13743b83cdbed1b091d19518975401a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646405, "uuid": "5535bdc1-67b5-42e6-b528-90ad779674e6", "value": "6144:pCxLvYy7IVQf2JF2qNYihWY8gVmwCOaM8rHtQK/f0:MxB7IVQeSKYihT8gVmw05tQKX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674646405, "uuid": "605352d6-8977-4eda-b9c8-3d7b39ce7adf", "value": 238187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674646405, "uuid": "e9e1ac88-50ba-46ce-aa53-8087f79a78a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646405, "uuid": "0925ca6f-4c85-4dbd-9704-a59257ee9000", "value": "scarica (3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15105727-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Matiex)", "timestamp": 1674678618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678618, "uuid": "5d641f84-65e9-476e-8a4f-573cf9968cd0", "comment": "Malware payload (Matiex)", "value": "b368b4f8ba0c292896547adf2a35f967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678618, "uuid": "769f80c4-526e-4761-aab8-d81700e3ea06", "comment": "Malware payload (Matiex)", "value": "2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678618, "uuid": "3500d7f4-e9a0-4745-aab6-f714e026dcd8", "comment": "Malware payload (Matiex)", "value": "02db58020730eb1fb7169c3d4ccc6f17aa3b6037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678618, "uuid": "e82572a3-420c-47e4-9e76-de4aaabb08ce", "comment": "Malware payload (Matiex)", "value": "45c12cea339b8f8b75d199b69cae32b7b9077062f7c76b7300720c571b17118c7d3cfe0550f02a2be348ed0d5acedb9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678618, "uuid": "69e18811-fdfe-4deb-8764-3a851413e486", "value": "T17AE4F192B3A840C8C06BD674CD605627EA72B8A457346BEF5660CE790F33BC5F83A715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678618, "uuid": "d7c59a8a-b440-4505-ace7-6182f9364704", "value": "755b26ee88bff31382938e00e4a0bfa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678618, "uuid": "1df1f3b9-4e04-40a6-85e5-23f297861e90", "value": "12288:aCe8LxGQ7MRSRAsDYeQBWlWc4b70eU06zTwjZ++R5Mi6/ZVgCp0TLAXZoCzZWpfb:aN88Q7aQjDYLWlhW7JUyZ++R5PyZ5pcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678618, "uuid": "84c5c48b-933e-47fc-9073-d4738d8489c5", "value": 720946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678618, "uuid": "fdff4d7c-329d-4bcc-8845-5e1e78acb4d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678618, "uuid": "745ebd0b-cc1d-43a6-a572-c1ea6889e357", "value": "b368b4f8ba0c292896547adf2a35f967.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca4c364-9cca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674663034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674663034, "uuid": "d9a2428c-aceb-41f6-82aa-e3d8556942e8", "comment": "Malware payload (Smoke Loader)", "value": "b979140c4a09ff098bbc169be06afdda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674663034, "uuid": "9b02131e-59e9-4065-beaf-0619fdd12166", "comment": "Malware payload (Smoke Loader)", "value": "2ee7146b99892cec64940afb22b834fb10470f8bcbf56c734647081b38940c83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674663034, "uuid": "b32ebff7-54dd-40a3-9d7b-0a559eecb0f0", "comment": "Malware payload (Smoke Loader)", "value": "2461f84c06eda2fa217ff4e6650e3252674846c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674663034, "uuid": "51dad3df-ffaa-4466-84d0-5773fb75e5c0", "comment": "Malware payload (Smoke Loader)", "value": "785ffb633507c00505f293ad2a31ccd514f2b9cb52e040aa4f6aa97474ed87a55d65ddfa3a62c7e3573f503dbbfbb87e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674663034, "uuid": "4e7864e6-ac0e-4d59-b01c-4d015775f7af", "value": "T19E64BF227990BA60F8164A368D1ADBE439EEF8D39F3C335732D46B1F59323E0C566215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674663034, "uuid": "a0dd9852-3041-4840-9fdb-77a9c577e874", "value": "8ec76f5c59a9f0c161f9365e55dfcda6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674663034, "uuid": "59afa63e-ef9c-4d2b-9e2c-f9aed6c7da04", "value": "6144:Ub/L2AZ8jw+cXP35HOa6bf9luPCe60+MOKXK/2UTU:UrDZIyf5HOHjuarWU2UTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674663034, "uuid": "6acaca6f-2033-48aa-8462-407a185f9276", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674663034, "uuid": "d3a4afa2-5aa3-4d9a-a507-9c4bf56719df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674663034, "uuid": "564cd442-daa0-47d0-8cab-b530ae30cfe6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20051c35-9cbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674657161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674657161, "uuid": "9d1fdf3b-b2ba-44b5-ab3d-25e67b2f8894", "comment": "Malware payload (Smoke Loader)", "value": "d6714f564775182643eee3f108424ce8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674657161, "uuid": "6fd18641-aa2d-4263-9505-78872971bf0d", "comment": "Malware payload (Smoke Loader)", "value": "2f53bc63dde1c8fe07d1d9002d8985c9e9443cd145e06108911adbf7452e00ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674657161, "uuid": "5c32dd87-7c95-4276-8de2-0086f49409f5", "comment": "Malware payload (Smoke Loader)", "value": "a2b9e86bc71d39a6009f88772ab3b0be156d51e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674657161, "uuid": "55485ede-40a5-4138-b579-74a244a1de45", "comment": "Malware payload (Smoke Loader)", "value": "f6aeb22e7e3b50513ddedd0844bdbf10171237c6bb0be8f97c97d4d6701e9aec4a30e61a4f7b8fa49baa4bb7b083e170", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674657161, "uuid": "36954504-b002-4fdb-94cf-ed274ecbb1f4", "value": "T130649E12F2E4BCE1F51ECA318D1ADBEC363EB9515D15623A323D7A1F29702E1C92A315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674657161, "uuid": "4abe9335-38b0-4baf-8e55-abd0f3a3c044", "value": "8f16ef841269728457dd532b4a807550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674657161, "uuid": "252ad2e2-0a57-4ff0-8840-8a45269c0477", "value": "6144:NYTLK0wxGu3KWHB0wBgUekGq0VvRFBMolz20Opsny:eeLxGcKWHGAgPa0VvR5lz8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674657161, "uuid": "02651b27-b140-4747-98eb-3a10def34d76", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674657161, "uuid": "e0f48318-2caa-4178-986a-12d0906243ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674657161, "uuid": "7d96e467-eee6-4863-9ccd-5ecd1c732b43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0b21fc-9d0a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674690493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690493, "uuid": "4b1282ff-9154-4c08-be0a-01b09ede27c8", "comment": "Malware payload", "value": "24f151af9c9a84a617b54c9b4f9e6086", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690493, "uuid": "d3f2e9f4-1f4a-4c9a-947d-f60b2d28c761", "comment": "Malware payload", "value": "2f7401c6bf78b7e24809d6be840abc63c54095858bd547aa459f3243ac67e8bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690493, "uuid": "4827dcca-e8df-4608-8e6b-75663a46ecea", "comment": "Malware payload", "value": "d2fb3cf8bf5dbe497a4e2c70ffa1c9cfbe0825dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690493, "uuid": "8aa571d6-722f-4999-a3e6-04dc09ccc98a", "comment": "Malware payload", "value": "d9cf1b53d8b04bc7e02b4bdc7ea1d6d56053c5e09625f675827c0f2db664b02293f13ac036c652a48175268a43fee7d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690493, "uuid": "3dc953b2-2d18-4e89-bfb5-4567b342d961", "value": "T14B64AF3275D0B860E91A0A35CD2ADBD4792EF8D28F3C775732C8AA1F19772A0D52E315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690493, "uuid": "08bd3b38-811d-4f0a-8392-87f579e033db", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690493, "uuid": "2232d716-4808-473a-8f88-a4105026d426", "value": "6144:BsLTNL/i2pANHoYqy9uwc5RTY0+MOKXujjUT:BsFLiaUjqy9xc5+W8jUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674690493, "uuid": "0256fa3e-a1b0-4c87-87fb-efb0461e7a74", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674690493, "uuid": "399a07a4-11a8-4c7b-8e81-50a44fcad8b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690493, "uuid": "fe5f5a87-2ea6-408f-b865-4ea5095ef657", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d8a584-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674678626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678626, "uuid": "86bcfed0-d378-4ba6-8290-5257b2b8b7cd", "comment": "Malware payload (SnakeKeylogger)", "value": "2342890d94990def4cf4552015a5404f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678626, "uuid": "4b5577f1-2594-4b16-bcd6-dbb81a25e1a9", "comment": "Malware payload (SnakeKeylogger)", "value": "2f77a0882a1faa6b040bb17d2bc63a5a154835d46adedd98339eba6599974655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678626, "uuid": "edc097d7-8506-4a47-b72d-fbcbf83b9a88", "comment": "Malware payload (SnakeKeylogger)", "value": "bad74af969ac10b199ea64d653cb64d955b45768", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678626, "uuid": "212988d4-6f37-4874-999a-092f1700b1c4", "comment": "Malware payload (SnakeKeylogger)", "value": "0538be4a543548f5c1571fe29aac03d200498b99a61f031abe9b928542d12c58d1c8a4d26a8562d71ad3c8d5fc1a3925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678626, "uuid": "c7692472-14f6-4f5f-8fdb-05d3d012691b", "value": "T16105CE40B2B8EB42EEA48FF5101195A147B22E2BFF24F3645D8272E71673B847E50D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678626, "uuid": "8cfd3d75-4736-4a2b-8d9d-0934e3a3f67c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678626, "uuid": "1dcdfdb3-26da-4b60-8bc5-86a19369d228", "value": "12288:YPr8kyGy+ysyQzjkATGdsQbM6pEh47DyHQPJoL2SGGqCBu99cdMtEwcU3gZ+:I8kyGyOyQzlGptDuoJoLyDCB96AAgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678626, "uuid": "e58070ac-1349-4bd8-99bb-1a3ca37733f5", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678626, "uuid": "edbd3a35-7477-4a37-9889-6486ea0ada37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678626, "uuid": "9bf9e24a-c4c4-47f7-8b47-48735a4e9d00", "value": "20230125 09052394 Hesap Ozeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2b125c-9cb4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674653425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674653425, "uuid": "93fe871d-d729-4681-9a43-5f439cfbbbfc", "comment": "Malware payload", "value": "c3441267a4f584f649c9154a2442057b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674653425, "uuid": "e901ea76-80b3-48e0-99e1-81d4a3081c36", "comment": "Malware payload", "value": "3066d8aee375735ae180cd83974d6a72f98489736e59333798e458e383d2b718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674653425, "uuid": "835cbb59-5fcf-405b-9111-2e4ff6192549", "comment": "Malware payload", "value": "dddde15b0ab014f81a9cec227101843a3da9bead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674653425, "uuid": "b1c94c3d-2af3-4e39-a948-87d29995c3fe", "comment": "Malware payload", "value": "6060c2997f1c995e646a8a0c99889232811ae10b0ef63175946db0c2c3a6bd38ac9fbbc3ad5427b51863dfda7019ab68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674653425, "uuid": "6861c274-8531-4f36-8df7-12fedd1c2059", "value": "T16C87331136FBC1F7C3155531C68C877691B2A7580B298EC367858E2C3B2D2D1CB7B6AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674653425, "uuid": "497a4463-1ae5-4e3a-902e-0b5c626d579d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674653425, "uuid": "3a969db5-354a-4381-a42b-2967ba12c96b", "value": "786432:8xqKeUCAOBiFZl2VtgCVS5kyoUoPQJ9XWwEkwgLKaYqRAS:8teNpiItgp5kyoUoo8pgLKaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674653425, "uuid": "4f6565ec-854e-4790-9bde-f65a99ce75d3", "value": 39184760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674653425, "uuid": "0777d554-b563-4a6c-9ba2-37e0fafc721b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674653425, "uuid": "50a90183-64e2-4982-bd7a-a9e8063a458a", "value": "PDFCreator-5_0_3-Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42417ab8-9c54-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674612122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674612122, "uuid": "6b76d932-aaf5-448e-8351-5c0e71f243b8", "comment": "Malware payload (GCleaner)", "value": "60cb55f5178a191a9c07dd4e293305b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674612122, "uuid": "82fc7817-d490-494b-870b-0d2ae64a7841", "comment": "Malware payload (GCleaner)", "value": "30a7574cee8b90193bbc5d3beacb10b07d208b2a0dbd447926671cbeb6a234f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674612122, "uuid": "bc336402-b8d6-40cd-9a35-4a9c000bf7ca", "comment": "Malware payload (GCleaner)", "value": "c27b543837121cf699e1d96f969735304aa8950f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674612122, "uuid": "5e5be2b3-1182-43c1-9d0e-ca8176da1343", "comment": "Malware payload (GCleaner)", "value": "3f8d0a282dcc10fb66e92a19649161fd40ee1ed4d42d56945e2609e3ef6d80412c1d8d60ab8b37c31551533262d0cae9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674612122, "uuid": "97c72482-7302-423e-b470-2d3ecbd11930", "value": "T1CC8533B9D2539836F1439F325E60EA46986735315BBC9284310C3A7F2F72285BA4D3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674612122, "uuid": "d2d85126-5c6d-4f3d-8d18-cbe33b87585d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674612122, "uuid": "22b920c7-04d1-42f4-a02c-02b09a0c9058", "value": "49152:ZaDKeKCDBcSRLgEcgPjSL/HT44rNViEKUdaySUQ9CutLCgv2MR:oDgtClcO2LRJMm8UHuxv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674612122, "uuid": "5fd88147-2e4b-4be5-8d8d-954bde928a2f", "value": 1810207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674612122, "uuid": "b766ad6a-fc78-4499-a598-83a63a2ce6a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674612122, "uuid": "b68a7b06-f9df-4d0b-afc5-42fa28c6024b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df8d620-9c86-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674633643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633643, "uuid": "c8dcb8c6-9196-4dd7-86d6-29f79802472f", "comment": "Malware payload (AgentTesla)", "value": "a398563c55e12396aa9cd9289daeda96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633643, "uuid": "5f89f280-d99e-48e3-bd20-078d38ce87d4", "comment": "Malware payload (AgentTesla)", "value": "30d07ab66aa0456a13b4b9d0b8a2f01dde9912078d1f2bbdf324e79a81314d81", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633643, "uuid": "7e2b9eb3-90b0-4bb3-9e44-41c1ac47910b", "comment": "Malware payload (AgentTesla)", "value": "e3cab9e399a54de02dfc921e5161c7080d50bdd9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633643, "uuid": "ba2bcbba-c462-4386-b3b6-df349e656cbd", "comment": "Malware payload (AgentTesla)", "value": "75c149d68b90c00837d4bb2c5d810540313c7f83ce4bb4534b484c73e3e4fc9ef219871ac44e04a66e975bc26203a420", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633643, "uuid": "a25aec59-8232-4d82-9ca2-709bf5e572e3", "value": "T129E4A0BD7B5BDD22C0285677C1C7950013B096A2A233DB9B3BCA11E51602BEF5D897CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633643, "uuid": "c2a2730d-97f4-4c6a-9ff1-3a0bc0a50f6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633643, "uuid": "cdcd2b66-a954-4793-a583-d3d21e117a5c", "value": "12288:RiRpPsdFZd2r35wVWg7FbrFu7JyNbU2/O+cYg:uiBdY3yhdFu7OP2+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674633643, "uuid": "cf12e3a5-c5d6-4355-9de4-63ddf93e2c33", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674633643, "uuid": "d09ab154-c30a-4c48-825d-9e4cd8b0fde7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633643, "uuid": "04b7348d-7a11-4bed-b734-07d85bc2adf5", "value": "Pagamento01242023,jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32748f6f-9ca6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1674647314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647314, "uuid": "97fb2b13-2ba2-4bfd-8899-85c98e94a6ec", "comment": "Malware payload (RemcosRAT)", "value": "b1d073104bbfc0210465938d4d83cab3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647314, "uuid": "00756feb-b93b-49ca-b47f-a92ed0cd6afa", "comment": "Malware payload (RemcosRAT)", "value": "32c38d159ca596fc6f8696c7462299312a8b243dd4ea75086946494f5c5cd801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647314, "uuid": "0e7a5086-b4f5-4fdd-b9bf-1e1484b252a0", "comment": "Malware payload (RemcosRAT)", "value": "3d56e396ec24127071e94226c4d5b654ffe3afc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647314, "uuid": "7cef0e9c-9760-4347-a032-43f5eff01085", "comment": "Malware payload (RemcosRAT)", "value": "ba650cf134872bcbe6f6f5a9be6050be3565452947641c749ce73bd2b41ecf6540aeff43124ddeabe3c0ded542e7292c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647314, "uuid": "7b561e46-a400-4a62-813a-319b327aec81", "value": "T1E325E0BC7790FC8EC05B8F7A85141C00AA60A4B31F47F383A05F15699A1EBDE9E556E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647314, "uuid": "a2b67b98-7a24-40f4-ae1e-65ea1b41b793", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647314, "uuid": "741e23a0-cc85-410d-8b9e-b75c84b904ce", "value": "24576:fK9SwdINS9riJ77z47hiGZXJkHrxPdIKkQ2FL:6H9r0778VdzKkQQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674647314, "uuid": "41599144-1023-4a62-82e3-562d533a81aa", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674647314, "uuid": "f02449d7-3022-489e-ae8f-c9f42a25fb8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647314, "uuid": "c4351b3a-24dc-4b1c-b6a0-3079a745e3d4", "value": "Roshan Basnayaka CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32967a2a-9cb0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674651609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651609, "uuid": "961967dd-2d6b-4a20-92cd-e8a011d101d5", "comment": "Malware payload", "value": "98e635250b70206bb73e7af18933be01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651609, "uuid": "2a4069be-1647-4270-9b3a-b20ae9cf72e4", "comment": "Malware payload", "value": "33c3fc186e0437fcbd468994e103e534a6c9da4d32641efa1d908dec77c1be41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651609, "uuid": "ec6ac565-1619-4f30-b37f-098dabf99807", "comment": "Malware payload", "value": "a959a5a95631676d46cb05644ffd45a486f26234", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651609, "uuid": "ec75c112-1faa-4f95-879e-b46bfc5fe298", "comment": "Malware payload", "value": "8281a4840db4f16f2f2af90cd701830e63cf856b5acccb5734b5cdb6c642b796c329beaa35f17ea63104ee74576d3d7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651609, "uuid": "f13ddd92-3dd5-44cb-87f9-16e921cf3a86", "value": "T181A623D0599452E4D0E7871471C7436AB0C13BA99AED4E0A79F0AD221FA0CFF750B6EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651609, "uuid": "b068584f-c441-42a6-91d6-c799b35fc859", "value": "38884057b610520849299965eb44b13b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651609, "uuid": "f9cfefdb-2c4d-4a44-b76b-fa61ac45fc7d", "value": "196608:9FUZi7gdP5R/WaT7fjJJluskCe8esP1CtAd4Nvc6Q:9Ff7m7/WMzjk8esP1CHpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674651609, "uuid": "ddf48f6f-f710-4d5c-a0a1-79b41da80fcd", "value": 9653248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674651609, "uuid": "9f7c9555-cab3-4ebc-8356-39fe29393375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651609, "uuid": "73c9b77a-638c-487b-8f93-cfd0b39e6644", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd507e08-9ce8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674675920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675920, "uuid": "312cf5bc-414a-4bcb-894c-75fc47a3b1c5", "comment": "Malware payload (GCleaner)", "value": "0014ae2d09c80f9523dc0c24773ced8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675920, "uuid": "c8f4b937-fe2b-4882-b64f-92776505d904", "comment": "Malware payload (GCleaner)", "value": "346eba435b9c52fa58603b788182f9d58e138866e5b29b6541ab30a59156d120", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675920, "uuid": "33326411-0b4d-4e41-b3a3-f0f6e450b1ea", "comment": "Malware payload (GCleaner)", "value": "7fc243affd8a9f96fae3971c146300f11d989c3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675920, "uuid": "de8ce782-c689-4530-b595-182d53d0d7df", "comment": "Malware payload (GCleaner)", "value": "3fe7c7699059f7508831045484472edcdb617336b01a197217683f760594a187468b20c0449a1448e3bcaffdb4343757", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675920, "uuid": "c800fe10-df4b-4ccc-bf70-4b02b0f23362", "value": "T11585337390B44533D19BBF34A635E4430A7ABB2B6C7C60D9344E929F535A0E2BE89353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675920, "uuid": "31871b8c-ee76-4936-916d-be18a60467f8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675920, "uuid": "77561755-0d0e-4560-a12e-5c23ec2f1b77", "value": "49152:ZaFN0FKM1Iwd9IOJxAnRBR283nOOGKjnB/LCgv2MR:sN0VIwdniRBR28nO7ARv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674675920, "uuid": "ff9b7ad4-94dc-4e01-afa7-53762c66ec5a", "value": 1785078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674675920, "uuid": "7288b9a6-823f-43ed-b2f7-ac91c3e08771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675920, "uuid": "f1ee4520-9401-4548-a08e-48995010409b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1adf2839-9c6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1674621934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674621934, "uuid": "632dbdc7-af30-463a-ad5e-4a4b9088f0f4", "comment": "Malware payload (ArkeiStealer)", "value": "307832716da4e2f4630508b14803f8cc", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674621934, "uuid": "d58e6d47-eb15-46c4-8415-4ba691dc5cca", "comment": "Malware payload (ArkeiStealer)", "value": "34fbb725cb2dadf927aa711744b2ac462ebfca6545ac07486ff319090727bc9c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674621934, "uuid": "ed932477-2e11-4348-bcf0-4e65fe8a285c", "comment": "Malware payload (ArkeiStealer)", "value": "377ec621b9d9626a52b361430768fe0b64b91afe", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674621934, "uuid": "fa510ef4-f6d2-4585-a767-6ed4406fde4c", "comment": "Malware payload (ArkeiStealer)", "value": "3f9c7800e8ae8879a787d61ab9bc10a63967e6f44c938aaef2a83c6089d4b04297a4c9dbfabe916bfe5cdce766816bfe", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674621934, "uuid": "8c97b9de-1998-4a18-af5f-ffd164b0eebd", "value": "T1264633C92B706A40F35C77772A897EAEC16B6843A3F75E124E568F1A2C4F7CE8749011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674621934, "uuid": "d36ec2ef-e573-47f4-84c5-cba49e06fb1d", "value": "98304:RHDl7/NIwMjgnV1GQ0jwuB0932vzeNoixCjfDXxsFU01netH0CEMm2YhJj:L/NIwMjgfGRwXlo17WFxetUCCHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674621934, "uuid": "17e74429-c950-4e28-a714-8d394cca1223", "value": 5854216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674621934, "uuid": "6f428760-0183-4628-acd6-e9f4c820910b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674621934, "uuid": "25d1b45f-01f9-4e3b-820e-436b91e6c675", "value": "Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052fe6e0-9c9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674642513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642513, "uuid": "13f5c881-6f11-4e7c-934e-59bda4a709e8", "comment": "Malware payload (SnakeKeylogger)", "value": "abb62deff1e4851be179ab55fb65e4a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642513, "uuid": "39cacf0b-cb65-4fc5-9eab-33637b856dfd", "comment": "Malware payload (SnakeKeylogger)", "value": "35a1eb3544b13e48380568cef531dec8473aa229fa4fccc532898b2c514f05ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642513, "uuid": "30815c09-0443-45c9-a98e-4a0aa6ae38bd", "comment": "Malware payload (SnakeKeylogger)", "value": "36d60ff07bcfdbe6c83c69079c954cc655bd9557", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642513, "uuid": "07b29446-1994-4aae-9bcc-28e03eba5eb7", "comment": "Malware payload (SnakeKeylogger)", "value": "0c9b44e6ef4f81ba038ade9289a420dea2cc287fd80804fa226eba1e02cdb50f5224593de3908edd8954f9d4646d5cdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642513, "uuid": "427a3e88-5a0c-4708-b2b8-1d77c5c31c12", "value": "T1ED7239257AAD4B21C2FAC73FF9EAD69342FCD2111823C59BB19023C50D12396D9DA25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642513, "uuid": "f70810b5-a4c5-4b4b-a031-820a0bbc6a86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642513, "uuid": "c3ac475b-90cc-42a7-85f4-f99e8684ef65", "value": "384:eBHyHMiAiIufjm2g6WeLLB3mDTQ8T3Jd:YHyHMi0ufj3H5F3mDF3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674642513, "uuid": "5d48b579-99e5-4887-b33a-658bf10f7659", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674642513, "uuid": "90522437-bd02-4a3c-ad9a-06d39fd2e789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642513, "uuid": "46b0256c-1d7d-4051-ab6f-b2026fe5cd63", "value": "VSL Q88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda61200-9d0a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674690578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690578, "uuid": "ff790fdc-9088-4a4c-9188-dbf5c821a4f5", "comment": "Malware payload", "value": "aa118c1f4cc9d78f0e99398001967729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690578, "uuid": "7bc7a336-2e44-4469-956d-7e7dc4f1b0dd", "comment": "Malware payload", "value": "35aa1f2b9de5a43b2f214a89fd083e875a99d1bb67c2d2066b8914c97f53ad29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690578, "uuid": "fa284424-1a5c-4e63-8f50-c697cc41a66c", "comment": "Malware payload", "value": "435df775bb25c1521cda0a85d1ce4078589423cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690578, "uuid": "6a5497fc-11e7-46ad-a62a-defd5bf36cb7", "comment": "Malware payload", "value": "88aa8147a35b2a12763204cadc180d84253a25a9c89f56a0806b4b0159d2ece1fbfada02c475793cc52723bf458a81de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690578, "uuid": "35c75098-f57f-41d3-bd55-c01863440a50", "value": "T1E776336036EA45B3D08709739D882FD1E0FCFE589E35A4BB6354C63F5D3869AC32425A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690578, "uuid": "3103e37f-9f19-4346-b7c2-e469a41f1211", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690578, "uuid": "6de2a86b-dfeb-4132-b4e7-0fa44cd65f53", "value": "196608:91OBe5e+0vIEqLN2j0zxPDnySXSSpIZMWKpX3DgIMUXP:3OBe5e+0QEqoj0zBySXSSzzX3DP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674690578, "uuid": "ecf6e28e-e210-44c7-8784-c21b240d847a", "value": 7583347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674690578, "uuid": "9fa2a857-2053-456f-b662-a7f5297ec6b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690578, "uuid": "172cc40f-a3b0-4554-ba7b-80c7f2f893dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343a046c-9ca6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674647317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647317, "uuid": "f77cb35c-5a95-4547-a9ea-092c7e85c610", "comment": "Malware payload (AgentTesla)", "value": "861d01503fd3f2258907539fe4f4984d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647317, "uuid": "dc39928a-f9bc-47a6-9378-c3ed89369fc0", "comment": "Malware payload (AgentTesla)", "value": "3671f50c59e91067f6161243ec3e701d87ebfe461dd0c3b8c520f50d8619598a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647317, "uuid": "7789d647-e1bb-46d5-b937-74081633bd1e", "comment": "Malware payload (AgentTesla)", "value": "f2f4a48bc9d48815b090525c4d49e3937a9f4a94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647317, "uuid": "3ed571eb-5d02-4331-b9c5-19f19f347ac6", "comment": "Malware payload (AgentTesla)", "value": "6fd449203f69730cd0876f9b90f6f71b3c6233e766adfd2078290497065cae102001c7caf94662a651840c6c43d21a9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647317, "uuid": "7a6d8ea5-44b7-4c5c-a372-52ff74c07223", "value": "T1826422647AE080F3E09B12351E395792E7B3EC3514B1874FCB007A9CB5A3151E66EBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647317, "uuid": "61b087a2-8b42-4f8c-b776-f074aeca0e4e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647317, "uuid": "1a5aeaa9-396c-45f7-8996-272395c43d24", "value": "6144:TYa6E9nxscxsV0m/GV95UqnZtTmQeJXfe32vEnZclbXnXTGnInit8y:TYi9nmQsFa5UTZqAEnGlbXKnV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674647317, "uuid": "c176a47f-5bba-496b-95a6-032efdd851bf", "value": 311258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674647317, "uuid": "551d9d15-1f13-49a7-a61b-a2ff94e94abe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647317, "uuid": "a2ce3f8b-f907-4fcb-8d85-2621fde42e8b", "value": "ZZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf027ba-9cec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674677634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677634, "uuid": "cf4925da-3799-4211-89cf-134753cef7ce", "comment": "Malware payload (RedLineStealer)", "value": "d10a75722c3552ad4d7e7fe72b813c49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677634, "uuid": "9252c11c-8994-4e1c-a829-3a5297aae817", "comment": "Malware payload (RedLineStealer)", "value": "36bc5cd56024d6a8ad02205402b750973465c54b8c1ea0beb49826c1e0016613", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677634, "uuid": "4ed36c22-6ae7-4de1-8b9c-679a7da32bfb", "comment": "Malware payload (RedLineStealer)", "value": "fc86354270113cce7a63b5135df5f1117478a60b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677634, "uuid": "98afc50b-15bd-4986-99c6-20f468ad71a0", "comment": "Malware payload (RedLineStealer)", "value": "c0f5c9b18e5eec9fcf982c702bf022fbe6432b574dc34e11a9138a5277320ea46ef4b54683c6f3caafa5cdeff234870f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677634, "uuid": "790588d2-7b3f-40f4-b680-65077d5d2655", "value": "T12364AE1272D0A860F91A4A3D8D2ADBD4792EBCD2CF3CF35732D47A1F29732A0D566215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677634, "uuid": "96156d2e-8852-4f61-8181-1f10aed3e67b", "value": "8ec76f5c59a9f0c161f9365e55dfcda6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677634, "uuid": "73052f08-ac39-4a46-b68a-cb3f47265f31", "value": "3072:yGcjgz6sLJh+VV3Ts8R9QezG2O2xIeqF5YzIkJTIMfupiZlmI0+L4Oi/XcLYPvUr:dz/LCVV3taec5sepiZlmI0+MOKX1UTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674677634, "uuid": "cb8fea95-74e2-49be-a7c1-53643ca52a50", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674677634, "uuid": "9fdb2526-4899-42d1-ac5a-30d4238e181d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677634, "uuid": "470c16ab-9d90-4156-9764-d5ae44992272", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e76d37-9caa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1674649205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649205, "uuid": "150a2dad-31d1-4ec9-93fc-0cbe7110618d", "comment": "Malware payload (Fabookie)", "value": "e9c11f0422dc5f113a85a46ca4a2a032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649205, "uuid": "fe0c86bd-73ed-4c03-95cc-415abf79b3b7", "comment": "Malware payload (Fabookie)", "value": "377010ea82f695947354092b9b3f38721740c62019474d2f370221703227f4f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649205, "uuid": "befedb00-6589-4a50-b6ba-0fa400b59095", "comment": "Malware payload (Fabookie)", "value": "23878b3b06a803549a437b499792603975179b42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649205, "uuid": "a9afd3e9-24ce-4d59-97ae-d7e3b6c5fa8d", "comment": "Malware payload (Fabookie)", "value": "fda0557c33fb59b1e30a8b010144e5ee8441652a0c826091d187b240dc9829ec508b98e9e0ab22263a346b5de5251846", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649205, "uuid": "7e539bc0-ab90-49fc-bc3f-9f0f28bb6f69", "value": "T1110602FA629433A8C01AC8785133FA45B2B6921E4BE9D469B2DF76C07B7F450E641F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649205, "uuid": "204fb457-d0f3-404c-9682-a8152a1538ee", "value": "245fbb05d3da4d7c6badd5cc3e1f9b98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649205, "uuid": "7479d60d-2736-426b-9f2e-de5bc929a1f8", "value": "98304:9nWhuq4qcCihf6ntgYGrIazxs1nXNyAVXspjFABY:9cRiQnVtZgAVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674649205, "uuid": "6068afa6-39d0-424c-89cf-9d007d4f51c1", "value": 3662336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674649205, "uuid": "9cf4bb1f-7b79-4f99-97b4-2c9959ee80b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649205, "uuid": "70c966d7-070f-4f6b-908b-e0b728b139ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73b6685-9ce8-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674675937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675937, "uuid": "0dacbb65-2d28-4845-afdb-8980b7b665b3", "comment": "Malware payload (njrat)", "value": "dcd186064deb58cedc952d6349203613", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675937, "uuid": "285b9ed2-8e03-4e7f-a8ad-1d90ac08e7ab", "comment": "Malware payload (njrat)", "value": "389c5a40b358b59713b613000f2131e149bfb274e18717a0e665c2f1d8676576", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675937, "uuid": "e49d14e7-bcd6-40bd-ae91-54519b181077", "comment": "Malware payload (njrat)", "value": "1e3fd131aede371a36004e0315134deb955f22ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675937, "uuid": "562b8fd5-8574-442c-bc96-69280821ab08", "comment": "Malware payload (njrat)", "value": "2154949e30574133a126bf5620929851b170a72765ef3e351d6f2a752834f67d0430b7b0c0cc87732b6b6d108cdbd804", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675937, "uuid": "f3e0ca16-26d3-4152-a7b4-208080d18f23", "value": "T1F96219487BEC5723E63E4BFD18E654004BB5659BA872E71E0EC6A0C61A13F804793F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675937, "uuid": "7c6b0fa8-b342-43dd-8e41-13e4fdc6a4ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675937, "uuid": "7db7db77-1290-4b5a-8fb6-2c3d8785e5c4", "value": "384:j7uU6snA/vKpzJjPgrbmR/qYRkDyJhO3FduEa+Ef2LB:j7uUe5mR/qYRU18Ea+02l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674675937, "uuid": "2969fae1-45ae-48ca-9d99-9bdb45b5783c", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674675937, "uuid": "59571040-5785-4f01-84dc-3f8ce987c415", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675937, "uuid": "77e17cfb-db2a-4a08-bd17-1ad0e13719c9", "value": "Bomolovo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa908d2e-9c7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1674630335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630335, "uuid": "1aed8f48-f948-40d7-b507-140bf1457272", "comment": "Malware payload (ArkeiStealer)", "value": "43c71da016e58aeec10ba93f6298ff65", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630335, "uuid": "d8825ba2-6a1e-418e-9638-6d1b26a73125", "comment": "Malware payload (ArkeiStealer)", "value": "38ea96bb0a7c7f67144539664695bdb02987c7022b835050e2aeb935170ef955", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630335, "uuid": "fea94fce-94aa-4165-bcdc-1be393dd398b", "comment": "Malware payload (ArkeiStealer)", "value": "91ed9873de843809861933be99ee8b97693a83ea", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630335, "uuid": "990314f1-9d3d-44be-b8e5-73835fccd76c", "comment": "Malware payload (ArkeiStealer)", "value": "02770a2848e5852284513984dfe468d77d3d29ce9fa342748f3cf0572258ba2b850302c62553c1cf5977a366f3af34e1", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630335, "uuid": "9478a518-9b7e-4678-a1a2-dc21ead83b80", "value": "T13F748D02E298BE91F499CA318D1EABEC763EF9514E146367322C7B3F25701E1C56A31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630335, "uuid": "cb9a2484-7371-4b9a-8be4-445bff294974", "value": "861af707b319724b1132a7a971c54bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630335, "uuid": "ac9e0ca6-9d72-442b-8426-c7e0a3b68fec", "value": "6144:tt0LyPQ0iqi5JpnjQ7xDFV2qntJ5jq7VWRFBMolz90ci:tmSQ0mtQ9K6Y7VWR5lzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674630335, "uuid": "acb83f8c-4656-409f-a8ae-0356e026971b", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674630335, "uuid": "85df8fd9-1da4-450e-90de-456e286e5f73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630335, "uuid": "ece76b86-5e16-415b-b4de-db3847cfc83f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc20a58-9c96-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674640619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640619, "uuid": "9a19c42b-931c-4783-b088-4de6e29ac9f0", "comment": "Malware payload (SnakeKeylogger)", "value": "d7b4ead6fc37ef7315c0118f8039e5fd", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640619, "uuid": "30405345-4ba7-461b-bf54-03e8f8e8cc57", "comment": "Malware payload (SnakeKeylogger)", "value": "390638174e786d6f8debc631dcd06acf8e06fe5a80f9dbb6cad409794bf70ff0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640619, "uuid": "0ee9a377-27ff-480b-a51e-18522563481a", "comment": "Malware payload (SnakeKeylogger)", "value": "70c4b99344efebdfd15c84543a73387e051d9c6e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640619, "uuid": "856b48fc-3473-4926-af73-6ef552cbfe6a", "comment": "Malware payload (SnakeKeylogger)", "value": "d1e6651bbce550c2763c7bc341462b0c1a6d6c5f334179499294a6ac5b8d991cdb576ed282f70174f423a6f5b6a740a6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640619, "uuid": "0c725a6b-c79d-4cec-81a5-2943ad2a7a63", "value": "T1B5C23B53F7A81379439200E26A1E1BD9FB3AD13933A255A03C9C927433D6C62477A7ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640619, "uuid": "c6987cbb-cf86-40a0-90a3-695c1dcbb0fd", "value": "384:qQMmdOFNYY0aaaIswqPeOrka1+fHQJ+t3rQkRhZgNAStY8hAtGMHM62bIhRohX9s:mFx0XaIsnPRIa4fwJMn8CtGP62E29s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674640619, "uuid": "49b0f81d-848a-471e-a514-16432cd71e93", "value": 27068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674640619, "uuid": "7fdbf51d-669e-4b96-aa3b-36752e517121", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640619, "uuid": "18b75420-b248-48d6-9820-fd3d6a9605a0", "value": "Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c88f14f-9c97-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674640835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640835, "uuid": "c1e64495-a224-434f-9a79-a0ebb2faab31", "comment": "Malware payload (GCleaner)", "value": "f3e47d9ef54b7783e66a3267906c4a51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640835, "uuid": "64227173-fb89-43c2-9fd6-0a01abde4025", "comment": "Malware payload (GCleaner)", "value": "3934b66fb8cbbaf868f60d3d7fd20d38a8069c454e4128ed802b247f9c0cc22d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640835, "uuid": "3585a0aa-e201-44a4-aca6-10c176f1362b", "comment": "Malware payload (GCleaner)", "value": "e2352a47e9c80d619f6a8a8f86ed9483708dab58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640835, "uuid": "be2dfe7a-1026-4918-9bd0-48ed4cccb1bf", "comment": "Malware payload (GCleaner)", "value": "d69d89b5dea4151d9fa5f1a7adedf271b80dc39c60e9ca0106c359370d70106de851914ac273917855b1f9d69d38d392", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640835, "uuid": "b66a27d1-384f-4b73-9eab-40aa8e4e84dd", "value": "T10F853303ED73C076E1539F724A2989169AFBB72B29387160316D952E243BACC049D76F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640835, "uuid": "ba80afc7-4114-404e-b823-2812b3c42534", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640835, "uuid": "c6edf552-ecc2-474a-a39f-71616a59654c", "value": "49152:ZlZbZ4P0MDMpNtEmFmsbk5hn5c9LCgv2MR:NuMphA5cBv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674640835, "uuid": "78a907dc-596a-4f8d-888a-69cb5debb339", "value": 1777629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674640835, "uuid": "3669d160-84e6-4675-8ec5-7fa6476997d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640835, "uuid": "fbe01f14-eba0-4c66-8800-e2bf1de3e4d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bce375b-9c6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674622043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622043, "uuid": "b350801a-cd71-4b33-a821-405218b5d89c", "comment": "Malware payload (GCleaner)", "value": "fcfbf11e337117752875b09e828586ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622043, "uuid": "c971e240-90d6-42c6-a053-73e6560e0cf7", "comment": "Malware payload (GCleaner)", "value": "3b045bfaf8e46d7f1bb267521ecff5ed8c21d9b41ed0c39c0801a49985f4f108", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622043, "uuid": "953dc4f4-3044-4a83-9a20-35733172d4b4", "comment": "Malware payload (GCleaner)", "value": "f7bc059d1ce8d89a63b78038568eb4fdf38c7dcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622043, "uuid": "ba048e5a-86fe-4cf9-8757-8be88584c03a", "comment": "Malware payload (GCleaner)", "value": "ee1416b13f6371d233692dd3a8bc062d51de910650507fbc3d6b09c1d55ff8c40627a0d43278fd54874e993d2c5db799", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622043, "uuid": "427724be-b864-49a6-a272-4b97a93c941f", "value": "T16285330468B08637D107DB7458244DD88F6FFD0936345A09329FBB8E6F23BA4E59876B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622043, "uuid": "6fa6449f-68be-49eb-b564-7c9461209266", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622043, "uuid": "c410eaa4-58f0-49cd-8770-78312a775285", "value": "49152:ZSKA4VBBdhQ9Mwt5GqcazXJscnXgdbVLCgv2MR:4KDBBdhQJ5GPazZsxdbJv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674622043, "uuid": "eebc0586-4e3a-4bc1-bb27-2a7521fe7b29", "value": 1759135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674622043, "uuid": "1527a05f-ab46-4423-a9d2-8f738ec63d8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622043, "uuid": "ab6c4795-5d6d-475a-ad92-cfad990a1415", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61954ea8-9c57-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674613463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674613463, "uuid": "59e87af4-10ea-4ab0-9334-e0076df4c19c", "comment": "Malware payload (Smoke Loader)", "value": "aa38a1b9876f3999168ec5c9a5db73e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674613463, "uuid": "3c94ee28-7e81-4fb3-9cef-ad06ef0b5cd2", "comment": "Malware payload (Smoke Loader)", "value": "3b4253beca8e1b9f9ff5c466364f7022c2012f26144b6921501c48b22363d160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674613463, "uuid": "606ea955-8051-46dd-98fe-436bc1dda25b", "comment": "Malware payload (Smoke Loader)", "value": "b43c9c300341e1cdb89710dc6435a3defd757cef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674613463, "uuid": "71af5120-85d7-447e-afe2-156c70ecfc95", "comment": "Malware payload (Smoke Loader)", "value": "29ff337487cda14018ad49b8132ff1debf3732d2779a4ec1e283b8be1cf968226536c757fa17ef3845d4a04d84f89e19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674613463, "uuid": "5db0fc9d-a4c9-4525-9956-ac2a404cadce", "value": "T1C514E1123A61D037D4E745390C31EAD06E3FF83156A9998F37985A7E1F703D16A3A38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674613463, "uuid": "91ac3b3b-74e2-447c-b821-17439104b895", "value": "5eb8e9ebd49d9ccce156e2e9eb6d0902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674613463, "uuid": "12e45340-605b-4676-9378-642597428053", "value": "3072:ELBN2waRiLFvT5ai5HBEY7bAsuFjMf1izqVNr34Czv:E15L9T5aiHPVNizA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674613463, "uuid": "8a3cf865-ab06-448d-8407-e15f2eb884e5", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674613463, "uuid": "e30329b7-52f5-46df-a54c-65623e531207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674613463, "uuid": "205dd41b-01df-46bf-bdf6-d2db3d83a624", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b02be3-9c68-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674620934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674620934, "uuid": "49858fd3-e599-4c8f-87ae-b5446e203519", "comment": "Malware payload (Smoke Loader)", "value": "6d01312b39d5157400c871a6906f8801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674620934, "uuid": "c2f5981b-0f97-4878-8b0e-d32c15b8409a", "comment": "Malware payload (Smoke Loader)", "value": "3bc40bb94d7a800b31916e7a6c0c411db2d149712b73b745c514f68fb6ee6f9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674620934, "uuid": "8091cd1f-46d0-4c45-a2be-0d65e0f145c3", "comment": "Malware payload (Smoke Loader)", "value": "d6ad50b51ed9a2273f2255bb786dd2c6c00d8491", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674620934, "uuid": "962c53e6-98c9-4a73-b9a6-f6521089eea7", "comment": "Malware payload (Smoke Loader)", "value": "be0d861be7a011ec77a983cee9b23e77e758728a75c7913fdcf75ca1f2c3fba18093168c64b4343d01576d5f4dbef64c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674620934, "uuid": "f7cb4b48-6b88-4f1d-a986-d4af36206b92", "value": "T1E514D022F9A2D032C5A2057D1864EB807B7AF97247D9484F7B940FBF4F712D0562A3B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674620934, "uuid": "2a4213e2-ca14-4a43-b029-8da41f2fb178", "value": "5eb8e9ebd49d9ccce156e2e9eb6d0902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674620934, "uuid": "abc67679-e722-4f8e-b9fb-7bf6b3355023", "value": "3072:nLBN2R+R6yLHWf5L5ZGKGJVgzoWSMThdverscmtIpGUQT:n17L2f5mKG0oWFhdWrYtYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674620934, "uuid": "c8c45e81-eac4-47a8-9d21-e8378eb0ec0a", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674620934, "uuid": "df541ab0-a439-43dd-8eee-5d212e4400ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674620934, "uuid": "7639e396-3dee-45f7-8174-1c43b91cedaf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0232618f-9c9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674642508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642508, "uuid": "f552d17e-cc60-43b2-bce4-d03a441b81c7", "comment": "Malware payload (SnakeKeylogger)", "value": "4b717baf6a9b0c219b44bc5eabc821e2", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642508, "uuid": "82eccb44-505f-485a-a530-e8fc0c9fc198", "comment": "Malware payload (SnakeKeylogger)", "value": "3c3a0a24c9dc7ee7cb4a86ef7e113b9835d4dc2c69b915e9d16f68f99799e4c9", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642508, "uuid": "f8a32322-fc72-43be-9045-7cbe1270ff8e", "comment": "Malware payload (SnakeKeylogger)", "value": "b50f7f4085eda26f6da2398b55ae406ef84f5916", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642508, "uuid": "1ac9bf25-6633-4e82-8dc1-f0fdc6c655c1", "comment": "Malware payload (SnakeKeylogger)", "value": "aee54e7fdd556b9d05642286cc07d26f7f345aef4c00aad6588e4941cc007ed0966d946a5c8fb931c1224b5b864a8256", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642508, "uuid": "234dae78-ce57-4c33-840d-b3f44429021b", "value": "T19782D0CD52F3D83BA86C168881A70236DADDF184A6F446506B2507DFCA14F64D133B6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642508, "uuid": "62d336f1-9fc0-410c-979c-0efd2d540c60", "value": "384:dv2G2yiu/qWbbFYzibCcj7uQSpGy9hUGyt7MVUFFrr/hNpzrrub:deGA/QCOec2/pGy9hUXBZF/jzrrub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674642508, "uuid": "9c163fa3-b14c-4544-8746-35209abc5977", "value": 18496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674642508, "uuid": "9678ba34-0a9c-4d0a-9a34-86ab86d0037d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642508, "uuid": "c96b45b2-849e-47a8-8f83-09350d4e0f15", "value": "VSL Q88.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b274b5-9cbc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1674656748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656748, "uuid": "3869fe52-fbc1-4663-8b6d-dd6c4a7a6114", "comment": "Malware payload (Stop)", "value": "c096f3415a8f5dd9d4fde73cd4d7a1fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656748, "uuid": "9f774bca-a66a-41cf-99a7-2c4aed8b956c", "comment": "Malware payload (Stop)", "value": "3cc84dd17a401fdf7422d561526421908c4b485ac9a967ce4764b4df521745c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656748, "uuid": "3e28df31-9f08-4276-93cb-c0679d64a31f", "comment": "Malware payload (Stop)", "value": "55873c6e1d7cf7cf3c1793c2f17bcf6ef2ffcb61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656748, "uuid": "29d875f8-30cc-484a-819c-43a3c3547e93", "comment": "Malware payload (Stop)", "value": "841e691ddd2af8d222748a32f44950680be3f85be58142e5bf1cfd07cac30fc6d795dfb251174281751b2c97f06cef46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656748, "uuid": "883f94a3-8768-4ade-8bb9-d430d72244c1", "value": "T1D6E42322BAB2C0F2C58700350424DBF6EABB743152BA495F73A11A6D6E717F19E5F306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656748, "uuid": "7ea04d7b-82ea-4f29-8207-d1e44d1027e4", "value": "4ad169539e30f4fdc9cb467ca358dbdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656748, "uuid": "f50f204c-a2c0-4f23-b302-0b3698552657", "value": "12288:lbwlMaTf69BNYuooONRhN0z1tATvERig+aVsKFV30wQ:lszTfuBNWoONtwiMRjrVIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674656748, "uuid": "d9270ec1-d207-4181-a854-6e6eb0fe5431", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674656748, "uuid": "e419e0df-2a18-4965-b857-37ba50a6efcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656748, "uuid": "becb4f71-23e4-487c-bd0f-96d46be035ed", "value": "c096f3415a8f5dd9d4fde73cd4d7a1fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104a82f0-9cf0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674679039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679039, "uuid": "f02e56f6-15b5-410c-b15d-e93725912934", "comment": "Malware payload (AgentTesla)", "value": "a424c5a9d52ef0d143031d99d149a77b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679039, "uuid": "a81e7724-49ac-48fd-a2c8-be797be291e6", "comment": "Malware payload (AgentTesla)", "value": "3d27f2fd8456f08086d43db9fb71bbbf0e79db96dcfac5f7ed3dd49f14878b8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679039, "uuid": "4b85aec7-b390-48dd-af50-32d6338ee768", "comment": "Malware payload (AgentTesla)", "value": "5e4e8df6bf8844ebfdbf7f70e3095fc8b7c016cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679039, "uuid": "cf314ba3-593c-4880-9611-e29dba040228", "comment": "Malware payload (AgentTesla)", "value": "67f6e220cb1d8f7f9de01907a6bc64f86f4578ebe58537b455e15130e29eb4f6da08b28d74bd07d145eeac91a933de50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679039, "uuid": "57940efd-987d-4afa-809a-a41c279828ec", "value": "T13905BF0075F390E3F8C7487A513966CC9E2035526753E23766F83BA462036BFBAD6762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679039, "uuid": "190e50e3-3aa7-4b94-b2d2-6afa4b6a6e14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679039, "uuid": "19b383ec-503f-49d7-9632-96f90c499d75", "value": "24576:+pZlh1cconBuOhjSXs4TNE5wrqhTPVccJg4+/tKj++lXx9E05Y:/4TNywrCPVccJ7B+RZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674679039, "uuid": "70c77c15-44ff-4682-8632-c22113010a43", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674679039, "uuid": "0da2f72f-d5a7-41ce-9d4e-4cb1fe425ecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679039, "uuid": "e4e61ab8-b097-4d8a-8394-0b79aca4666d", "value": "Solicitud de Cotizaci\ufffdn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8cd3184-9c6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674623514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623514, "uuid": "914a83b8-480e-4ded-8a0e-85439eb89afb", "comment": "Malware payload (Smoke Loader)", "value": "883f703789ecc9ebe80bf778a54c892a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623514, "uuid": "8c2d3083-d0ac-4288-a2bd-0a67dcf79e54", "comment": "Malware payload (Smoke Loader)", "value": "3d44f0b66e9ee859f72feb058a02ee417009e1fbcc9de3f5d226004a5baffb2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623514, "uuid": "9d96cb01-cfc2-4a06-926e-00e55fd99840", "comment": "Malware payload (Smoke Loader)", "value": "f053cc0a15dc09aff51fb25a43f1537a47d6c9c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623514, "uuid": "f3a26b59-288d-45ef-b264-ec639282bb0c", "comment": "Malware payload (Smoke Loader)", "value": "83db8f59ac453ff488c1640a1b176c3f8ea6f3887189b106a3198b5423e46cffa77866119612d22998b79b3e579f7e3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623514, "uuid": "72208da4-37cb-44fb-b558-979bb42a7ddb", "value": "T18114E1117690C073F1A205341A70EB907E7AB9F317A889C737981B7E5F706E12A7A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623514, "uuid": "98ea8b93-1359-4732-aef6-ce6681767c73", "value": "5eb8e9ebd49d9ccce156e2e9eb6d0902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623514, "uuid": "919465d7-36ed-4715-8bc1-3b689b2a6a74", "value": "1536:V5uMBN2NAQ3wMZLwy1rusZPK9DlmP415MrlC05kHHyrwAVqzRgXEUUGv/7Mib+cI:3LBN2NBgiL5CsGh15Y5kn0NUGv/xn69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674623514, "uuid": "1d64fe66-7f70-4b00-9b9b-63087d108b83", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674623514, "uuid": "c7e45576-6c98-41d1-9c8e-ae6cd3efe68f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623514, "uuid": "2780db05-1a5c-4757-9225-6e4a74408f89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455a9fca-9cb3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674652929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674652929, "uuid": "a785420a-b2e4-4784-b3d8-5f74c3bcf672", "comment": "Malware payload", "value": "4709d4b7768fd92b708c4ee6f29c93a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674652929, "uuid": "cc504b70-1ee0-465c-8d43-d93952e41332", "comment": "Malware payload", "value": "3d9ac6f9ce5a7639a5a76e3242ffd8ecb12dbbdf1b5d7226778c068926eedd48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674652929, "uuid": "8992f004-382e-4a85-b8a3-8deb47128b78", "comment": "Malware payload", "value": "c0187ff7e6be3a382aaa4d88528a21e65f8e3826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674652929, "uuid": "03449072-dae8-4a6e-a2e6-d55d4dab9a4c", "comment": "Malware payload", "value": "fa298ec80c5cfee000f54f8ab5c0ec0848953e81ffcbde14abde1b7dfdf4276b9207c807ef73bdada8508bff6d8f0a02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674652929, "uuid": "57672b5c-4b6e-417f-a724-facaed84fce9", "value": "T12A763332B7F289B5E8C5A935DE256F95F0A6F740472881F753A05788AD3CE42C60EEC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674652929, "uuid": "a3e6e82e-74ba-442b-8f5f-658c25cba727", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674652929, "uuid": "79b495bd-70ab-49d8-938c-ae03d9c48945", "value": "196608:91OOit6wbhM9xi+NmaZB64QcCAbJxd1w6SnD4k14:3OOSbW3i+kaf64QzQOZD4k14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674652929, "uuid": "9252b102-c759-408a-9ecf-f980b5a40919", "value": 7634448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674652929, "uuid": "4c06f9bf-3125-452f-aa31-bd02a3375f29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674652929, "uuid": "b6d25a93-5f53-45e6-8090-56bf967864e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424fbcd6-9c7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674630161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630161, "uuid": "77bdf23c-b79b-4367-b6cf-9f3e13339ad6", "comment": "Malware payload (GCleaner)", "value": "3991db43bea1b21f4c2e5df9d2a2d407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630161, "uuid": "603b9b4a-5f4f-45e9-9043-f2894a908f4c", "comment": "Malware payload (GCleaner)", "value": "3dc34375a0f1590af2a20cb67a74cf79906ee93c6d83bb1792f4882fa5e79b4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630161, "uuid": "6fd0e471-d61d-41ae-b75f-4c0933e8fabd", "comment": "Malware payload (GCleaner)", "value": "1487a9660d45cb45237c9177506b50967edf79f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630161, "uuid": "5cebba5c-7202-4f5d-89fb-ffad7349500c", "comment": "Malware payload (GCleaner)", "value": "9e6a80170939bf0fb6f2764455acb66bffc548a85454dbb7086c18802dbac29cce8a748c3b4d8b97a04843508c4470e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630161, "uuid": "02d7a787-652a-4cfd-b97a-9dba9f20f591", "value": "T12785330AE516C536C092473419799094EFFFFA2A517CA035205D7E6E6F3B382BA09F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630161, "uuid": "bf5b9208-30c1-42b4-92cc-226901d3319e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630161, "uuid": "f7a6607f-344f-4eb3-9933-bd705f594312", "value": "49152:ZdUtkJ6DKX+R542ckYyf2Hk398gLCgv2MR:7xHX+L4Gou98Iv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674630161, "uuid": "d52db199-4c90-485f-9221-fb0f3469932e", "value": 1771240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674630161, "uuid": "34ccf533-8aeb-4a2a-90bf-b46989f7c4b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630161, "uuid": "847fa38f-7886-4133-a367-dcccf6fd578c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e290dc5-9c7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1674630637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630637, "uuid": "39372d1c-2675-47e4-9c6b-8db48a7172d6", "comment": "Malware payload (IcedID)", "value": "2a11a124eb354924c974b9497e673182", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630637, "uuid": "7cdca630-7e0f-4ac2-9760-0c763511dc40", "comment": "Malware payload (IcedID)", "value": "3de8568bc332a346e9a87f9f360c4b1942ba48c2c5ed655e8a2a608fa67d498d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630637, "uuid": "fdf50567-edf5-4215-bb8f-e43b91e3dae1", "comment": "Malware payload (IcedID)", "value": "dbce2057099fed107891418d7d3ac65151f79a74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630637, "uuid": "ef9449dd-a23b-4742-a8ad-b47e6e914041", "comment": "Malware payload (IcedID)", "value": "82a8540fa74c7322ea1946d9b75f3b6ac7357c0debcfbeb941b1708f238ecc652d96648b0784fafb4babd5df05c6b57f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630637, "uuid": "28dba64f-5d51-420e-abff-030f6d56e702", "value": "T168742952B2A04DB5D063D33B8A824689EF723814D72193CB525F833A2F276F5D93E365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630637, "uuid": "955636dd-33ff-453c-ab41-c056a2dc85a8", "value": "6e34f235de42d6bbfa98671aa88e0e47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630637, "uuid": "d23d2219-cf4f-4061-b59e-d4878ebc869d", "value": "6144:CAHUFNIhsCZaNuaG8Hya5EDZObAnvx7LzKJk3Y1e5KRXmQzFtYVS:3UFUvxaZnaD7+JZCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674630637, "uuid": "aeb16ffe-9fb9-4561-a0e2-fc172531932a", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674630637, "uuid": "45a57be5-f9ae-42dc-8314-b7a457b0efcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630637, "uuid": "172c105e-9ec4-4e4c-a075-dced1e49f4c4", "value": "SetupWin24-01-202317-01-50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7636f125-9c9a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674642274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642274, "uuid": "99a448c0-8546-4a46-ac4a-86c0c2303af9", "comment": "Malware payload", "value": "6b22914d287bd2f6cd9d1af41fc862b4", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642274, "uuid": "ae90afab-c43e-476c-ac96-a4ee8fed0107", "comment": "Malware payload", "value": "3e49c6a60657614c03773864239ed8ef9e8bfd9aea613bbed647265e82007aec", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642274, "uuid": "4089b477-0101-479a-b1ad-f5d94226aaf3", "comment": "Malware payload", "value": "1599c9758807fab8a9986a59a0ee6c63d5d84b2e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642274, "uuid": "d6cc7524-d33f-4ea9-91d7-a80226f17a0c", "comment": "Malware payload", "value": "ea00bbc70f05357b33b35dc3e0a65bfc33d4a4dbf60c22a773b1aa221d006014a781394a3a7bbeecd00ccdefa2255b57", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642274, "uuid": "80de1ef2-a621-4500-9656-58e9c2d2c1ab", "value": "T1A3A4233BE26A9DF31829F4B5C06D46A92CE74C942B394DE0953951B0DBFCDA5F322342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642274, "uuid": "7642e170-d787-4405-994b-a52e196a0958", "value": "12288:xlraKwQBeGHwp2YvCx9Fp9iPg/uwd5jiW6YphZnNHU:fm+HMmx9FyJMi8hZn9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674642274, "uuid": "f46013f0-c9e8-4da3-bd8e-d9c813c6f61c", "value": 477756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674642274, "uuid": "5e5fd266-9210-47f1-8220-36b954d11b1f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642274, "uuid": "e7175b91-a2c4-4efe-9c9a-72a7f72364cd", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce36589-9cd8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1674668726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668726, "uuid": "b0dff433-b0ab-4f9b-bef7-47c9cb4db7a8", "comment": "Malware payload (RemcosRAT)", "value": "a259e8612ddca7148e523632b34cbab3", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw - 2023", "colour": "#DD6AC4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668726, "uuid": "938abbf0-5d91-4f6a-accb-d55509e3576d", "comment": "Malware payload (RemcosRAT)", "value": "3ebf04e423c2733d77b202601502d92bb2118fb1667a19d0684c85246e094721", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw - 2023", "colour": "#DD6AC4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668726, "uuid": "9086b7b2-0ae7-4adf-8592-1e065baea38b", "comment": "Malware payload (RemcosRAT)", "value": "ce3c16edd099bf6e3e6e623331773b1c27bbbcde", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw - 2023", "colour": "#DD6AC4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668726, "uuid": "b513b2a6-18e8-471e-8531-2206db828b13", "comment": "Malware payload (RemcosRAT)", "value": "0d237de25e1fe89f89f86682256399d141d1452a260a1b4d6448a1cce09282b22229dc14bcfd0d25e1511cb07f81fe42", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw - 2023", "colour": "#DD6AC4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668726, "uuid": "07f2fa04-d9cc-4090-8889-d8180642d94b", "value": "T15FB423D4C3E87061E5D2667856223683C0F79746F2AF7A11FA641DD3A206E3B2BB9031", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668726, "uuid": "0e22d57a-715c-438a-a3ae-c84d2025cf63", "value": "12288:l+TU7RvlTsffhGxKXMzDQv2uegF32rjWGWAE6VSECpHfWivebDb:CovSffp8zDgsxWxIVSEQtoDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668726, "uuid": "086fa0aa-e985-405c-a758-88fdcf69602e", "value": 535726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668726, "uuid": "254cb0a7-e193-426c-a90c-f87e01b67033", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668726, "uuid": "fbc95ccc-0052-4793-954a-630f84ec230f", "value": "Boletin_Fiscal_Caso_Proferido_Judicial_N\u00b0_5992842321.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6811af-9c6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1674622338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622338, "uuid": "a8bb8cd1-a85b-49e7-b371-4341b7f8a61e", "comment": "Malware payload (QuasarRAT)", "value": "f6f83ba3f1e87503941e50b3e50d390f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622338, "uuid": "b03132c5-5766-43f0-9f00-3fdeb83eceee", "comment": "Malware payload (QuasarRAT)", "value": "3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622338, "uuid": "fc79559b-54f9-4aad-a540-dd719fa73338", "comment": "Malware payload (QuasarRAT)", "value": "6983d00bc9cda93f0da126504d99a851ffef6cea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622338, "uuid": "888c6a9d-4ba7-4127-8f84-e13f3c6c2498", "comment": "Malware payload (QuasarRAT)", "value": "ed9d900eed00564074ce11c4611f811142ec191fbaca55834b1f6ac3677742587c1cc672ff5c5e1e4489d0addd7cb827", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622338, "uuid": "d69b78ee-4ff8-4a09-b50d-1c91368fce17", "value": "T17A7217E16A6C4B20F625F77FE8E6ED9447E1F2618C53C81EB88113864D13367CA1E3A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622338, "uuid": "c965dcbd-45ee-433d-a19b-fc01c9ca678d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622338, "uuid": "f8e0ca5e-d95f-4308-b9bb-618fddfde8f6", "value": "384:O0CqWx4t+dWNzuY7/aAygucwhb6v/uFi:O0CL4sBTguJmei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674622338, "uuid": "72402927-c65d-4326-be62-880baf82b0fc", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674622338, "uuid": "d7f55235-f693-4c6e-95f0-c8bc0440497f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622338, "uuid": "d9e5caaa-5fa5-4593-abc2-1eb186587cd2", "value": "f6f83ba3f1e87503941e50b3e50d390f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40467b39-9ce8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674675684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675684, "uuid": "c01449da-8d1b-466b-9f69-c49078852b02", "comment": "Malware payload (Smoke Loader)", "value": "b677aa640c469d7a2decf2109abe7444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675684, "uuid": "5576e242-c76e-4f72-a444-b3174e6edf12", "comment": "Malware payload (Smoke Loader)", "value": "3fef2c3527344255b378f175635c2fe38ea28a6b0235d0a2690b9213e99c3561", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675684, "uuid": "2a023979-4cc9-4673-94d0-deea676a6f34", "comment": "Malware payload (Smoke Loader)", "value": "559f267a793bb219807b43926c6a2bfbd5d9a9ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675684, "uuid": "4bcef98e-8157-4539-954d-8a675193ed6c", "comment": "Malware payload (Smoke Loader)", "value": "64d35bfa6b3111545af9b61324823fd69a02dbbae4c763280878262db29cda7f9d9ac00e987af28e1949e6277daa8f9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675684, "uuid": "c326de36-51e7-4205-b0a5-0268e0627bc9", "value": "T14A64BE2271D0BC60F9154A76CD2AFBE4396EF8D28FBC735B32D46A1F19732A0C126615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675684, "uuid": "3a1a5afd-f6a7-45ad-ba74-b6cb9ba3d81b", "value": "8ec76f5c59a9f0c161f9365e55dfcda6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675684, "uuid": "7746a23b-105e-452c-93c5-2f22a7c70dd3", "value": "6144:IHWLRz8BDn3v6YdCWrm3Mu0+MOKXQY+NUTn:I2F8V6YdBrm3tWiUTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674675684, "uuid": "2a878d08-eb15-4a1e-955e-4be08484034a", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674675684, "uuid": "8c593d69-fd78-44b9-b958-52155f41f732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675684, "uuid": "1a00ad1f-054e-495b-b157-3d4522eae201", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1709660c-9cdf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Dharma)", "timestamp": 1674671749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674671749, "uuid": "d4468911-aae2-4932-ad09-f1ecf1dff744", "comment": "Malware payload (Dharma)", "value": "8bacbf2e386dbc47af1f1390e1bdbbf7", "object_relation": "md5", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674671749, "uuid": "b1f2f5cf-b656-4edc-a391-863b52ee8553", "comment": "Malware payload (Dharma)", "value": "40ca770fe8a5c994872adf7e0f72ee131960ef65d34b88a66d7047b29f763055", "object_relation": "sha256", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674671749, "uuid": "2a8f5309-e1a7-4f73-91db-e783ce3fb974", "comment": "Malware payload (Dharma)", "value": "1101a108e9ae5aa0a0b905dd3cbbbaa05b7dd41d", "object_relation": "sha1", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674671749, "uuid": "1efd811d-5d71-4316-9aa2-52143409930b", "comment": "Malware payload (Dharma)", "value": "5b001465447b205b349359441a3a8f319824a4a4ee3d8dab42c3ae42e419af4213ade48b941b43540f87d24a9f130628", "object_relation": "sha3-384", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674671749, "uuid": "35647b51-9716-452d-92b7-0d6f50e97b9b", "value": "T110A50112B2D05933CF67163D9C0B57785D29BE11EA685AB26BF51C0C8E38EB138392D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674671749, "uuid": "f72244d5-41fb-451f-92fc-ed9cdb8cf449", "value": "ca8a968818883f4b47dacd6943e1ee04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674671749, "uuid": "dc5731b0-3eb9-4cc5-815c-a4388b9b752c", "value": "49152:VnWl+qXj1FhW825PlJ0TJcttcCmIf+u9YZrpkN:VnWlRjTo82Pb0c0NZrqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674671749, "uuid": "683f27b9-e4f1-4c8a-bfff-f8a65052ad7b", "value": 2065408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674671749, "uuid": "fb5d063e-ebe4-4fd8-9587-e521c52ac1c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674671749, "uuid": "605cfccd-d168-4ee1-9c26-355e64439a78", "value": "40ca770fe8a5c994872adf7e0f72ee131960ef65d34b88a66d7047b29f763055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d64db3e-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1674678847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678847, "uuid": "51db1d44-42a5-46bc-b823-450a6a06c790", "comment": "Malware payload (Rhadamanthys)", "value": "a07b8499a4e8ffad461634e74daf7862", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678847, "uuid": "3bc90156-aaa0-4a5b-9d00-5adf4ca4ca2d", "comment": "Malware payload (Rhadamanthys)", "value": "450275dd4939c82e54d0c4567222ae4dd81ef7ef0b25e1a2ef5ba36612d75ab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678847, "uuid": "0725d3f9-091c-407a-898d-329f792d06b4", "comment": "Malware payload (Rhadamanthys)", "value": "c44e98f0a5110b36fecbdc01d2f0cdb7802b4bad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678847, "uuid": "fc3098f7-451d-4303-912c-211113954067", "comment": "Malware payload (Rhadamanthys)", "value": "2acaf51b3462e179cc7de3296b4cb097aa08f48d7821ac4b080c400111103fd752fae9ded56b2b2fed4026e6d09c2650", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678847, "uuid": "85f60945-05e9-4706-a231-98ebdfcb2927", "value": "T122E1C500E39C4337CE364B7AA8F353402B79E651AE57DFAE6894715BEC127850A637B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678847, "uuid": "273122a5-684c-4ff9-ac3b-b1174ad5040b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678847, "uuid": "eea5129a-f3bb-48d4-bb1c-18438ddabd5e", "value": "96:EpF6pKgeeU6aw0HSC+HJpkLnTKtUCuRsul1UxkFkPmt893ozNt:m8stP+HULTKt4T+Pmeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678847, "uuid": "9f4ae4b2-b6e8-494d-a3e2-8aaa187b215f", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678847, "uuid": "79cde734-e3aa-48a0-b744-6fe95edbf3cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678847, "uuid": "94762577-bdbb-4d3f-aced-58cfec5097e8", "value": "a07b8499a4e8ffad461634e74daf7862.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f90b70e-9c92-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674638826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638826, "uuid": "9813934b-1a9e-4356-9ed9-8e18751f6a6f", "comment": "Malware payload (Mirai)", "value": "073d963c3fab6206856e526d6432c074", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638826, "uuid": "260e6655-b82a-4978-964f-99909e0e4d8a", "comment": "Malware payload (Mirai)", "value": "4513fe253c9fafa06613a9dfe4a9c7368fa9422d9655b1444aa627ef61ceeb55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638826, "uuid": "5b6a8805-db5c-4014-8d27-12798338c48f", "comment": "Malware payload (Mirai)", "value": "602cf26ddd9925c0e3295c2c245638b14cd30d5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638826, "uuid": "b2a83a5e-12d3-4d6b-9b59-0d1310a56193", "comment": "Malware payload (Mirai)", "value": "9659ba12ffb2ca641d07c4cac18f2299b39d542b4c68f122f61c879071c7c4121d8d83315e61eb0c906f22fe58d83322", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638826, "uuid": "6537ccf3-0ce6-4cf9-8e56-d97d64fd9d7c", "value": "T134634AD6B8019D7CFDDFEA7A88121A0AF121735514930F37A76AFDA37D322A59C12D02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638826, "uuid": "2f208ba3-c51b-4115-a0c8-9e39618dbe0c", "value": "1536:U9sxwKNMH3UEVcvJLDABggHcPP4zLtcV8il6pjhp1EkbxvF:0k8cvWggHcn4zBSApucr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674638826, "uuid": "31bb02d4-b8a6-4102-af19-7b40ccebb0e7", "value": 66740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674638826, "uuid": "ee13a4cd-54ee-4a76-95ae-6a511403f4f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638826, "uuid": "a862574a-d814-4246-b7b1-4bc0b96db8a3", "value": "073d963c3fab6206856e526d6432c074", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465ccdcf-9cc5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674660662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674660662, "uuid": "c1b891d5-3d4c-4294-aa48-78af6b6249fb", "comment": "Malware payload (GCleaner)", "value": "3631f02786e449349de5ee902a5993e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674660662, "uuid": "8fdcff57-e4ca-4da9-8a7d-ec9ad9bfcd03", "comment": "Malware payload (GCleaner)", "value": "45512573af08255e1324d3d7e2c09ee67e85e389231d92a427f647191e999560", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674660662, "uuid": "3d2afd7d-1f01-4ec7-b949-05e289246808", "comment": "Malware payload (GCleaner)", "value": "ca74abc1d2ea2c4ddd5279a59de54f395384af8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674660662, "uuid": "d6ea9597-9c70-42e3-be2c-8802052abc75", "comment": "Malware payload (GCleaner)", "value": "c09b29fd54238e8da5bf53348b1dbee46a30cdd5c4e07e4c1c3045c2e071b684b33fe06b18674bc56f35a9ca58be30b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674660662, "uuid": "99754921-d5c0-4a77-bd86-b5d2c73b1070", "value": "T17A853383585289B9D1A5CF7B2B454A09423E75212676030D350FE39F6E23BB19C9FBF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674660662, "uuid": "176397cc-1a31-49c0-b55f-d31e5ac50f3a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674660662, "uuid": "4a7084fc-b7f6-44cb-862d-1128a94e6709", "value": "24576:Z3CPbg1hMur6E31yoztBlURv/ZYUrkTurmjoE9eN76iVvJhwcZAvsT/UosOM4LCU:ZATi6E3tcB4uU7OJVZusT/s4LCgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674660662, "uuid": "f18335c3-afe5-4b7a-aca8-bfdf57abff9b", "value": 1814978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674660662, "uuid": "68ffe529-99cb-42f4-9d29-888347cfdfad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674660662, "uuid": "43dcde24-075d-46f0-afc9-c731a690bd09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1453bf7b-9cf0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1674679046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679046, "uuid": "f98d96ec-5e29-461c-bcbb-b7cc34181d61", "comment": "Malware payload (AveMariaRAT)", "value": "fed3d92fd978feaa82958a4681107198", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679046, "uuid": "c7926dbe-3d67-421e-bd8f-163f9d08155d", "comment": "Malware payload (AveMariaRAT)", "value": "4579fce194d2ddd7a59d94c4942ae43218d899e0af9665c4672c3af49eaf07f3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679046, "uuid": "b3ad20bf-436d-4992-b227-0d5af1254636", "comment": "Malware payload (AveMariaRAT)", "value": "d8deeabfd56131e502629f1e8281a0f78d34fccd", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679046, "uuid": "2031952d-26db-4ee4-ac8c-06e6d1e97a2f", "comment": "Malware payload (AveMariaRAT)", "value": "e7b3c9883ac0d91616d585a331e45fb6548f88c2cef5eda8ce5fce449a742630799674c32990b4782d45b82dec36f1fd", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679046, "uuid": "567f0960-8656-4c68-80d8-0c171977b988", "value": "T11665BFB876047DE6266F576BDA96ACDD03B617239ACBA4CC80647BC305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679046, "uuid": "928109c0-1446-459d-846b-52cae6be4218", "value": "24576:JjB+o0P87ID6jsXBko3ZAKwzYDZ2i6ZvRp2H+Px02TmDEpvJrFvs6zDlYERlQMgf:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674679046, "uuid": "cddc0ee8-d52e-421f-b02b-21b0d7d90ae5", "value": 1469741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674679046, "uuid": "7c4de35f-2a5a-4877-b5f7-11932e45d5e3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679046, "uuid": "3a8466a2-795c-4d9d-a2e4-7d93f9f56cbe", "value": "offer-25012023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3350405f-9c95-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674640014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640014, "uuid": "ca2778a8-2465-4a78-932c-c6197869db63", "comment": "Malware payload (RedLineStealer)", "value": "6e3dce0a73703f0eb11c9d556c945d75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640014, "uuid": "d36be9a3-2fc3-47c8-8d92-4589b3fe2cac", "comment": "Malware payload (RedLineStealer)", "value": "46642e783a047c0cc9e9acebcaa242dd1dab97e478e567c129178495a5746e62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640014, "uuid": "741d284b-89e6-4958-920f-02e0689a76e6", "comment": "Malware payload (RedLineStealer)", "value": "b137ec327a16c95c12dbeda06119d1114255ff1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640014, "uuid": "f22f2fe4-e0ac-48dc-92c9-ad594a1ec4ec", "comment": "Malware payload (RedLineStealer)", "value": "cecfa05c5518d9ea0792c4b8c11d8d17cf03fcd0b05d1d338d89b91d9b96f51332fb7a1d47ace7330764a36878a115db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640014, "uuid": "77c92ff5-a160-4237-bfc4-abea7d3e976f", "value": "T1C8748E12E2D8BA91F59DCA318D1EABDC763DF9404D356B26322C7A3F25701E1C16A31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640014, "uuid": "7cf180fd-840c-470b-ba04-c8c76828b117", "value": "861af707b319724b1132a7a971c54bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640014, "uuid": "88d028fd-7e4f-482a-86e6-e398c852d056", "value": "6144:HNLiig5upmhcIXhyXG5h0HvqxDjq7VWRFBMolz90hPl:tmvtXLj0PqQ7VWR5lzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674640014, "uuid": "cb6b3d78-dcb8-4637-a3f4-2de7607f855b", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674640014, "uuid": "045cf00b-90e0-4409-9a00-f010ab970086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640014, "uuid": "42fdd558-461a-49b9-a8e7-d69c2cb42a27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d55735bc-9cad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674650594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650594, "uuid": "dac469f6-2b0c-4452-8ba0-320a714e7cd7", "comment": "Malware payload (Smoke Loader)", "value": "9da8a28a4152ab0b199d38eb7bd3d442", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650594, "uuid": "779111f6-9ee4-4257-88b8-728c2980f4ce", "comment": "Malware payload (Smoke Loader)", "value": "484de6cdd53419b9670d33787dd72608bcf5f9dd315eeeb9bfbd463c2740976a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650594, "uuid": "c1d04020-bc22-4ea6-922d-16fe14b659a2", "comment": "Malware payload (Smoke Loader)", "value": "4dfbe71279ccd8d51b0e1467b9e7d4973d38c52b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650594, "uuid": "514bb97f-7978-4af9-9db3-072722f8969b", "comment": "Malware payload (Smoke Loader)", "value": "25c316bd85fca146ea8a6d673beac54581194cf911503f47dd7b0b4044363cc7bd8537e57a77d3c923afb1aa9c4104a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650594, "uuid": "71629de4-f43a-4be9-aab7-cec6ba84e5b9", "value": "T178749E02E2D8BA93F999CA318D1EA7DC763DB9504D147726322C763F19701E0E52E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650594, "uuid": "d03ee208-7bf5-442d-9aad-0e2e961861f6", "value": "787cd3f7e6d0161bfca0cbd92375e751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650594, "uuid": "2956172c-d164-4235-b9ed-8b558355b02d", "value": "6144:uLPyeGlJBQNeqtTI5Avup4L8NOjq7VWRFBMolz90M4m:uDy3l/QNeqt8evup4G7VWR5lzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674650594, "uuid": "62a2f3e8-572d-424b-8a8a-48f639f06c95", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674650594, "uuid": "6923e28b-e151-4ce2-8395-5cc987b887f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650594, "uuid": "9403a07f-953b-40a5-918b-fec8ca0efbbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30aac8f7-9cf7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674682100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682100, "uuid": "875b52f5-163d-4903-8faa-ed647e9f09d0", "comment": "Malware payload", "value": "41052ee3b52462f648df50472e42a374", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682100, "uuid": "0b34af24-9c54-4992-bb74-603a08b37a63", "comment": "Malware payload", "value": "489ceb676e0e15e5e5c277ccb679b4508c7ac746e36ec21d4c7d9a52f8f1c88b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682100, "uuid": "a44c228e-80f7-4154-bb54-746d7349c12c", "comment": "Malware payload", "value": "806b179f76975ab262b032682cb7af06ba3ae47a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682100, "uuid": "b239a0de-e689-45ff-afcb-9cc8dfdbb4d0", "comment": "Malware payload", "value": "3e80f6c6c6074c2a78fd9523743d3a503b1c9313d96717f7687e3b9f08e96d9b6f8aa94142e19afb47496523b8658d83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682100, "uuid": "b4dd1b4a-b07a-4864-b646-2d5b06ee39cb", "value": "T1D305D05072B8EB02EEA48FF5101195614BB22E1BFF24F3645D82B2E71A73B913E50E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682100, "uuid": "c953048a-a6b0-411c-8057-2bbc2f9e0f24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682100, "uuid": "9a507234-e052-4564-81b2-947e78431e98", "value": "12288:rbr8kyGy+ys9QzjkATGds3MtEwcU3gZ+jt/TKbnusLVZq01+VQOoHL5:b8kyGyO9QzlGI6AAgZEVKVZqamoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674682100, "uuid": "f1990db0-ad54-400d-beec-d737d1f4163f", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674682100, "uuid": "efae06e9-29fd-471b-8919-a92f0dbabbd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682100, "uuid": "843ec7fd-1e67-4a2b-b476-54af6eb8e774", "value": "41052ee3b52462f648df50472e42a374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ac8897-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674678988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678988, "uuid": "9276f2e6-6b68-4320-b62b-e7a7f983f827", "comment": "Malware payload (Formbook)", "value": "9e6edbb8f896b118663cfa8c0e2e8849", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678988, "uuid": "70d24d2c-e579-40e9-95ac-aaaacc8b3b96", "comment": "Malware payload (Formbook)", "value": "48d4d0c2d682bbc507a63901694ca44bf3a6371895cc14f485eb9c110c8e4fb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678988, "uuid": "89a7bd4e-6e3a-46d3-921c-2cc5bc1f7dee", "comment": "Malware payload (Formbook)", "value": "f022840a47edcb7782bfed617789a9628417de45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678988, "uuid": "7b63bc3a-5879-4db3-a2b9-950e095d069d", "comment": "Malware payload (Formbook)", "value": "60f9e8c8b433690039362260d5659226509650ee9e7390e1872dd3f05c03b0f5fef55ef65475886cffba26e455df9bc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678988, "uuid": "4128b27e-4196-45d0-bc42-bbeffc91c752", "value": "T1AB7412B830D8D84BD472A7B11E7917A99EDEED0718B1734F2F803A4976356A0D32E361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678988, "uuid": "cdebc818-38a0-4002-bebc-f7bc2b293a68", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678988, "uuid": "cfb29b1e-35f7-43e0-8f86-429bee1c7765", "value": "6144:LYa6KGCw/94IiNF4K24QbDt3eUMs9nJyacdjtMiA1g2R8TCV60w3qDE6cgv1wx:LYsW/94xN121bBnf8tMbHHU0vDEevu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678988, "uuid": "7beea69d-e273-44db-8ed4-781fbca449da", "value": 351253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678988, "uuid": "6cef356f-997d-4a74-b8fd-d36c4b1017d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678988, "uuid": "6cf8cc7c-d952-4699-86c7-6c08705b27ba", "value": "9e6edbb8f896b118663cfa8c0e2e8849", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5adc5b-9c89-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674634984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674634984, "uuid": "25e08f16-476f-47d4-9c27-51addbb263ba", "comment": "Malware payload (AgentTesla)", "value": "eb34e736d909e239abf1db8b97c89665", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674634984, "uuid": "46d8083f-69a5-46f2-97d7-a117f5d36410", "comment": "Malware payload (AgentTesla)", "value": "48e56120cc1a4db88ce499eccae59f50fd009f98d94ecdc6a14344209e3755ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674634984, "uuid": "37c728b9-0fb9-42fd-84c1-6146c7034eb6", "comment": "Malware payload (AgentTesla)", "value": "1077f24fdd8e07a8351ee0df4b8fb5b967e9d7a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674634984, "uuid": "a22215f6-53b2-4754-9d5e-1c7f3c502ec1", "comment": "Malware payload (AgentTesla)", "value": "3e4f8d9054ba2bc4895430c92ed001f6a22e06b8879f3469578ad16da62c8794ca00e2bf7ac1561e31c77c47e4dd053d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674634984, "uuid": "62e313b3-7d38-4e5b-bf72-437abbe941b5", "value": "T1778423819C77D9192F041D1E2DD283B427CCCCC6BAA8EEE627B59DF2493D66149B2C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674634984, "uuid": "6c9459a8-e2f0-4714-b2cc-bd39ac5d38ff", "value": "12288:CHfvvKDEKHWurQu8B4BDrUDQ74jrKlBAlFFHT:CXiDEBurl5kXKlBAlFFHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674634984, "uuid": "6c8e7a87-16d6-47dd-a7b8-6515464d79c6", "value": 397054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674634984, "uuid": "d1551377-c493-4a40-9554-7647bfb9a429", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674634984, "uuid": "b77d1ae9-d325-4ad6-8f14-de2a705c862b", "value": "new order 00029485886459966 dated 25012023.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d30821-9cf7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1674682132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682132, "uuid": "8ce01e74-6812-40ce-aefb-892c125f6657", "comment": "Malware payload (Rhadamanthys)", "value": "a0e5cdd648a7dd0e03ba84fe9a52f7bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682132, "uuid": "db9a2a6e-de3a-4a26-84cc-98507f15f2a6", "comment": "Malware payload (Rhadamanthys)", "value": "49a4c9b865e272372dc2c42f4e23861637616f84ee08b007786e3baef4af936f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682132, "uuid": "e6951eb3-f74d-4845-8d8f-56ea9dae165e", "comment": "Malware payload (Rhadamanthys)", "value": "48fc05de8a1f0be4abc79996d48f98058560226b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682132, "uuid": "9dd11551-4c79-464e-920c-76956c76b5b5", "comment": "Malware payload (Rhadamanthys)", "value": "45de9448bbd78cff36604f39ac5cc28426c4a6887e92a8e96fc23462ab8563e01a459fc276bc526b096918d981935c08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682132, "uuid": "a05dbb40-e212-4910-b3b8-f335351e1fe8", "value": "T11584CF2271D0BA70F9174A75CD2ADBE4792EF8D28F3C765732C66A1F38722A0C166215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682132, "uuid": "a850a2ec-eaa5-4aa4-b6ea-15d86c797b69", "value": "8ec76f5c59a9f0c161f9365e55dfcda6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682132, "uuid": "b355e1ae-b9ca-4598-a3e5-817ff94ef3c3", "value": "6144:+RdLuDtwFQpqqC+wB+T5lyramnswCZFI9W0+MOKXIAUTn:+zgt9qqHwBwbs0PrW5UTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674682132, "uuid": "66253b53-cf01-49cd-a9e1-765905f79f77", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674682132, "uuid": "9046f04b-b692-4303-9511-dda3c652d92b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682132, "uuid": "cfa861e4-2bba-407d-b273-88bffb5e694b", "value": "a0e5cdd648a7dd0e03ba84fe9a52f7bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed59c3c-9c7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674630906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630906, "uuid": "02041d77-da7c-47e4-b3b2-7f6e9abc149e", "comment": "Malware payload (Smoke Loader)", "value": "6dd2757a88ca2f3f518abc4faa89b874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630906, "uuid": "f771de0c-689b-4e5a-87e3-fbfcfb7a36ff", "comment": "Malware payload (Smoke Loader)", "value": "49e2d97e83d0f6a4e00b631fd11a3e72fe5d43478d14d90af3e99384d6320efb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630906, "uuid": "d2453c69-10fc-4777-87fb-013fa1f6c7aa", "comment": "Malware payload (Smoke Loader)", "value": "7cb4d920e056dbcc260d0d3c4292a39e66ecb1a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630906, "uuid": "1b78c105-b7b3-4398-925e-f1b3db599f2b", "comment": "Malware payload (Smoke Loader)", "value": "a2d5fb4c4f26a8c1b71361643d9b28b5460c34408d7f62b7c1129faba9b722b187e7838bf3b79d9fcac1a29c944f50e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630906, "uuid": "0346fe4c-d244-488e-a847-b389e7463153", "value": "T1FB748D12E299BE90F8D9CA318D1EA7DC763FB9504D186626322C7A3F35701E1C56E31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630906, "uuid": "5838edb5-a833-4d50-9b9e-e76bac63e846", "value": "861af707b319724b1132a7a971c54bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630906, "uuid": "65723685-f0a4-4f5e-a626-4b00bf2b4753", "value": "6144:KKLe+69fPyFLOuk1yJbCQYs3jq7VWRFBMolz90W0j:Rv69fP9PZ7VWR5lzT0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674630906, "uuid": "e76db8c6-a3c7-405f-977f-bb53751ad9d8", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674630906, "uuid": "bed0f71f-4b93-4d24-aa4c-10f1ac38cabc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630906, "uuid": "96586bfd-77ac-4d69-86fb-cbcdecb21da4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75567a1-9c91-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1674638490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638490, "uuid": "cca74a7e-6100-470a-8864-0a49e2e8830a", "comment": "Malware payload (ArkeiStealer)", "value": "fab26682ba1a848484d1b6ebda73106d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-55500", "colour": "#F85036", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638490, "uuid": "46ffc16f-076c-4e62-ac80-05798f54ee57", "comment": "Malware payload (ArkeiStealer)", "value": "4a09459d095915e4ea732d5fd9aa453e0a05603baa711696bcc9c9f479cbcecf", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-55500", "colour": "#F85036", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638490, "uuid": "0765d4c7-eb03-461f-904a-0eac067227d7", "comment": "Malware payload (ArkeiStealer)", "value": "c0f7c0704bf5fc937fba2048c6c45ad25a970fde", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-55500", "colour": "#F85036", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638490, "uuid": "4c4cc49a-0ce2-41c7-903a-c1c6a9ce0df7", "comment": "Malware payload (ArkeiStealer)", "value": "968268d47a8047139bdb7834b85e3c157417a332fa2fb681377152e524b811490fd64cb7f0120641baaafbc96ed607fd", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-55500", "colour": "#F85036", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638490, "uuid": "934898fc-57e3-4efe-81fe-587714ca19f3", "value": "T1421633265BD6D8948EF14444F421A48DCAB7192AB065F4F11B882CF3FE67FA36FE0485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638490, "uuid": "cf96da0b-18f1-4ca9-a7c8-80ecf857bd0e", "value": "98304:S4gq6GfAH3NqJseMsfLJk/PtYZPD4LUPw7HyFo:S4gq6G446ePLJk/6DpPwrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674638490, "uuid": "81319ebb-b6bb-448b-975b-4589e1bda50c", "value": 4338092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674638490, "uuid": "e7cba3b7-9e61-452f-8528-ca1982014c6a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638490, "uuid": "89ce10eb-4088-4958-992c-eaf65461d1f9", "value": "Use_55500_As_Passw0rd.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9578bb22-9caa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1674649198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649198, "uuid": "4a62f3d5-80d8-45ab-a7e1-55f88f4a5e8d", "comment": "Malware payload (AveMariaRAT)", "value": "b1d0360f3559407064a898e5d83d99d7", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649198, "uuid": "c60f6d7c-6260-4168-a030-61ac9f454aa7", "comment": "Malware payload (AveMariaRAT)", "value": "4bdda49e98eae3912a4309ed3a0f7e861a83af656dbf91122c673e87f825ae45", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649198, "uuid": "793c5a19-c986-47ac-ae9b-e5259f292d50", "comment": "Malware payload (AveMariaRAT)", "value": "ee685dc085c457e37d3b6a3deb312a422d320627", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649198, "uuid": "7c556525-3cb3-4343-ba3d-7700d5b3173f", "comment": "Malware payload (AveMariaRAT)", "value": "60c42b4559257f2bdb4a7781158ad33e96b5d31149517605ceaa934dde03767142b3935753016ded0ea76f488afd6715", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649198, "uuid": "76daf128-7e4d-4446-be1c-4a2f6a114b19", "value": "T1E6E4BE7B7FC12FA6D16887B585D3044C23F0A70760A2EBD23DE844F9C6D5F895B29286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649198, "uuid": "0b7b5f7f-3996-45a7-aad5-b8cebc859fde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649198, "uuid": "fc8e26a0-a5b2-4258-bd4c-14a21c0f7af6", "value": "12288:2u60TacS4nMlcQ2mhyolUQgULr7YL9S+F5IBRKYWTHME2v:ep4qcQv1gLMRun2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674649198, "uuid": "c8c6ce3d-741a-4920-afaf-2496516fe7ad", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674649198, "uuid": "992bb940-8753-44d7-b245-675ed259bfa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649198, "uuid": "e2129cc7-6d6f-482c-b797-404780fbcf81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f38d2ea-9cad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674650369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650369, "uuid": "894646a9-5bbe-443c-b328-cad5d05cfd66", "comment": "Malware payload", "value": "bd40bc823404e0915ba0dedfccb50562", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650369, "uuid": "bdd346ee-7fe9-445b-905d-e1d1f3099eee", "comment": "Malware payload", "value": "4c24891000dce2647272ce77343f2884a968445d9bd0a34fe4e7ce178132c665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650369, "uuid": "ab95c099-778f-4131-9631-543c0a2cdc83", "comment": "Malware payload", "value": "261ca5d1feef6eec40656edd6153516bb01ab455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650369, "uuid": "3a1a3875-32fc-4123-bbf8-bd194d8c8277", "comment": "Malware payload", "value": "b2ca8857ffbf25d86f3c5eafaead2a4ca12c151f67bcb84256bb7e1e20512b8cbf8a69c1cbc22f20c54d1ee33ad91686", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650369, "uuid": "9ea119aa-aaeb-4b3e-a698-b0864905801c", "value": "T162348F117491C473E472153119F8EB7A593EB9320B7489EBB7D44F7E8E313C19A32A2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650369, "uuid": "40cffaed-64cc-45cd-994f-ca8eb8108fdc", "value": "66068028bda8664d3d5c4af1ed63a31b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650369, "uuid": "7d57121f-2c53-42f1-81d4-41a5e2f531a4", "value": "6144:8xQ4rFQwqYaZipGAkkEsyt1U2lXuUC77xlmAOKvToA+:8x1qYaZipG7sIUiuUC7DmrA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674650369, "uuid": "932c35b4-7fb3-48d0-8924-91953da1209f", "value": 246680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674650369, "uuid": "b246250d-3b12-4087-86d5-0cb1562a5b2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650369, "uuid": "a62aafde-5d4a-4cc1-9491-6bf409c9eb8b", "value": "WindowsInstallationAssistant.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31260d55-9c84-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674632709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674632709, "uuid": "643b130d-52bd-45df-8f00-c6f2c669f1f9", "comment": "Malware payload (RedLineStealer)", "value": "6aaab0397f19016ab3928837aca42463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674632709, "uuid": "5e2dad64-462d-4105-8fc1-41b4e2f343e9", "comment": "Malware payload (RedLineStealer)", "value": "4cb9fabaa9fe4429eea6c216b97d8be31b6148208744438f7df9c489eb8207d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674632709, "uuid": "6d5d174d-8b59-4595-b0eb-d45ff6524d33", "comment": "Malware payload (RedLineStealer)", "value": "f98ef16e646fa5384392740e38d46a15f57188ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674632709, "uuid": "60b2a763-6d25-4b67-b13c-9fcc26efb20c", "comment": "Malware payload (RedLineStealer)", "value": "c59a7a0721dd1f875efe2a91bcab2923057922c1acf9f84ee32be9a6a0036dd7c03d0fd8e3b18e1c429400188198e90e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674632709, "uuid": "fa071ed1-a561-4330-b040-b5877214586d", "value": "T19906237722951891D6EBCC328D3FFC62B2B3157E4A81D8BC6991ADC5A9328F5D703903", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674632709, "uuid": "0f835eff-be70-412e-ae57-5b2e7b25e24d", "value": "acbbb57a9e219cbd48d9ce15a64944ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674632709, "uuid": "7e66c20a-aa44-445b-a89b-4219859864c5", "value": "98304:6e/PJjiHnwQvF7cso/3aBhGPIJeNgbcBr6fOOWLndlH:xhjoz9CaBhHiBrqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674632709, "uuid": "41671ba9-31cf-42d6-a065-7cd4a5deb845", "value": 3881472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674632709, "uuid": "627735cd-7a2b-4275-9303-b5ff47034a69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674632709, "uuid": "6c51001c-b7af-4a09-8a8d-f017370386ba", "value": "6aaab0397f19016ab3928837aca42463.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691a53e4-9cde-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674671457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674671457, "uuid": "a27675c3-3dff-4558-9210-eb5b2a9c939d", "comment": "Malware payload", "value": "a2960d9961e66823029459c37fd6e738", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674671457, "uuid": "ac83fdda-f4d6-49fb-8e06-979930abaa34", "comment": "Malware payload", "value": "4d43756498c7ad8c7c3e2dfcbabce0078cf90722f987aedfe4e961d3bb7768cc", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674671457, "uuid": "69c9a0b5-ed88-484a-a102-b98304d1a3eb", "comment": "Malware payload", "value": "7728fdf0a4c27007bc56f57bfd58c30097cbdf00", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674671457, "uuid": "17477228-11fb-4a65-bfaa-50e12c62e599", "comment": "Malware payload", "value": "241ee54ae9cc2532dc53687d3b32276c887d0832cb8db23bbda89f28bdcd701ea07a4103e066bb73142bb33d8843e9ae", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674671457, "uuid": "399d262e-00aa-4c2c-9d4b-c8d025f3466d", "value": "T1CE31442E57E44216D1F38672A4BBB2118736F915D9678A2A41C0E28FDCA1600FD39B3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674671457, "uuid": "daf998f9-8f52-4eac-8475-4d70db52fe85", "value": "24:86WJR4so9oDlss4yMpGYy2bYHJ+/U4I02Gd+dsT+m9l:8HgAlsz3oJEIUd+dC+Gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674671457, "uuid": "36f5f608-b22e-43ae-b933-81bfafe3fcb9", "value": 1806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674671457, "uuid": "2f8a903e-86fd-4b6f-8ae2-d7d95474a44a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674671457, "uuid": "7e9967e8-bc9e-49eb-81f8-e2c316a14684", "value": "MANYATTA.LNK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61321d92-9d03-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674687335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674687335, "uuid": "3ae6f7dd-89ad-4826-b8a0-6bcd09882b39", "comment": "Malware payload (njrat)", "value": "a32ca9c57964444f60b5cd78e7b58c1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674687335, "uuid": "86a77861-ec39-4891-a18e-b4aeb2102031", "comment": "Malware payload (njrat)", "value": "4d827a686aaccd4d89b6ef7a58271c91b871c17845ca8de37d603cb21940e8bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674687335, "uuid": "0b3deb0d-9ca3-468b-a65b-68deb1f42b64", "comment": "Malware payload (njrat)", "value": "f2606f4dcc14f5cc9a994a7bd9ee2d9eb7aaaaa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674687335, "uuid": "f5fc9575-5d27-4a33-8837-415763320bea", "comment": "Malware payload (njrat)", "value": "e7bbdb04f73108fec6d682b5bb2716a784ef19f4a0688f21fb877590c4509ae200829bb9e3d0638d184a49ca6223d0a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674687335, "uuid": "f6a44731-28f8-4f41-a67f-af56eadee6fc", "value": "T1C3032A4D7FE18168D5FD067B05B2D41207BAE04B6E23D90E8EF264AA37636C18B50EF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674687335, "uuid": "f9172f92-6a7b-4694-bf47-39d27491cea1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674687335, "uuid": "02de743c-8243-4a4b-aca5-d8243d3a2ee4", "value": "384:peSvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXC:MS7TZ38fvCv3E1c1rM+rMRa8Nu34t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674687335, "uuid": "685c459c-0d4d-405c-8073-43dc1ad88e16", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674687335, "uuid": "038aa7c9-9417-4f32-bcc5-80af9fc78c62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674687335, "uuid": "cde06dae-206e-4bf0-8518-a0b4a4e6d10e", "value": "a32ca9c57964444f60b5cd78e7b58c1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df4f540-9c6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RevengeRAT)", "timestamp": 1674623738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623738, "uuid": "ef285ca9-bf15-424f-a079-7935acfed7dc", "comment": "Malware payload (RevengeRAT)", "value": "f898e240cdab196a4a4045a9475e1641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623738, "uuid": "3043a808-7a1a-4e58-85a9-ce29c301941a", "comment": "Malware payload (RevengeRAT)", "value": "4dd82c8cfe6e1bd52dc523ba8bb6bb1891f95fcc7187e4f4817400eb3547cda9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623738, "uuid": "4d23b76e-d64e-4ec5-b26f-a30b7da4d5d3", "comment": "Malware payload (RevengeRAT)", "value": "e4868eac22f6dda6160da5aa9929b5c732ce74f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623738, "uuid": "33f2c52a-c80c-4c4f-9f76-0b7b442909f8", "comment": "Malware payload (RevengeRAT)", "value": "4e7840d6c5202dd0575350fd0bdfa021a224ac209c3f193bd10e5034a3e520590f840d28f930b69a653cc2d25d0cfb2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623738, "uuid": "6a83905c-dd66-4b3a-be71-40cb847db971", "value": "T1E3E3D8261BC96A06E5BD93741F7212C487BA8D91C306E72ABFC6059049FFD4FBE02746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623738, "uuid": "4328c4d1-fb17-4aaa-b4ad-3b62813811a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623738, "uuid": "b6444745-e0e1-47a5-b023-72c127cdd96b", "value": "3072:cYLvQhh2YZsMFw3GmQ8gM4fNXI614xGBD94lh4c0BoO5mkhltVhFFElbHF9FFFNK:lLIH2YTFhH5FFElbHF9FFFNABlFFFFNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674623738, "uuid": "be4a4b28-c572-4715-8186-083a044976f3", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674623738, "uuid": "35baf547-f3aa-4281-b227-a218f3d75a77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623738, "uuid": "97962a00-b598-4c2b-bb3b-53e2b498b054", "value": "4DD82C8CFE6E1BD52DC523BA8BB6BB1891F95FCC7187E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea3ed4a-9cc9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674662635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674662635, "uuid": "e07b3834-db45-47af-9d3e-54aa37b828f3", "comment": "Malware payload", "value": "44f71fbcdd19c1f3092aa4c9a33de4c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674662635, "uuid": "24ab0531-a862-4dd0-b24b-e05dcbe85e86", "comment": "Malware payload", "value": "4feb166139c6fdcecc99100fd18167033ad4dccfc64f94f7a2acd7c900cd7873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674662635, "uuid": "06107c3b-49dd-4f76-aa64-e84ad65835db", "comment": "Malware payload", "value": "d6e08772e1df0fcce5592e3755b9e281f2f2fc53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674662635, "uuid": "05b00737-a6e8-4b6d-bd9c-303713071214", "comment": "Malware payload", "value": "6e1ed87ffb33d451190174241c3af8f7ffc44bbb3decc0ebe477c84263f52d074ad01f9d373e7fba0a1cee302b3029be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674662635, "uuid": "30a451b5-8eed-4764-80e1-f2e2d3051f04", "value": "T1BE7633A679C0C8FDE55013708495BEE2E1FAD3BC0E60C8B37B8569394EFC162C6456AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674662635, "uuid": "d6c7a983-cdd3-41a8-8acb-46f5b328e21b", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674662635, "uuid": "8e15115f-77b0-41e7-b59b-6ef2fb379708", "value": "196608:91O7KtJYST89q50es/eDu/+hi6beaYd6Q0vWm:3O7KtJrYolsQuWpb6YZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674662635, "uuid": "1a1cc07c-3ecc-4141-8c33-edfa711641b2", "value": 7648618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674662635, "uuid": "20622cb8-ef24-41c2-9f61-4416e09e2a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674662635, "uuid": "ff215768-3b24-4b2a-b736-ffa8e606f555", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab683fd5-9c63-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1674618740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674618740, "uuid": "62181509-884b-4773-898e-dfe9cb14e129", "comment": "Malware payload (CoinMiner)", "value": "3f72e3da4148d8212c438a9a76bf72a0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674618740, "uuid": "f37ba966-74e2-4e55-a5eb-63836c5968bf", "comment": "Malware payload (CoinMiner)", "value": "50c2bec0fbc955824b6b2648d30fc42a5fc64994411fdb6026f560d0aa8e178e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674618740, "uuid": "e6ca6c86-0d0b-4c8e-8e34-6daf03f11a42", "comment": "Malware payload (CoinMiner)", "value": "be3860cd681143035a3765ba1b071899a6e2cd1e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674618740, "uuid": "352ac4c8-11d1-4100-90bd-fa4e2b97aa5e", "comment": "Malware payload (CoinMiner)", "value": "83f86d24fa31a1b8b28f15d41e3154775944d2a126c7cc0d9bc91f00cf033adb3ddc0a87ef7e6fdc7da87dce95bb06cf", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674618740, "uuid": "d95e99bb-e942-45fe-bd61-5c562eae1953", "value": "T1088623FD22543398C067C474D233F944A1B6221E0B99E9FEBADBB5C0B7BA851D606F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674618740, "uuid": "f3949b3a-e884-4bfe-a7c7-b859531d8eac", "value": "5d92ae5c85df45b698eb8cb62ab35a7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674618740, "uuid": "5238884d-7a41-4059-b422-e90f95d6a4f0", "value": "196608:YbRaO9w1Y1YMQL5aEb4z4HbdA/xWaRQpuDQ:Yta46Y1YMw5p7u5BXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674618740, "uuid": "ee86c3f1-bff5-46d3-9333-3fd27d314605", "value": 8550320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674618740, "uuid": "e243eec5-f363-420b-9538-07a2a60c5805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674618740, "uuid": "68d85b0a-8937-41e1-961e-9bca9c4222e6", "value": "3f72e3da4148d8212c438a9a76bf72a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8fc3829-9ccf-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674665203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665203, "uuid": "a9c8468f-a37a-4e37-9cfc-96791e9246c0", "comment": "Malware payload (GCleaner)", "value": "23ac363ba387f7855ea1c0631f8f241e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665203, "uuid": "dae8bd0e-c28c-48b3-a91e-9f5576dfba5a", "comment": "Malware payload (GCleaner)", "value": "50f415861b265b522b7691d148ffbc0289bcc821eb4d368436796daab333884e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665203, "uuid": "0849e4b8-a698-46ef-8b8c-1e45e36c337b", "comment": "Malware payload (GCleaner)", "value": "2829420356ce39ba7d4f0a7912f89436bd43ec86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665203, "uuid": "2f97da31-d24d-46a7-aad9-4ed68c3b6b91", "comment": "Malware payload (GCleaner)", "value": "b1c26f64f6849159cdef1aa70ebd0c6122ff1b95fa2791b3e4b0f7d5336d617f3911dc8ba055452e29837b87ad1d176a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665203, "uuid": "745a3d8e-24f9-4efc-b11b-61f312cdc09b", "value": "T12785334325D3C0B2D2C3A7B8DB2CD83663B3BF5108B69199355E36598FBD1949A0E327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665203, "uuid": "be435571-d5fb-47f6-85d2-8c047b4c9ed9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665203, "uuid": "adfcf597-ce94-42ea-9f05-833cb5c5c4e7", "value": "49152:Z5iJ4YtQkKSKr7rLVt0kc46ZSw+IHXBh8phLCgv2MR:tjkKSe1tS4i+MX8Tv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674665203, "uuid": "9c3287aa-8540-4a6f-8c55-8c8e2b353413", "value": 1772436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674665203, "uuid": "0e016f56-63c5-4a6e-92a6-924956aa415f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665203, "uuid": "e33dc744-a21c-4fcb-8ffb-f3f8ca5d3487", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f1f968-9ca4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1674646410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646410, "uuid": "1e08c4dd-3ad8-4872-9faa-57f0adce4bd0", "comment": "Malware payload (Gozi)", "value": "b3c14105b2e6a235a1f789ffb5395fd3", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646410, "uuid": "a05aef95-9cb7-42a1-b027-ee8116c5c4f5", "comment": "Malware payload (Gozi)", "value": "511e23ad034cd019805b2c560e3d761ab8d1148557d7632d9700aabd757438de", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646410, "uuid": "361591c8-6119-4347-bad2-c9957a70b49e", "comment": "Malware payload (Gozi)", "value": "865e145795f5ff9efceca796062a9e7f930e279a", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646410, "uuid": "d055a361-d072-468c-bfcc-a24045ec1015", "comment": "Malware payload (Gozi)", "value": "745a0614abe8a6b3ee031e61dfb1f7cb0bd521c1a1fa7bce189fd0cfd2d74e484b3a29312de3dc1f5dd3cda57e16f6dc", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646410, "uuid": "ac02edda-ea28-4844-9264-1bef60c87f80", "value": "T10F34CE836EE4BC61C9264A328D1FCBEC76DDF9025E1867271739DA2F25B03B5C672118", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646410, "uuid": "1ea3ca51-4e5b-4bb8-8c56-fe03ae713cab", "value": "13743b83cdbed1b091d19518975401a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646410, "uuid": "a3bd68e8-e0e0-4ee1-a849-31e8a26f62d2", "value": "6144:pCxLvYy7IVQf2JF2qNYihWY8gVmwCOaM8rHtQK/fu0:MxB7IVQeSKYihT8gVmw05tQKXu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674646410, "uuid": "a0fdf525-5d30-4643-88b1-410747474e90", "value": 249771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674646410, "uuid": "5cced8b4-c989-4be8-9d58-12a8a89204c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646410, "uuid": "67299637-7dba-4196-9f36-9d5794daf79e", "value": "scarica (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c6a6b6-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674678963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678963, "uuid": "3d0e12af-d6c7-4ba3-85fc-ec6e92127aa8", "comment": "Malware payload", "value": "e8126fccaded98440c94fe496d4889f0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678963, "uuid": "ff144759-8e4c-498a-8a91-b8d26fd8e0a4", "comment": "Malware payload", "value": "514039455f6c4aa3042af9b939ba20178597ceb125829b9e0a65553f89ce2fe4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678963, "uuid": "4afc1d51-8ae9-4d63-8043-4aa4cd412f0b", "comment": "Malware payload", "value": "427b1159d361db8d17cf03acbe9724497484ede4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678963, "uuid": "24f52d9f-d37c-4bb7-819b-3f150cab9ae1", "comment": "Malware payload", "value": "ff789ce079cb587805e43c8e0b3f3c3fe1802a9eb79ab38e943b1139e694c8fee05878c53193d28a64bcb8f5145a3fac", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678963, "uuid": "82f518c7-41d2-403e-9d65-d28717713834", "value": "T19E74D009B785D997F993133888D3CA963329FC487F4286073A647F0E7CB16B44B26799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678963, "uuid": "d9bbccff-de54-49ad-963b-d4115223a2bd", "value": "6144:5h0k5eq1h0k5eqnh0k5eObh0k5eqIZ+RwPONXoRjDhIcp0fDlavx+W26nAkW6rU9:5ykdykvykvykn4DYRqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678963, "uuid": "c26820ea-841d-4cfb-9753-ebe32066ba7f", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678963, "uuid": "265004d2-2aed-4992-b2ab-4cfbf0d1421f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678963, "uuid": "b51bd9d5-3952-401a-82bb-80a693473c4e", "value": "RFQ_4857835748574845784.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d259420-9cc8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674661908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661908, "uuid": "692748a7-1356-4077-b002-3844100cb448", "comment": "Malware payload (Formbook)", "value": "63b5aa9ab79b1395c0d91902a1c47962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661908, "uuid": "6ee0f65a-6dd9-4bb0-828d-66567b1091ac", "comment": "Malware payload (Formbook)", "value": "52659c067eae50044c3989655f17e58a6391c62a23bfb90de95574b119c72b80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661908, "uuid": "2fea631d-1f55-4f87-aa6c-31cec78813bd", "comment": "Malware payload (Formbook)", "value": "35826e47ff75b1e3b898009dbc867ecee204b6a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661908, "uuid": "6821ff93-1694-4413-bbc9-f659f4055236", "comment": "Malware payload (Formbook)", "value": "af0c5e27b8d4133115d2980d0d273e52995bbc49559a164be5e79686e15c08cfb3edb7ae8f353dfc236ff97abd7eca2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661908, "uuid": "59661c13-f634-4280-bd47-981f5bda1596", "value": "T15FA4F183F39E830EEEEA08F2B97D01B48499AF9B10905D84F1C8FF6E107695D65252D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661908, "uuid": "d4d734fe-2da9-4ad2-acd6-5260bf12894f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661908, "uuid": "2a580ac3-c52a-461d-b6e3-70817e10833b", "value": "12288:QYmajc6gjGwlW9fjHG9sZxuhd/6Zq9RBXlzXqyxMh7RghYU:QYmyc6gjGwEfjHfU/6wRtlz9672t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674661908, "uuid": "5f123d18-41b5-4681-94b6-43c5e0654f6f", "value": 480136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674661908, "uuid": "c22c7536-cc68-41fc-b685-b704fd88512f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661908, "uuid": "e1b9c7b1-02bf-4b45-b924-e9ce7dde6d0b", "value": "DHL Express Shipping Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4863c4e-9c60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1674617521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674617521, "uuid": "c7cf5b86-d907-4afb-858c-577c6f2654ee", "comment": "Malware payload (Rhadamanthys)", "value": "f3afd1e9dd383f83d210f8d98f490f99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674617521, "uuid": "170e79a6-3c9a-403a-8bc4-9f2b0ff8f0b2", "comment": "Malware payload (Rhadamanthys)", "value": "528310b1bd875262e059778563b8b026f19b1bb4ee3d4da101b0d1307839e59e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674617521, "uuid": "9acff0bc-4e7f-4b47-b449-d18f7e797167", "comment": "Malware payload (Rhadamanthys)", "value": "8ae86fa623305bbd9d1e4bc1a5e63883b1bb419c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674617521, "uuid": "5cd858a2-a6ea-4470-b7da-4805f5c60132", "comment": "Malware payload (Rhadamanthys)", "value": "a1755c94faf63636234cc9af1917d25cf8715725edc8fcf9eafb850f9ed4c61b3cec4c7a9e0e2a114f0259f62f476b6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674617521, "uuid": "1f8c0154-bb8d-4522-9791-74f769042b00", "value": "T1C314E12279B0C432C49645785C20DA816F7BB53246EACC8B3B581BBFEF702D1557A396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674617521, "uuid": "97d24c08-2c13-4a35-89a9-32773ebd5252", "value": "5eb8e9ebd49d9ccce156e2e9eb6d0902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674617521, "uuid": "fa5a3309-2b4d-46d1-b72a-4409c4adbba1", "value": "3072:jLBN2cZQhLH9EvK/5ZK4+KMfunoHUHYC1Amqc4N4Uqz:j1ALdEvK3ofunoqAmr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674617521, "uuid": "df62d559-7b88-4a3e-9ae3-98dd2179a84e", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674617521, "uuid": "925c6c37-f3cb-4c4f-a9d5-494680df5cb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674617521, "uuid": "484b9982-0cbd-498a-8ff4-cc29573c4100", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d2f02e-9cd4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674667018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674667018, "uuid": "a3de4f8b-4aaf-448d-b5e5-da32e63e9473", "comment": "Malware payload (GCleaner)", "value": "569ac447137e11d65265432631501176", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674667018, "uuid": "f0e3eaba-1046-4ca7-8e5b-0a4f5feba170", "comment": "Malware payload (GCleaner)", "value": "536fcb99034026b8777fda97132708c2dbdd2844c5375807be025c5b18af23a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674667018, "uuid": "79fbabf1-fe99-43d2-9cc0-db6789f3ce64", "comment": "Malware payload (GCleaner)", "value": "08b82533601eef0448177182f6f0a1e9f2ea6df0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674667018, "uuid": "c9b48436-626f-4e96-b8d3-6177c58e5027", "comment": "Malware payload (GCleaner)", "value": "dcd132a24552028d00786222864fc683f40a56643ae3ca2eaa00def76d4de4563b714f3a7766f088fd534539534d3128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674667018, "uuid": "60b55e18-64ce-4a49-bdc6-8ba0386a103b", "value": "T143853302F8729472F1A396FA1C5DA50066B7FE2906A5575E70CC2ABC3E77BD4880B34D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674667018, "uuid": "c9055b1c-a814-488a-85f4-53dfd0d6fa3e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674667018, "uuid": "e52bd22d-ba28-4259-b2d1-9407d166f92e", "value": "49152:ZxpTj5CHsavkyPhGZs2XBGB1R5mA8M6LCgv2MR:3pbav1hGisIBpmA8Dv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674667018, "uuid": "efdcff2c-0243-40f1-937b-ac1f6aaafaf0", "value": 1796274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674667018, "uuid": "38d243b0-142d-4a87-89b2-8cdde2b67b55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674667018, "uuid": "4e483880-b403-4963-a160-2ab7acdb5a85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f987288-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674678635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678635, "uuid": "ec3b86a8-8725-402d-9422-6620bcdb5431", "comment": "Malware payload (SnakeKeylogger)", "value": "8cdcf9d4502ce65a9bf4fcc5f5fa54d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678635, "uuid": "390233f9-735e-4d79-97c4-f3532f04136d", "comment": "Malware payload (SnakeKeylogger)", "value": "53ab8d99f27bef0bdbc4a0d0a02de34254fde15d202708e379bf2ff84d2ecfef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678635, "uuid": "161b6a74-d12e-46c2-9f41-589de03cac9c", "comment": "Malware payload (SnakeKeylogger)", "value": "b534efd9dd2902ab2172cc9f2f07fc8ff1acac0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678635, "uuid": "e038aa3c-23d5-4516-9fd7-f7a45d98fe46", "comment": "Malware payload (SnakeKeylogger)", "value": "b55adb342c4bd87b2f2090aab4cd3f36884995cc26c3dfc4d12623a349e26719b27c5397e610fad2848a9abe81750a99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678635, "uuid": "f07567f8-3c5a-4b66-a176-70abf99f4c90", "value": "T176D1A810F7AD8377CE720B399CE353404674F35098A79BAE79D4621BED172894A717D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678635, "uuid": "1887562a-3db1-4fc8-920d-e54e751e767b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678635, "uuid": "023d0776-2bf7-4a9b-835b-1f92738b3d2f", "value": "96:DpMKEpKgeQV6lfxV9n5Hl9cItU2RM1FVbWm7atAkuaLzNt:DuKTqQl/95HnZtJy9bWqa/DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678635, "uuid": "e84dd1b9-a128-4a89-80f7-bb31b3e6dbc3", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678635, "uuid": "e444a850-0593-46a9-9639-f45b425c14ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678635, "uuid": "74d689f7-18d0-498b-b2f9-3c3825007380", "value": "FATURA VE BELGELER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f548ad69-9cc7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674661814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661814, "uuid": "fc63003e-084b-42f8-bb9e-e7ba742b27b0", "comment": "Malware payload", "value": "f7373b286f49dd2fc1ac3c159a4499e4", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661814, "uuid": "1a313aea-2780-4773-9aba-f31f7e2cfb95", "comment": "Malware payload", "value": "53e9e6bf16ec7de032956a0a87d9fadec380be59a5c75672aa36cfdd2da7a803", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661814, "uuid": "e07535ee-759a-4e9b-841a-66f0123faf2e", "comment": "Malware payload", "value": "a2d48efd2fb41c69049e1ef800ec91fcc87ff1f8", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661814, "uuid": "22a5586a-ed4d-4199-85b9-6534e628ec53", "comment": "Malware payload", "value": "fb0fc9cddd6e4270d5f3617e6dd08f37ed2ce6909ceb011d02849526289744dee38978d67cb910d69f27759ef0dee979", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661814, "uuid": "7179d303-13ec-4e02-bd46-4710bbf83646", "value": "T1BA05339CB78F365EC3BFA82570514B048964C21C864EBDF2F8A3882C5D61A85E7F7784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661814, "uuid": "4dcfb0f3-834d-4c11-86b0-50fa38280ce7", "value": "12288:3ML7nvXmvJ+oqcjuXV6SLuLzjdLjYvkU4/tJodYrdQ6nCfk9pIJGnTJja3tL3JRa:GmvJicjuX83nC9aJRQICcrQGnA9jDRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674661814, "uuid": "b06f999e-e69a-4147-af0f-f09c9dd748c3", "value": 805738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674661814, "uuid": "a7dfafb4-8433-4aaa-9f74-2bf13b330897", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661814, "uuid": "1771e8c3-dde9-4df3-8865-864f729a08ea", "value": "Orden de compra.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aafd6bc0-9cbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674656535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656535, "uuid": "fb276ce8-6db7-46fe-8c1e-e2dfcac8cefe", "comment": "Malware payload (AgentTesla)", "value": "91d45108e5fb6d1fec317038cd28dd24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656535, "uuid": "70492df0-b229-42b6-bdd5-5f9b207951d3", "comment": "Malware payload (AgentTesla)", "value": "558367122fe2b06afb6d3c7c88c8953d7d391767107e5c97757e28d18575c260", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656535, "uuid": "faa49731-6c52-4914-a37a-5ff04affbd71", "comment": "Malware payload (AgentTesla)", "value": "aa1335bc456d3f03a5b2d6b270fa88b0ff8e7f53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656535, "uuid": "bf6d87e8-978f-42fb-a55e-6f39be30ef74", "comment": "Malware payload (AgentTesla)", "value": "0b0b25bafc39f9c8756eab2b30fc65b09c7255b5322666650bca6c5892e8143dc0c54f1c5897e1db70411459602d0617", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656535, "uuid": "4ecfd4a8-c069-4abb-b0bc-60676700143f", "value": "T127752269F3942AF2C9247F7126A7BEB117B73CF8DD6538420609B62D9DBB3705026C84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656535, "uuid": "1de68216-2cd6-486a-adb6-44e19b7e0559", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656535, "uuid": "ff4de665-3f5e-4765-99af-3c132f2af347", "value": "49152:OW4VeWlcU2vR48gu4lXbWiO5NBuK/yYCZL:WoFUiR+lXbXhK/yYCZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674656535, "uuid": "14dde209-c875-4e1d-b3b5-d4da13361f7e", "value": 1666048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674656535, "uuid": "edf87b60-d36f-427e-8ce9-e404a61a9a5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656535, "uuid": "625c64bb-2ffb-491d-9c4d-0f92de92f200", "value": "51703_P0_Document_30651jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec45247-9ca4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674646395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646395, "uuid": "9cbc7e7d-15a7-4381-9fc8-2e7c20897af4", "comment": "Malware payload (Smoke Loader)", "value": "33c79a1820ad98b718ea1e48f201b0e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646395, "uuid": "913be546-1ccb-48c9-872b-313239a729ec", "comment": "Malware payload (Smoke Loader)", "value": "5597dbb4b4d83b9cb7927bf58f1dd8e983589e8709c908c462c23a53db2987de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646395, "uuid": "be7a3bd0-928d-422c-a4f4-4e5afa013774", "comment": "Malware payload (Smoke Loader)", "value": "4a6d33fa4ab829a07c59bf0f1451f84748e7d400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646395, "uuid": "0a1a1f50-b18e-4630-be12-66f6622628cf", "comment": "Malware payload (Smoke Loader)", "value": "b104f228d88f5030058d26d184584d9d62935538da12aa08cd50200b6dc759f65a5ffb744803b2c77e80960744c22cb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646395, "uuid": "316eb1a6-51b5-42a9-8882-4007b7237f77", "value": "T158748D12E2D8BAD0F49ACA318D1EFBDC763EB9506D146726362C7A3F15701E0C16A72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646395, "uuid": "0f710d0b-f389-4c29-8800-026a772ba8b5", "value": "787cd3f7e6d0161bfca0cbd92375e751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646395, "uuid": "1e848039-6f11-4825-a1cf-f377d681e7eb", "value": "6144:PLAnew6Yy3XVWOEdqCcNjSOjq7VWRFBMolz90bVivVm:PcnB6YAXYIw7VWR5lzxv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674646395, "uuid": "d6ba2d66-c782-4bf7-98e4-49fb5a004db4", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674646395, "uuid": "df93187d-4352-4e35-885a-cb527eeeac9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646395, "uuid": "7a2c55ab-4bc4-429d-94b6-fa089b326fdd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffdb999a-9cf1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674679871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679871, "uuid": "9f6ad2d4-a444-4ada-a96e-edbcae3cc462", "comment": "Malware payload (Smoke Loader)", "value": "24a289a54e5a919355bfff5df98544ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679871, "uuid": "ce608f28-6bcf-4a70-a2fe-b02847c2d321", "comment": "Malware payload (Smoke Loader)", "value": "56494e95f081b6c42240991cd3a5de1d745627ab93455dcdbad92b66fdae6b73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679871, "uuid": "565376af-875e-4790-86d8-0a5b254165b9", "comment": "Malware payload (Smoke Loader)", "value": "a2b4746d42083043aaca9465e40a9e5609c64103", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679871, "uuid": "8af42986-d4dd-4318-add1-f2feb9e0bf7d", "comment": "Malware payload (Smoke Loader)", "value": "9a728083d16b2160fdcb0efb8beeba5f0b79b2aaa2febd87a7eb5b348d91196ac5602ea227e703744103584b7ffcea50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679871, "uuid": "894947ae-8f28-4aa7-902d-7927a47c32c5", "value": "T15764BE2276D0A860F91A56378D1ADBD4B92EF8D2CF3C735732D4A63F2C732A0D526215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679871, "uuid": "5a31c4f1-779a-473e-b92e-b94be5082e43", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679871, "uuid": "c3cdfea1-8748-4c81-a9da-6c1203c340fe", "value": "6144:XTLpvH1IraWnILxz1k8uMH6hAvg0+MOKXW49UT:XTRVIdo/vHKAoWyuUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674679871, "uuid": "65a09bc0-b8cd-4f00-9492-371aa0a3e224", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674679871, "uuid": "a6c669a7-3c0f-4d57-a097-dc5def1dcf61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679871, "uuid": "3643333c-b8f8-440f-95d1-168735868089", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464ae324-9cb9-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1674655508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655508, "uuid": "4a3951f7-ea6b-4e3f-bcb1-30f8a481182d", "comment": "Malware payload (PrivateLoader)", "value": "e20910b796fc1b4daa210ce625023d7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655508, "uuid": "ad71601a-ba50-4d5e-91df-14e82c9b8f2e", "comment": "Malware payload (PrivateLoader)", "value": "578b32f9bd3b8a0e79585e0160efa88ac127a9d28d3344aa7131061983d2bf0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655508, "uuid": "5f678073-e020-4e6c-8e7f-b3fb9445fd59", "comment": "Malware payload (PrivateLoader)", "value": "56fdaf4f2e7243c35f91e60ff0fb372c027cdd3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655508, "uuid": "4f98f5e9-e53a-413a-a531-e71a451f9c5d", "comment": "Malware payload (PrivateLoader)", "value": "b3c010613621821e7b10c595764d98b1c280945cc052d76ec382838a14879a7c44ab6a6f2b57ec034cf5fa370c464a6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655508, "uuid": "967d5667-30f6-4176-83fa-fc9ad95a03e2", "value": "T1F426F113F9D1D032E59602B2E22A6BF21E7EBD3156318457D7AC3C886E305D1E72A397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655508, "uuid": "a298e52b-c6c8-4259-bd6e-86541445b22a", "value": "5f15e282c9ab32f785ec67df78e330eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655508, "uuid": "ff3f3e75-781a-4f6e-94e7-8b84193567a0", "value": "98304:lAzL4t7P7CbM5zD6sILTjblMS0ugkKqRu/to5ZBHfKhBcR8gO:qX4ti4osI3jhMSNUcjHfKhBc1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674655508, "uuid": "568d87b7-2bae-4ee0-8205-c1e1bec755d3", "value": 4654096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674655508, "uuid": "4aac0862-baf1-4daa-b08a-293f7316f0a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655508, "uuid": "22c720ff-508b-4ee5-8e7b-d00af536762f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c5e74a-9c63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1674618753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674618753, "uuid": "5515cc0d-c250-4d92-9f65-24fae4d874f6", "comment": "Malware payload (RaccoonStealer)", "value": "f4d345160854af4c4ef11a99e6c8c445", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674618753, "uuid": "a9171ab6-0c26-4aba-9c55-5b2f3ce5069c", "comment": "Malware payload (RaccoonStealer)", "value": "58b415a4211b4ab0714cb45cfc92cc793c3f6ad8b1413c5f8320cfc77b5d2868", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674618753, "uuid": "4085a2e4-901b-4145-9019-fad40f0728fe", "comment": "Malware payload (RaccoonStealer)", "value": "0e05d70debe1bba22a8012f15b2ae989d1280fa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674618753, "uuid": "3ba30ba1-a56f-4efe-89b7-ac7c79cb69fd", "comment": "Malware payload (RaccoonStealer)", "value": "c1cda08c76c1444a632cfddf286747e907c183fb2b6af8e08a3c1e04afd08ea0c98a1aa2270e07f603d16c0fdbcd6b3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674618753, "uuid": "4a62f380-0bd5-4422-abf6-a1bea9ab4da9", "value": "T11F962362F54822C6D4BA883A4737FD95F0B657DA4681883C14CDBCF536F29E8D60268F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674618753, "uuid": "597af7ae-c0a5-4b02-93f3-0e70c0a99c9c", "value": "ab329f8f72fc310f12d40c1ee53207e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674618753, "uuid": "1f50c953-18f7-4f35-b07c-aa6fd6ab1427", "value": "98304:JzGeR/R0kIE/WqoMpk2pWzy7k1Yw9xLWjsAKU8MuT2DbAOocP8MUXIj3f+79Vvif:wU/J/1fWzyOYR9giRZJa1fKsD1LSZoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674618753, "uuid": "35b12fce-12b4-455b-b9a5-95e022e3fc2a", "value": 9207608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674618753, "uuid": "ee8e1c08-9549-450b-bb5a-8176c35bb00a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674618753, "uuid": "54422425-5ac8-4ef6-9386-24eac376dacc", "value": "f4d345160854af4c4ef11a99e6c8c445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a67031b-9cd1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674665769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665769, "uuid": "a4f81f54-b513-47b5-be51-2cb10c29edde", "comment": "Malware payload (RedLineStealer)", "value": "052b790607b6abd94baddaeaf8e7201d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665769, "uuid": "f8d846fa-23bb-4b3b-82d6-f6c659cfba47", "comment": "Malware payload (RedLineStealer)", "value": "5997f2dd2199549c99c8b9411841be40579c499cb692d2a78378984a85494c6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665769, "uuid": "a5dcbe58-cb6f-43e9-88c6-9e6bcb454ee7", "comment": "Malware payload (RedLineStealer)", "value": "3a32e7ef399a1bb348269f3bfda3cf674ea35cc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665769, "uuid": "9ad1c6ca-0e37-425c-b2a6-46c4715cb552", "comment": "Malware payload (RedLineStealer)", "value": "46bde1d1e3d84ad57ec770031e665737d2f06595b85fe4d951bfc443ef9235ede384bc8ad395c0dc3c5c48e980ad72e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665769, "uuid": "f03923ae-90b2-4359-8303-c10d1f635a7a", "value": "T1B354C3E0CDC69E90DAD622B1606993768D28B7DD2409F2879C7A301C8D3B6C777E9F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665769, "uuid": "8e0de392-1dd7-4780-873c-44200284448f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665769, "uuid": "a6c32ff0-c0a6-46a1-9a37-c3d22511f88b", "value": "3072:1u6H40H4mm0BkkBg4k5rfSdxykF1F30jalse9rlq6k3NZrQUG2A5nWtPzWTPghvv:1lH40YmmjREl0eZDqv3NSZfAYF4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674665769, "uuid": "76cb7d5a-d190-421a-988f-14060ab9e72a", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674665769, "uuid": "bd74f157-161a-4880-a558-c4a169f95e1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665769, "uuid": "b7c807a3-fc17-4c44-b394-014c45b7674d", "value": "libreoffice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03664058-9cac-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674649812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649812, "uuid": "1acc6e88-3344-4200-8e4f-276f53b4b15c", "comment": "Malware payload (AgentTesla)", "value": "535439bd8c4448eac2ea3f0ceb5eaf1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649812, "uuid": "df11ffb7-6b68-4279-b831-1fb9306ffdd6", "comment": "Malware payload (AgentTesla)", "value": "5a2225052fcc4609a6a8e785816a8c0fb3e454a717117e9c7e9027f111d27151", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649812, "uuid": "d059af0f-39f3-4bf8-a779-4baf6513bbd7", "comment": "Malware payload (AgentTesla)", "value": "a65f05fb9e4465dfcd017f2d9e9c189bc90dd9aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649812, "uuid": "5b91ce49-a523-481b-b7f4-22e33c88f500", "comment": "Malware payload (AgentTesla)", "value": "f12db12a0f1c70e23577fe0e13962a8b8ff8883bf05d9c06595537606c4622625036f1b1ae66003681a12a3987e85d50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649812, "uuid": "13a13900-6914-4b13-b1d5-a417eb6686dd", "value": "T14215D0507278EB52EE688FF5201151A14BB22E1BEF64F3685D81B2E71A73BC03E50E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649812, "uuid": "031a0ed9-123a-4c0c-aec2-1da5ffd2e6a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649812, "uuid": "9e38a117-b1bd-4643-a08e-6949f98deff1", "value": "12288:g2r8kyGy+yseQzjkATGds3MtEwcU3gZ+NYpyF6ichkpJSWf8liRLg2xo37H3jrKh:L8kyGyOeQzlGI6AAgZG6mhZxo3nv4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674649812, "uuid": "39632c22-1e13-430d-b4ef-088ab06085be", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674649812, "uuid": "f93b05b9-3d16-4b96-a421-3308574ae511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649812, "uuid": "1d6d71fb-a7c0-4a54-b6b1-239e0d0043d2", "value": "PL20019036 - 24 - 01 - 2023 _doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986941ce-9c7d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Shikitega)", "timestamp": 1674629876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674629876, "uuid": "b647b64e-4529-498a-a958-b24f1e1bfbbf", "comment": "Malware payload (Shikitega)", "value": "34e5128ceac2321afecb84ef0bc8141d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Shikitega", "colour": "#C8F58F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674629876, "uuid": "9a6d039f-719f-4be7-b598-a1eafbde10d6", "comment": "Malware payload (Shikitega)", "value": "5a85df6d67434d41c00bc7a73c72764a5f34c639bc5596466c5a08344d5182cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Shikitega", "colour": "#C8F58F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674629876, "uuid": "311b7bba-d235-4018-b3c5-b30621fc9927", "comment": "Malware payload (Shikitega)", "value": "e389afae9b11da7e7f1090871b3216bd19b185da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Shikitega", "colour": "#C8F58F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674629876, "uuid": "c6bf20ce-f234-4096-b6e1-b47b4f926ae2", "comment": "Malware payload (Shikitega)", "value": "e379be0d9c6c8c3be089b10937b29272007caa70f3ff3e4dcc3916919dd00f4be1eea4e039609fafc941a6bae188301d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Shikitega", "colour": "#C8F58F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674629876, "uuid": "f67c39bc-6f07-4925-88f8-00863e5f6e21", "value": "T13321C68A4B1755EDBE50DA0A369B0ACC19603BC12E0AE578B0DA7939D0C451EAB0B720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674629876, "uuid": "210dcf0c-a557-41da-8f47-16a0e73204e6", "value": "24:VVwIWEQLrnjdJUdvtQWVZPOyNEKXTaFAL7ScXki1icYTMM9c1h:VNWD/njdOFVZPO2Xm0ScXki1/YT7c1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674629876, "uuid": "34c6903b-9180-4fb2-9e32-a77d596209a5", "value": 1113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674629876, "uuid": "79de5742-0cf6-4994-977d-2284cad600d3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674629876, "uuid": "ec57c80d-6e0b-4267-ae17-0f666b9012c8", "value": "pwer", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b245ea0-9cb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1674651570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651570, "uuid": "53f0ae0a-d197-41c3-a8c1-ecca0629112b", "comment": "Malware payload (DCRat)", "value": "3e821d4b4af33a23f64c69db57770955", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651570, "uuid": "b54ee2db-02b3-45d8-a2bc-fa2af098a8f5", "comment": "Malware payload (DCRat)", "value": "5ad5f24becf8b8653b7708edc35779128eb8cc84ddebf362121c603fd2caed04", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651570, "uuid": "a6631972-33e6-40e6-93e2-66a3a88dcb34", "comment": "Malware payload (DCRat)", "value": "019742e345c39bd10f6c9bc4c1af4c2e94a5fca0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651570, "uuid": "b2ae151e-b248-43a1-a9ef-69a605f5767a", "comment": "Malware payload (DCRat)", "value": "2ded68f38a2b72ade5db3467649bc1ceb52b034ccbeb5c783f06a5ea5d1e1c1f68848489d38a8bf8dbb5a4126dbf31ed", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651570, "uuid": "45f5990a-bf0b-45c1-957c-6c513711a0b5", "value": "T1E7456A127E54CA11F0181673C2FF490847B4AD112AA6E72BBEB9377E55123A37C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651570, "uuid": "d8f6092e-ca2c-404d-bcbb-522efd2da08b", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651570, "uuid": "4daf7a46-c327-4a22-b851-c771524bc441", "value": "24576:U2G/nvxW3Ww0teLTGJTb/Ka2FVx0Q5eRvuiNLzrejv:UbA30yTGF/KvVd5eTNS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674651570, "uuid": "4968a50e-54f0-4b5a-92a6-0a3f830c8a4c", "value": 1270890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674651570, "uuid": "400c55e1-da97-4a5a-aa82-c137d2610af0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651570, "uuid": "4183a937-4ada-4b67-ae7d-f7d83c1c71b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d13b058-9c44-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674605348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605348, "uuid": "df738e80-5d90-44ac-8e1e-b85df3800cba", "comment": "Malware payload (Mirai)", "value": "a0bb8ea36ebfc07054efbf1796dee3b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605348, "uuid": "6605f694-0a6b-4fe1-82dc-521faedec93f", "comment": "Malware payload (Mirai)", "value": "5bfb2966a3b86a2eb0ec5d568ae36ffab8cd705e6a0a183cb86948504ed1e5cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605348, "uuid": "d8bcf431-9f9d-4e70-82de-1543da4d83b6", "comment": "Malware payload (Mirai)", "value": "c602eb6e1c0c0184d1d978996ee6b80faa2bf355", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605348, "uuid": "d05bc12e-3ef5-4fe6-ace6-41a09a03fc24", "comment": "Malware payload (Mirai)", "value": "d8045d1f585faa1c2b9b2acd93261ca7d7cfd9ced4879a00f5beb5d94dad6d657f1ee58234afcb488bd2644d10041c68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605348, "uuid": "25122a56-f494-4d5c-8fd0-1d6ec566b18f", "value": "T151D3F9B0E808571FC2D227B6A64B0A5C3F391EDBD3A733115A3879B81BE57847F65920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605348, "uuid": "94590e0e-3156-4db7-8f33-def891e5eb29", "value": "3072:XXM7FIpm33SIBBevK4VbGBhwmy46aQb0dlfeiNb:s7Sm3/eC4Vbvmy46aQb0dlfeiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674605348, "uuid": "546bda77-4604-45e8-8e23-3ae558e4f89e", "value": 138748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674605348, "uuid": "703783b3-d14d-4a29-b0cc-e53bfb798b55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605348, "uuid": "f790d97c-37b6-4127-8967-648b924f72fd", "value": "a0bb8ea36ebfc07054efbf1796dee3b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00dbebe3-9cbc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674656680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656680, "uuid": "69928312-8f1a-420e-9c83-6794c5382f81", "comment": "Malware payload (AgentTesla)", "value": "3fc83828b62aca8f13629d37eb752bda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656680, "uuid": "650829e7-5e20-4a84-bfc3-7d72e77902af", "comment": "Malware payload (AgentTesla)", "value": "5c879e5a07d1f6539515eb743a70d7b3ea22b3cd3ce1ff32cf6fb4a8447eaea2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656680, "uuid": "ac3a6ac7-b22b-47cc-b232-55a45f85d39f", "comment": "Malware payload (AgentTesla)", "value": "4d98a182b6f720a38af6b3ce932fe7f1242de90d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656680, "uuid": "e3d6e310-4ac2-4fb0-b377-6e62436d4883", "comment": "Malware payload (AgentTesla)", "value": "3d26339d3b957b5eb407bb8c286b4ae1e47975e2e4ff2d591f7985366064652bd051929e1325f88a0122ea0f950516d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656680, "uuid": "664b7dd2-db78-4150-84d6-48ca60b8f976", "value": "T1F7841306776CD637FDA05B3058358E1E777BBE344498A30B1B707BB86C939A2A81E741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656680, "uuid": "3f5cd045-c233-4e57-aabe-c6dfb1d137cd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656680, "uuid": "b1f643df-1838-43a6-b43d-62e3771ae717", "value": "6144:/Ya6ga+s6t9lw1LqsQJEYkMGVED5H1ICYNjecSx39j0nFCtn/SlWyMI+M8:/YOTs6t9lMWsCpPGVEF1XKef3V0e/Sl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674656680, "uuid": "d4b4161f-3a93-4dc2-8e19-fba4ab1c435d", "value": 380305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674656680, "uuid": "b5e67ce7-c157-422c-97ae-da62040119ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656680, "uuid": "d215fc16-962d-49fb-9258-409758403644", "value": "20518497.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e14986-9d0a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674690407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690407, "uuid": "1378635e-c3c7-48bc-864b-ff544316bbf5", "comment": "Malware payload", "value": "799ca5671e0683b9bfb7df880c7219bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690407, "uuid": "15e0565b-7b80-4ff8-8b00-0143d2ebcb6a", "comment": "Malware payload", "value": "5cf5f59a5ad02c3cf16ca3df1ad6272bdcd2902a047613f0970126b65a76311b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690407, "uuid": "64aa811f-5a88-4b48-858d-08b46e06779d", "comment": "Malware payload", "value": "b6b843e454dcce5e75b94ce7a9d89a41c9cf04e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690407, "uuid": "28302c73-a4c5-48cb-ad5c-9f0eb46d9834", "comment": "Malware payload", "value": "ad78db3a46aeb28cb5df28bff466ec71022cb0627e00e2a2ebb4440dcf008ad92068f5b11e7c1d4cee18ac223bb84835", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690407, "uuid": "24805ddd-e07e-4d4f-a985-9faee56e623e", "value": "T1228533631729D03FE503D3356F0428885FB2BE911EB85284349EBAAE9F27511EC5E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690407, "uuid": "0a4ae615-ae39-40ec-a484-6ffb3ac93acf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690407, "uuid": "a2f7abc3-f63b-409f-8322-08078ac98a06", "value": "49152:ZpL2cA9fuRFZhOIKTy1OFsCzY2hpLCgv2MR:z2c7FPOIXgsT2hFv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674690407, "uuid": "0a3cb103-927d-4576-aac8-c3920c295ba0", "value": 1817250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674690407, "uuid": "da562f2a-c6b8-4fbf-b4b8-b112a36ed83c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690407, "uuid": "488705f0-5d98-4a95-8c8a-8079cbbc6655", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c6de33-9c5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (N-W0rm)", "timestamp": 1674615936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674615936, "uuid": "76b1faa4-9680-4475-b783-3ce51b53135a", "comment": "Malware payload (N-W0rm)", "value": "ec5e9429c7b3437325870b2d3e075c65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674615936, "uuid": "a213fdba-a631-42cc-a2ab-087346a95ab8", "comment": "Malware payload (N-W0rm)", "value": "5d63da440ad7260c0791f80a146246b4bf3dafe3ccd43786f8f566a757364f03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674615936, "uuid": "bc6b1743-2532-4d92-b6fe-1568231c6a61", "comment": "Malware payload (N-W0rm)", "value": "694160bc95cb49f50ef7722cdfff8443f610e6d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674615936, "uuid": "fe40ac44-f4f5-4c7a-8c1f-2ed714566743", "comment": "Malware payload (N-W0rm)", "value": "81a25ae029132acf7b702a9d269c7d362759d7a73cb3bafa8d0c3afd1eb29ccbcde7cb230b7b6718c8d4c7ffd0adfaa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674615936, "uuid": "e3d61917-a0d6-4978-859f-6864937b07dc", "value": "T1DD74C513960084E2E11412B225F6173D6ABCA7721C72A737EFC48EF46C616E39F87A5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674615936, "uuid": "90193ebe-9ea9-41f9-9fac-6146800f179e", "value": "8fed5ef7033d5b4b952de93b071a1d9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674615936, "uuid": "90120496-ca85-4425-bd44-077d33e65457", "value": "6144:mNYFF4VS2jY202NG9qjSdhVe2g1XPrnRZUxUPT9tMtR1:mNYj4VljD02NG9qjSs2yXPrnKUPZtS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674615936, "uuid": "7c43bf50-a5f1-40c4-92aa-27378e787629", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674615936, "uuid": "b2512ea9-b169-475a-96a4-d70372fc0261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674615936, "uuid": "c4098e09-4eb1-49a9-a0a9-3dd1c1799d1c", "value": "ec5e9429c7b3437325870b2d3e075c65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b78a00-9cdc-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674670589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670589, "uuid": "3a1a3c22-7b88-41dc-836f-138ef4b7444b", "comment": "Malware payload (GCleaner)", "value": "58c211aed5fbf3cfc9616f1d4a73232a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670589, "uuid": "9c909629-715f-4ff7-b3b0-f5cebe8058c1", "comment": "Malware payload (GCleaner)", "value": "5dfbe75fe325c634d6650922d0fa1142dd3368944706ff1a9ba7b73f54f29af4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670589, "uuid": "a2fbd175-a527-4de5-b198-26ecb6bc8966", "comment": "Malware payload (GCleaner)", "value": "1154770389db2bce287e1722a35535d03134c68d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670589, "uuid": "5fc1a0e3-317e-4386-b659-9bc7f28b6d59", "comment": "Malware payload (GCleaner)", "value": "53f5f386e56a526678a94b50530cbd93e59bdaa6da29dce91fd0c5e597bb8264df6b50d6798f4c6bae03ff6a6162c445", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670589, "uuid": "d7d82a6e-021b-4734-a4e4-215bd9aa5646", "value": "T1FC85332792481D35F092DEB07C38A19BC0FBDD186639E61AF1CC32DD097FA48D89B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670589, "uuid": "d9b8894b-75cd-4cf7-87b8-90fbf147cfce", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670589, "uuid": "4fd1db8a-3387-43ee-b287-8d4458b33669", "value": "49152:ZcQdK3GtWUv/FXslgR+JZgSaJFBkYCpRaLCgv2MR:CSK3mv/dslgwJZgSeGpIv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674670589, "uuid": "a85c79fb-2c7c-4e56-9431-775ed4d5937f", "value": 1807630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674670589, "uuid": "2b9d9592-6909-4d13-b60e-f8283be232c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670589, "uuid": "87f38fd7-3bd8-46eb-b7b9-fe9225448dd4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05150a4c-9ca7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674647667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647667, "uuid": "3a8dd539-2c81-4de3-95f5-cec9ab9f4a2b", "comment": "Malware payload", "value": "6bf24266e05b3cd35f35ec00fd6329a6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647667, "uuid": "d9f23ec9-134d-436a-9cc4-257a4018b35e", "comment": "Malware payload", "value": "5e0d8d9ae9094177d5d0c0626ab013a7e17155cf37171b63f70622758dc9a614", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647667, "uuid": "4ed1d777-9ebc-4134-b0a4-070dc8878a19", "comment": "Malware payload", "value": "2cad24387694028abfe2634e1c8066e6e62a9ee0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647667, "uuid": "15c05e9d-62b6-449b-aa32-c3301af812d1", "comment": "Malware payload", "value": "ad31ebb9cd48c313d7ff7678b9b86d930ab644902ac4c6a9c5317028e2f217000ddccd467eb0ecd5149936c845e763f9", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647667, "uuid": "92c25557-cf45-496e-b49c-e46f5535442d", "value": "T1AFD6222275C5C633EA6F8330652ADB7B51F97AE0377380DB53D8992D0E719C08276E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647667, "uuid": "dcb3e6cd-9285-4705-b915-7c66ff392035", "value": "393216:zPWYP6wAMQ8MLCCBtBOy2suKLRyfWVC8:zPWyh3wBtBXruKLgWVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674647667, "uuid": "8224982e-c679-4fa9-9991-415c21e055c3", "value": 13090304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674647667, "uuid": "b10c6fe2-4c69-4748-9136-420e1da66758", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647667, "uuid": "b07e5efa-3518-4f81-8a5b-2b467468220d", "value": "TradingView_setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83bbddde-9cc1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674659047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659047, "uuid": "85ae21f0-7cea-4ae7-866f-de0e0551c7c5", "comment": "Malware payload (GCleaner)", "value": "33b2c99ec24834dfc7e36dfdabea8043", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659047, "uuid": "dd744383-7754-402b-a8fa-126e65c73ffd", "comment": "Malware payload (GCleaner)", "value": "5f21d74f2ad986423d4a3f060a94a7006b43ad6227c3ce28b8b5018259c07397", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659047, "uuid": "c55e46c6-6a7b-4d02-85cc-39ade702839c", "comment": "Malware payload (GCleaner)", "value": "85a3ceb1ce9cd681f70151ae8aa41b5c233b6ae2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659047, "uuid": "03e21ad5-02cc-46a9-a129-260b648fbcd7", "comment": "Malware payload (GCleaner)", "value": "de5b04cc8cbc26518abccdb944ff118cb2fe4b2c9bea3addce03b4ddf4133556cae40a8ee3118244cbaf3a11f0cb21e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659047, "uuid": "672d3a9d-e73f-4f35-ad1c-fd8b856c4b86", "value": "T11D84CF12F6D4BCA1F92DC9328D26DBDC3A7EF8905D146226767C7A0F69702E0863E351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659047, "uuid": "0aa7de7b-17b6-4c2b-abe2-5e70ea04dc83", "value": "8f16ef841269728457dd532b4a807550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659047, "uuid": "182afde9-a28f-4e0d-92ca-5921521aa2d6", "value": "6144:HzLmJeTTkuOvPMwPraqF/OJqXoxChGmTKq0VvRFBMolz20AxUy:TSYdwPraqAWDhG40VvR5lzov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674659047, "uuid": "73d6cc24-789a-4dc1-b117-1346787370fa", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674659047, "uuid": "5dc4644a-e4f3-40ce-887c-c65c719b0f57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659047, "uuid": "d5b8364f-26f5-43cc-b800-e1b3dd7e55ba", "value": "33b2c99ec24834dfc7e36dfdabea8043", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7040f6c2-9ccd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674664168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674664168, "uuid": "c154a8dc-687d-4008-8135-a3a1df6da59e", "comment": "Malware payload (RedLineStealer)", "value": "93956ad345e8dccf5a58f4f98afa25a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674664168, "uuid": "c97d6130-38bd-4566-a826-cc097bb9da2e", "comment": "Malware payload (RedLineStealer)", "value": "5f2ddc11f56c06530348c20e5ced916ab19fd4719ee776cd001f976e523943e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674664168, "uuid": "1e070a34-861b-4d5d-8f90-747420a7bf0d", "comment": "Malware payload (RedLineStealer)", "value": "c2ee83a8727144fcea545edf05928a9b73423ae5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674664168, "uuid": "e86caf07-7ff6-4fb8-b613-32de89334c16", "comment": "Malware payload (RedLineStealer)", "value": "cd95896dd0e8d487c8323076105fac08f35197651ba95ad0af6275209bf215d2f8bd7f532a99e20ee42e771cc19e54e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674664168, "uuid": "eff7d8f5-a1d6-4858-a99e-f69958ba7784", "value": "T144649D12F2D4B8E1F51ECE318D1A9BEC767EB8505D1856663A3DBA1F29702E0C53E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674664168, "uuid": "e4b36986-5732-44df-93ba-7c2da8a01611", "value": "8f16ef841269728457dd532b4a807550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674664168, "uuid": "0660b3a3-511e-47ee-8e35-84706581beef", "value": "6144:2TLzb6mOdpXjqjjwGq0VvRFBMolz20cLqt/Ey:u3OmOdpXev+0VvR5lzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674664168, "uuid": "1565de64-60a0-43c8-b7f9-838668cb7d60", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674664168, "uuid": "76004610-0c51-4d41-b5d9-0d5f57e2fd69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674664168, "uuid": "f1c3dc20-4d4c-4855-b39e-01f729fccf95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88884e43-9cdf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1674671940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674671940, "uuid": "bf3da005-6158-479e-a75e-6f2fdfdd52de", "comment": "Malware payload (RustyStealer)", "value": "20ebc478a429ac5c954870668f453cb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674671940, "uuid": "e01d0961-ed3f-4658-9752-df590a2892df", "comment": "Malware payload (RustyStealer)", "value": "5fd3b925a93dd18e0345b89c63e96000a9db1a14f3cc30d06e3d71d0e0c0498d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674671940, "uuid": "ca4a0dfd-fd62-4ca4-b4c6-d83fcb6def32", "comment": "Malware payload (RustyStealer)", "value": "91c5fa33d5848a4e5bce867cf06a760aafd9dbd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674671940, "uuid": "e86a7417-4d70-4d23-9d59-347ea8b8a751", "comment": "Malware payload (RustyStealer)", "value": "d3d67c9dbcd506887f95ef86b6f2e9b8d227bdadb4309969be63adb367f35414744efed9ae20d51977518738e1f392f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674671940, "uuid": "6e0afc25-abec-491d-a2bc-09f5ac127935", "value": "T117166D01ECF43FF1E99BAA35405D662437723E24D716CFB3083AD2B59C53296EE0A649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674671940, "uuid": "c06971f3-9e5a-457f-8d09-178ea7ab90f6", "value": "281fc0d04d83a133e8284e3ae16041f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674671940, "uuid": "4257702b-e028-49ca-be98-4f052cc66696", "value": "49152:mJp9E35eoTp3f3QVWTZscWDAgd9GUFkPhyZMyjXTUG+GRpcYWAxDmnI11vwba5wc:GyoCiolKpIbKFubBOFiNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674671940, "uuid": "f5971674-9e5d-4c74-a8cd-830fe76bd523", "value": 4416979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674671940, "uuid": "cb42a014-abd2-435b-bc50-1a5ed701dcff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674671940, "uuid": "daf0cfed-f5a5-443a-8551-1eeb2f12fc09", "value": "5fd3b925a93dd18e0345b89c63e96000a9db1a14f3cc30d06e3d71d0e0c0498d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf14b044-9c9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674642423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642423, "uuid": "d77c2c0e-21d1-4aff-8d08-b5aa5c738890", "comment": "Malware payload (AgentTesla)", "value": "629650941c646616da246f363ac31b64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642423, "uuid": "cfd47ef2-14ae-48d0-a97b-d08368d51936", "comment": "Malware payload (AgentTesla)", "value": "5fd88707644b5c51752f574b44b60add5b279713e5fd1b47fe95f5cf97fa634e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642423, "uuid": "31ad88fc-c32b-4be6-b5a9-169ca7f69fed", "comment": "Malware payload (AgentTesla)", "value": "61c75662747d73543a4fd4ef522fa4e1d68a2123", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642423, "uuid": "29d671d3-cd21-48fb-b093-d082e6fa9c40", "comment": "Malware payload (AgentTesla)", "value": "8fa36bd749abd206db8aad247c8cd7c1a15c1456cd6c930f18e9440548ed252371a178afb06dc642ebf46608c8843e9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642423, "uuid": "60856465-7082-4d13-9a05-59c74ba6a3cd", "value": "T14E15CED0B239E423CE980EF50902664157F22D56FB19F2C52DA9B0DB22F3BD63E80657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642423, "uuid": "73150df3-930e-41d9-8900-52c8d764195a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642423, "uuid": "b504360c-89eb-4fd2-b679-65c3f72b80bf", "value": "24576:rVO8kyGyOMQzlG27ScBABcU9Ny6AAgZy:w8kypOMj27EcUry6Au", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674642423, "uuid": "41c11c12-0fdc-424c-9dce-59486bfee9d7", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674642423, "uuid": "66cb1595-a427-447e-8b99-28aee5ef682c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642423, "uuid": "f0fd6493-0a57-4495-8bd2-550111ea9253", "value": "invoice and packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f61d0ef-9caa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674649215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649215, "uuid": "dbaa9a69-2fe0-491a-97a6-5d41714b8510", "comment": "Malware payload (RedLineStealer)", "value": "58768775fb249bfb2aa735b56d3a1fec", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649215, "uuid": "143e0f28-3afb-45b4-95b8-fd5764b6b5c2", "comment": "Malware payload (RedLineStealer)", "value": "5fee060bb26c37da4d1205d84d457ed8513e59987a41a0ad094451f4ff14e4d8", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649215, "uuid": "e9a1644b-9ef1-4551-8b17-95f040045f7e", "comment": "Malware payload (RedLineStealer)", "value": "efcede7f10c967a247d00f88404101475158f161", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649215, "uuid": "05fae6bf-f83b-49a9-aaa1-f82278e1269b", "comment": "Malware payload (RedLineStealer)", "value": "25407143b59a5fc51820a1dd545b6cfddcfbd1c564f0dfc845f0787caf19aa8be9bf35197ece09c70c2943aff3597880", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649215, "uuid": "50eac856-6763-4ef9-8dae-5c4641f85c8b", "value": "T11E65332EA5585003E32DA27C87B592F0BB32DA35480585DFC1DA2F71B0B515FA086FF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649215, "uuid": "75403e00-1bb5-4c0b-9181-dc1536480e25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649215, "uuid": "3dfe5b3f-24a6-44e2-b35d-8102e7d7a390", "value": "24576:SeUtDZymgB2iuW3dBTn1H+OuznaXlEiSoMgFLo3dDGe02VWr2lHMhxqqipo:pUbCoKdBT1eOuzaXlEi8uX57sHMIq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674649215, "uuid": "aa75270d-1042-4815-a1ab-3967229e9e11", "value": 1519104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674649215, "uuid": "1ab70175-8830-4125-9464-01bb37ea05c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649215, "uuid": "01a48bce-ed3e-4316-be2a-e1e3cd0b0c17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582e8ca5-9cb9-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1674655538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655538, "uuid": "7834cc5d-46ee-4bd5-b46d-9def7215c692", "comment": "Malware payload (CoinMiner)", "value": "50eafe708b0e411d6f5d31ce3ce14ec8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655538, "uuid": "ae2c0a97-ba1a-4095-b207-3bc957d6ac0b", "comment": "Malware payload (CoinMiner)", "value": "604b694943267865160c335e10efa0375ff8fc29589326dbf1a3939d321ca5c0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655538, "uuid": "f53c7980-9239-4839-a3a1-69b5ee47dab0", "comment": "Malware payload (CoinMiner)", "value": "24e6d617badd100b28061e01b7c3e1bff9266fac", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655538, "uuid": "bd1ebdf0-45a3-4bac-88d4-db57bace442d", "comment": "Malware payload (CoinMiner)", "value": "ddad025804db9d2c0c65d5317439635906666ba724042f9dc11ad8b730c7c4b778a7fee23cec6d13186002ea4cbabbbc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655538, "uuid": "122d34d1-1e52-493b-bb04-9843ed4c0de3", "value": "T130666D07B6A218FCC1AAC470865FD573BD70B8985211797B3694AB302F27F605B1DFA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655538, "uuid": "e3e784d3-a59a-472e-b232-44e1d465ae3e", "value": "98304:4zy95wxCgnV1Df95DvDvD0YJTt3lbO0VRwvAoBzy24WEPea4dqF4vPE3PE3PEnbv:Ao5wb/Td1k6DB1OJu/nSXj0irmYTu0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674655538, "uuid": "34efbd52-4b60-4491-aec2-3cdcb1b7ef65", "value": 7072000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674655538, "uuid": "ef57ce26-c087-4a42-b66b-ae113e54a849", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655538, "uuid": "84e6b8e7-61ce-420f-acd5-191391c9dc71", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f59871-9cd0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674665409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665409, "uuid": "2a59498e-ab21-4d9d-a3f5-e2b5d3b89f7a", "comment": "Malware payload (RedLineStealer)", "value": "8d34e829970233c712c6f5fd499d83bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665409, "uuid": "8c1b32e1-3139-408c-adbe-f60cf098f5fe", "comment": "Malware payload (RedLineStealer)", "value": "60982dc632d901695b4e676038715d09bdc665150d6c235782a96cddcf8f2281", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665409, "uuid": "9e196164-58a6-4c0a-b413-35e4c86de650", "comment": "Malware payload (RedLineStealer)", "value": "03d04132a27e850bf101878e25ba0701b584c332", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665409, "uuid": "76bca274-bb3f-4dbb-9bb2-21f3638028e1", "comment": "Malware payload (RedLineStealer)", "value": "9ff5cac93f03646ab230dbc61e3ea5a157168cd3e4105d688ec57971c93e80ab955c89a24ad63d8130d871f401fd29b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665409, "uuid": "f808b729-cca2-4d53-9cb7-b237e7656bdf", "value": "T18064AE327190B860F91A4A368D1ADBD4BD2DF9D38F3C735B32D46E1F29722A0C576219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665409, "uuid": "8fdd620e-03a7-470a-aa2f-c795465b0f2f", "value": "8ec76f5c59a9f0c161f9365e55dfcda6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665409, "uuid": "6b6d2dab-1670-4e03-bced-40a55dc50f04", "value": "6144:Za9iLrzrN/jdDtmUa9qfq660+MOKXZBT/UTY:Zacrr5jttmKmW9BbUTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674665409, "uuid": "ce9834e2-df69-4215-b2be-5b69257fd2cd", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674665409, "uuid": "355fcdd6-d039-4021-a470-243de11debda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665409, "uuid": "36daa6b6-bac9-4c9c-a26a-4d1c9e24b805", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d9c44e-9cee-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674678483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678483, "uuid": "344018f3-75a2-4a93-a240-ed6665a65cce", "comment": "Malware payload (RedLineStealer)", "value": "f1ddf44d87508d928997ed86fc2c7f94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678483, "uuid": "bc34826e-b074-4e68-86ae-6295e67619ed", "comment": "Malware payload (RedLineStealer)", "value": "60c53aff261b756dd9f22d759688f3d0aa82ac200a29860dd021b168306d619b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678483, "uuid": "fd4d5e59-6dbf-4f94-aa02-336b427adad8", "comment": "Malware payload (RedLineStealer)", "value": "30d878b438dbcd072fde6d75a78b8fbfc59f7a23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678483, "uuid": "3fb4ec88-528a-47cb-ba10-d89dc7533e75", "comment": "Malware payload (RedLineStealer)", "value": "a975134b53e3628120c4fb8b94a7ba57169de42632f561c3fb6ecd4edec0effe4cef2bcf9197f6f0ed191cbf19f196ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678483, "uuid": "d4f3065a-aaff-4220-80be-46c3f535dd66", "value": "T1F6D4AD017AC06032E8B2C131C2695337676DAE7875A689D327EC753A7E31B824DF9397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678483, "uuid": "9c6c3128-12f3-4bbe-9a82-a417f82a6b27", "value": "02cab5f4768f187728c623834dd695f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678483, "uuid": "a3c50ba2-baf3-480e-9e10-c4302467e022", "value": "12288:9Hbezs7Xzgnmj4S307J8al64cF/xwPEK6bGVGB5MH+k:9Hbezs7Dgnmj4S3Ol64ayEBbrbS+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678483, "uuid": "ce84abcf-72de-4e5f-a831-0e03704fbb8f", "value": 642064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678483, "uuid": "80c087ee-c264-4135-951f-759e2a3114dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678483, "uuid": "85d299db-4704-4ace-8b45-d0ae5bf9d240", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80194291-9cee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674678368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678368, "uuid": "70c1c260-5114-4369-8a9c-dcff02b8de9d", "comment": "Malware payload (Formbook)", "value": "3e7cad35813f919d2ef89f15ca50de95", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678368, "uuid": "f0ff156d-9c7a-493a-b980-919422cc4f3b", "comment": "Malware payload (Formbook)", "value": "60d08c361dfc327938059a2afd1ea0d102c6e24df503c7c6452f3add31297f37", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678368, "uuid": "fa206769-4c07-45c9-b0ac-e1ff399f5013", "comment": "Malware payload (Formbook)", "value": "94011d49ec3c21fe858bd5b394bd5bd286788a2e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678368, "uuid": "27821359-2f27-4013-bd3e-080ec80f4984", "comment": "Malware payload (Formbook)", "value": "c701ac8730dc9bb92542ace0301d7c636c4de37b8f99281a8232144b0afe9cd26846b036d928e040712c6b80f132c09a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678368, "uuid": "b89aff40-e0d8-434c-9e5b-33c8d9ad8efb", "value": "T1C1F4BEBC7794AD8EC0178FBB85542D00AA20F4B75F53F383A04B01599A1EBDE8E556E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678368, "uuid": "654d0733-375d-4406-8c7e-e9f4af61efc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678368, "uuid": "e7986e31-93aa-4120-a517-58e4a9c1f3fe", "value": "12288:Ub7iTIUo1A/J9sEl+sCRQKdna6ewbSTkeOfYO3I49/CHrxKUIQMsS:UviTIa9+sCRddna6e9TMY4AL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678368, "uuid": "a799b91f-b9e3-4a24-821e-a79a0d4a905e", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678368, "uuid": "8f7c0036-6ce3-42a3-ac9b-ca027654e0d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678368, "uuid": "a93cd1f1-d3a2-4561-8bfb-58a50fb363fe", "value": "DHL Shipment doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88be1f6-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1674678919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678919, "uuid": "9b4e56c1-81ac-456f-aa68-a05f3951add4", "comment": "Malware payload (RemcosRAT)", "value": "72fabcd2a13ea8dec32cfab0ebc3678d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678919, "uuid": "198cea75-a7ff-4eda-a3fb-fbd239ff2040", "comment": "Malware payload (RemcosRAT)", "value": "612d0efc18bee9c407d22ec6a02ecc13a0cbf23abb3cc1f2b52aa3ac84965d3e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678919, "uuid": "add07908-9d04-4352-8a83-340c47adc668", "comment": "Malware payload (RemcosRAT)", "value": "caf6ca9ab6b52a94a848db5871285fd2f5db5a2c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678919, "uuid": "bd3ac4f0-8726-4397-8d21-ea7c304f4c29", "comment": "Malware payload (RemcosRAT)", "value": "96863a6c7d2a4b74985c27715950ca29543f70afe75e0cec230e2020eb0a299ccb574dc0eb15c1a5286e72b6f2842bc7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678919, "uuid": "333e9c16-e42a-4ea0-a3ea-7bfc3d7f8dd7", "value": "T1A66502693F426749F16EC2783E939CA633997E9E99F711032626370D3CBD168920DF84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678919, "uuid": "3377f17b-3e52-46ef-b8f6-cdbb8ae24e92", "value": "12288:SlhneFTuwGMyk9lhneFTuwGMykrlhneFTuwGMykslhneFTuwGMykjEVpIsu7QQYe:Sk9krkskjgposQYfZG1MRcmKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678919, "uuid": "c10c91d3-87cb-4660-a17e-307919b27c3b", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678919, "uuid": "41dec4b6-ae0a-4f87-88e5-e9a53a9d27c2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678919, "uuid": "6a03ba11-517a-44de-9c18-8693acbb1038", "value": "Doc_799.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f488479a-9c83-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674632607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674632607, "uuid": "bad24730-3a0e-4a74-8315-ace50e8bd04c", "comment": "Malware payload", "value": "0c952979e2d76f8ec17ff34a8023b82b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "libneoffice.com", "colour": "#1C57C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674632607, "uuid": "8d84f960-3de2-4cde-ae77-ff9f85529530", "comment": "Malware payload", "value": "615beea238930be9e92faf8e7394d59d65000beb9728bb8b38f6b31c83e435e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "libneoffice.com", "colour": "#1C57C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674632607, "uuid": "01a9beb4-276b-4c5f-8bcd-e9219eb4813c", "comment": "Malware payload", "value": "7406c03065315f5dd6d84e9443c2f0e92a666c0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "libneoffice.com", "colour": "#1C57C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674632607, "uuid": "3833588f-0c5f-405b-879a-bbb52df7381b", "comment": "Malware payload", "value": "8265c7faab8d74f89ef5b5a47cdc5f4f2ce39887199d57484624c701110a69da7317da02e364f253ec2212d18994b43d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "libneoffice.com", "colour": "#1C57C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674632607, "uuid": "8bd1344d-dd6a-43fa-bdb8-7b6d175e5c64", "value": "T1BC373312AA8F4472F9361771FD79A56AEC72FEA065D760232C7DD2ED02306893C39781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674632607, "uuid": "ba962038-6a8e-46b5-a366-b9ca5f51e60b", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674632607, "uuid": "0597aae0-8f6f-46ca-bd14-2e11187b5cf6", "value": "393216:RXZVmGOIszfE1/giQkQJ/y2OFsaetMhSEiCjjngIlGZi4zym8nmjKAO9wV3ajcv1:NOm/giQP/yWaeiSEikjnRYjzMmW99IFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674632607, "uuid": "98597669-67a8-4b81-a4ac-1827f34574fa", "value": 24336081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674632607, "uuid": "9def37e9-0630-4257-94d7-a69caa665550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674632607, "uuid": "b22c3217-1886-46ee-9dd8-1e06c65b00b5", "value": "t2_sup5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ad8bc2-9cb7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1674654653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674654653, "uuid": "a38a4ce5-82db-432b-9837-727a81686004", "comment": "Malware payload (Amadey)", "value": "665d5c7682e250cfcbeacbc5119f65ae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674654653, "uuid": "f2ca872a-2da2-496c-934c-be83f211e2f7", "comment": "Malware payload (Amadey)", "value": "61f1a2d39b49ded2ad9e84f9826a33c20e8f35e11ecc43d3eac4e076d6d33caf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674654653, "uuid": "69f51ea4-3104-4d5d-93d8-e3d925254d8d", "comment": "Malware payload (Amadey)", "value": "8d1cb038d7e189245b8136c6892835121f28e3fa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674654653, "uuid": "f81c5f7e-f5e3-4e79-9ce8-05bcf82f48b3", "comment": "Malware payload (Amadey)", "value": "360aaeff7f6245a3021fd5d762cf2ab99ef278121be8cde124a9042f2ab0449986f3653589d343e4fb36785677456897", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674654653, "uuid": "6c433979-fde4-433d-a685-98c553c7f7a4", "value": "T16D95E0550D264F68B9BFDB743D198A4FCFABEE906B1105C48A26D430A913BC85F70D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674654653, "uuid": "fdb219c2-0278-485a-9755-873c341aab2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674654653, "uuid": "b9c76f89-ad57-4e28-8a67-db6e2e9ca922", "value": "49152:CPbD8HlG86sDCvOCxHMo9HPKWRsCfa2WxAHtGb2Az9:CDD8HlG86sDCmMMoRKW+CLLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674654653, "uuid": "f91aef9e-cec1-4885-95a9-95980764c8a3", "value": 1999360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674654653, "uuid": "1e00336c-d188-4fb3-883b-55cc57745c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674654653, "uuid": "c7c54ab2-a2a9-4178-bbe6-62db31abc3f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0a18cb-9caa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1674649241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649241, "uuid": "a05684c9-4871-4213-bca2-a5563f08ab30", "comment": "Malware payload (Fabookie)", "value": "e36b667b33d4c9b76f17042fda512335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649241, "uuid": "8d8b010b-0543-4390-8c5d-d1f119da2d79", "comment": "Malware payload (Fabookie)", "value": "624b429fdaa3f9df7c3a64a2e8346a8dc4aadbcccbf1c6d9093e1ccbe62f5cc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649241, "uuid": "c4112621-1122-4d9a-9738-abb4f876a460", "comment": "Malware payload (Fabookie)", "value": "58b18d90c7065c521980f60160f4b8a85e863f3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649241, "uuid": "fbdfedc4-9551-40c3-8ff3-733e7bfd97f0", "comment": "Malware payload (Fabookie)", "value": "1b3ee619f2a8f919579cc6b8905a3df09cc13f5f89ca5309ad9ba9b97fd311adc03d0af06da10f60fc1b50aef9a16157", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649241, "uuid": "05ccdb79-30f0-40c8-928d-32aca823fb11", "value": "T1350602EE624833ACC01A85385533FD45B1B6166F0BE895AE79DB77C037AF850E602B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649241, "uuid": "374c8a85-d232-48e4-b6d9-3a96b54d603d", "value": "245fbb05d3da4d7c6badd5cc3e1f9b98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649241, "uuid": "6caa9e52-8702-4387-95d8-6bd4aab50591", "value": "98304:rsU+EklSge54OAzWsGrAb9As4Mpk3G4hX+IvTd9i:rsvEknZ/EcbZi3JX+2d9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674649241, "uuid": "fd087116-ad24-4bf3-a60d-35c104ccaed3", "value": 3665920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674649241, "uuid": "23fb7d78-fe08-445c-a7c1-dccf048b05e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649241, "uuid": "0d84f0e7-93d3-4872-8f24-e6b31f457d00", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c0a6eb-9caa-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1674649220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649220, "uuid": "99f89c45-4090-40bd-8a2d-2de7def648cd", "comment": "Malware payload (CoinMiner.XMRig)", "value": "de4ef0426636519491bba15a7a6cda05", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649220, "uuid": "fb13616e-e4af-4ed2-b64f-e3f325c182d8", "comment": "Malware payload (CoinMiner.XMRig)", "value": "62657e8757de34719b452195502d0c76f960f2eb566e725bbd1f6772d14bde74", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649220, "uuid": "3664d12f-78d7-446b-a311-4e552c694f84", "comment": "Malware payload (CoinMiner.XMRig)", "value": "d15a7fa38bf5015a8838bd37f4bcfb8aa86dc4a4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649220, "uuid": "c5c8835a-191e-42e9-affb-c5a57a35db73", "comment": "Malware payload (CoinMiner.XMRig)", "value": "87fe2f3ca086a4823365b00978c5f695f8e8718a5f7674899c4d0ac7aa7f8f13f11c4ff8166104f29caddb91d6c058e5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649220, "uuid": "104ffcca-7d0a-4e8b-9186-cdfbad9c67c2", "value": "T144732800F650D53BF4F740FBE2FB059E69289FE4434598DB62D0689F6B216C1BA324A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649220, "uuid": "916c0525-ad3d-492f-b3a8-a2cdcc5a14a6", "value": "dac8ae7c837e7fe3a3ea62e0b6800155", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649220, "uuid": "69757e29-be08-44eb-94c1-8010fa927603", "value": "1536:ga3Mz8OpJS7LcTolIk4Fvxv8xRh9sfFF:6wb7LeaIkQvxvqGfFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674649220, "uuid": "efd1d94a-d6e9-4e01-b895-93ab9bf5abea", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674649220, "uuid": "b10a9189-510c-4e47-a677-b450135aaaa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649220, "uuid": "0513be44-6361-4d85-914c-525f0b2dd22d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b845d535-9ca3-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674646250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646250, "uuid": "b81144b4-7ed3-4e96-81e4-1ee520b052f6", "comment": "Malware payload (njrat)", "value": "c0dbbc6e77a3b9cdad5563e7c814e053", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646250, "uuid": "c5faa855-5179-4273-9914-589ea02eb69b", "comment": "Malware payload (njrat)", "value": "62723ed12c72ceb21bc77c63811f58ab082b36bd8487531d8b52e4de5030c7f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646250, "uuid": "4d404fbf-772b-45a6-8e2c-8c92272a7e07", "comment": "Malware payload (njrat)", "value": "c814d27d1c1e7963c7d3ba533025918d70fc1ef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646250, "uuid": "a0098a9d-3c57-42ff-af66-f9243a8fb3f8", "comment": "Malware payload (njrat)", "value": "d2dd588d8e923eb4bea69b072ff6175557db111dd3929b016de524c9c104fbddfb16b7af8f73a1e03d182189b889f06a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646250, "uuid": "cb9de7c7-5d4c-437c-a391-35959f2db34a", "value": "T1AF033A4D7FE18168C5FD467B05B2E413077AE00B6E23D91E8EE164AA37636C58B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646250, "uuid": "4d7b5436-23a6-4204-bde3-0996440dedb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646250, "uuid": "6e002f54-5380-4147-8583-0ee38415165f", "value": "384:OA0GK3hUidkcXR21cGMy8P4E5fXUFl6M0lrAF+rMRTyN/0L+EcoinblneHQM3epA:R0GK3rLGv8P4E58qMorM+rMRa8Nunmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674646250, "uuid": "5f7f914a-3e89-4f43-ba0e-25b59c524d25", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674646250, "uuid": "b1bea358-bd8a-4ca5-bf31-7097a730316c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646250, "uuid": "395a88a5-a11b-477c-a7f9-c5f1844743dd", "value": "c0dbbc6e77a3b9cdad5563e7c814e053.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4041fce6-9c86-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674633593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633593, "uuid": "13080e34-9ddc-4fe6-8e88-1c0f1ca3ba3c", "comment": "Malware payload (AgentTesla)", "value": "ef70fb1a364dccc7f137fc7413636eda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633593, "uuid": "4dfa9c1c-5e53-4f12-bb66-e59c1cd96d82", "comment": "Malware payload (AgentTesla)", "value": "6287fb36baa0fae74fd9987cd88de072b2923a28955f12f53b1ba215fe52930c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633593, "uuid": "98866e3d-3b60-4673-9bef-20c2e5379412", "comment": "Malware payload (AgentTesla)", "value": "3f3b3b54a50a6e2d17c97342add6cea9e4e12507", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633593, "uuid": "f65316e5-930a-46d6-9d86-e26bfca5cc99", "comment": "Malware payload (AgentTesla)", "value": "371de872003172a1645f6def3dc2029ca98adac5751eeb5de164a27e9485d396a8e690dcb996a8de880c10968a26f98e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633593, "uuid": "9d2e12d8-f53e-4e4f-9ff1-0d285665601d", "value": "T165F19DDC8E57C15F63B201B031FABAAEAA3399D8242BCE653807E85C8D838615D104D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633593, "uuid": "9cc88fa7-e633-4809-95f0-e919d4ac8d53", "value": "192:V/tsNCvOWpEetS3VddGtoTWIf8KqolyZWNmdTzbci:wUvOWpEet0TfJlyZCmxzbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674633593, "uuid": "b64f3ac2-052f-438c-84a1-10ba5b2096ca", "value": 7967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674633593, "uuid": "1ffe4177-e118-4cee-bc5e-daf26ad3200f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633593, "uuid": "151aff94-0f7d-4be1-9467-75aaff8cbff3", "value": "PI_NBI-2250123(MECH)_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6beef40-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674678916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678916, "uuid": "e4b35dcf-a240-40ab-a14b-501b28639620", "comment": "Malware payload", "value": "3518e0ea1d12fb7270840ccf51ea7e12", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678916, "uuid": "2c7aa28f-b449-4710-b5c2-7f48c786f96a", "comment": "Malware payload", "value": "6301c7185aeb51cc2bf3eb5840b1af2a6491dc9447628e7b371e8639a62bf64f", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678916, "uuid": "1a1758ca-f741-4562-8f6a-70bdc7703788", "comment": "Malware payload", "value": "e90eaadc59e9c50c0d8a263ad3f5b919c4cf9105", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678916, "uuid": "877df5a1-6dea-469c-a9f7-5360fb0f823e", "comment": "Malware payload", "value": "cba860a777b30775988963f9ce91649378b43b5eccc58ba4c2e87d24d3af5e5f0a31c9f5267b65f802c8bb733db2a02f", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678916, "uuid": "8ad006b6-c3eb-45eb-adb3-25a9f3e757b6", "value": "T1A0E24EA6B3D6DC46D94907354CE6C2D67626BC626FA3834B3389F71E1F71AC0890361B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678916, "uuid": "518ebfad-6108-4adc-a2f5-656111c453b9", "value": "768:WUck3hOdsylKlgryzc4bNhZFGzE+cL2knAJ6OiCsJdjcrwQ70LSijx:sk3hOdsylKlgryzc4bNhZFGzE+cL2knB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678916, "uuid": "95c83ee8-2c78-4713-bf0f-e49d4d2fd4ef", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678916, "uuid": "bf35d43a-d067-4bd0-9ff7-fdd524cc6a4e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678916, "uuid": "33bf7bab-af79-41eb-911d-3f452e5813bc", "value": "Order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf90024f-9c9f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674644544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674644544, "uuid": "1bae310f-a2d1-4830-af95-fdefbc5dc11a", "comment": "Malware payload (RedLineStealer)", "value": "65fb6d2f92197ecfc2acc3fa4e4b4373", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674644544, "uuid": "0f273e03-bb54-4c83-9793-d4bd07824e8d", "comment": "Malware payload (RedLineStealer)", "value": "631505406e7458ef3b2300f251ed10a77655757e77e11ff06fbacb6a625cc992", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674644544, "uuid": "b4694f64-dea1-4d67-bcdb-7beee8a12367", "comment": "Malware payload (RedLineStealer)", "value": "ef029bf54ec6b22ef700cdf5e953a85cfa5023ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674644544, "uuid": "1d7b037e-8474-47b5-a8cf-22099fc2172f", "comment": "Malware payload (RedLineStealer)", "value": "4843ec49f99cdfdea45d8ac29ec09afef09fa067f41c8cf4214d0e3f453de2e1acb8af3528bbb3fba1b4d1db566c79a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674644544, "uuid": "a05f7df2-38c0-4eed-b9f1-a7aed2f3d80a", "value": "T15A748E02E2A8FAD0F69DCA35AD1EA7DC363EB9D05D146726322D7A3F15701E1C12A31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674644544, "uuid": "12da4698-ed46-4e7d-954d-f74d38cc7361", "value": "787cd3f7e6d0161bfca0cbd92375e751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674644544, "uuid": "ca28a169-3170-4450-a55f-61784474ed48", "value": "6144:KLjFeOjL4MvtA6erK/9YbhOjq7VWRFBMolz90VEbp:K3Fjj5vW6eIgr7VWR5lz8Ebp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674644544, "uuid": "49b54c77-4ba8-448b-99ef-77af33318d85", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674644544, "uuid": "4abdd681-ef5b-44ce-a761-7892a27a169e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674644544, "uuid": "8f5dd86e-80a4-4fa8-b2af-84b2e41a760e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca23324-9c49-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674607683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607683, "uuid": "4c375a52-5b3b-4ee4-92ac-bf1e0767ba16", "comment": "Malware payload", "value": "22f4e90bc71f73721342246f7cd90f3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607683, "uuid": "7ab1b101-dcbf-4f49-a7ef-0da0b85ccb5d", "comment": "Malware payload", "value": "64c8e8930db0808c3c96aaf245cf69e7255e2cb72c91203df7a5d024ca2482f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607683, "uuid": "17a58c33-9e9c-42d2-87b2-bbbf3bff655e", "comment": "Malware payload", "value": "c0c51019cfa62229f3f80baab2bc3a575d5e6e92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607683, "uuid": "3cc1f11c-0f2e-47bf-ab2a-248ebffc8e9e", "comment": "Malware payload", "value": "e253031ab299d63512f63cfb7136a8e94d673bdab6c22ce418597d729cbf25496af1d8fb47e4fa6869b1ed21893186b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607683, "uuid": "28bf6ca9-cd81-4a0b-82a8-94a6eeb193f0", "value": "T16D863369BE02843BF84335F20F8CD0FB19A1EE3568B196A773D91E6DCB36D951E15208", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607683, "uuid": "cf941c07-e2e4-4c87-a582-0250ba667482", "value": "8d92fa1956a6a631c642190121740197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607683, "uuid": "888b58ac-61a8-4379-a039-6f6ffcdac986", "value": "196608:hxVcsagliOKG5JneBygIOQfJXgZGfdUq0Pyrp:hxVcsaDbECxQBgQB061", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674607683, "uuid": "c2405d5c-70d6-4a54-89e0-b5dff65c87a4", "value": 8192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674607683, "uuid": "4b188615-d7ec-44d1-ac69-11bed2d13d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607683, "uuid": "ceea784f-94d8-46b2-bea2-c69736190322", "value": "Slot+.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c3502f-9ce9-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1674676114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676114, "uuid": "0f2b9c29-4809-42a9-a96e-1de48285d210", "comment": "Malware payload (ArkeiStealer)", "value": "494e03d339c4b84f71f0c122de940860", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676114, "uuid": "b41b530d-bc62-40ec-9aa5-ba31609d001b", "comment": "Malware payload (ArkeiStealer)", "value": "6511d09ada2bc11a95c06bd20abb66f450b9b2a6ed1f00c723401884ce7a2e61", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676114, "uuid": "1e89fea5-1116-47f5-9710-a2156e3b1ba5", "comment": "Malware payload (ArkeiStealer)", "value": "85152244f96b8a76ece7a26ba1db4eded3715b80", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676114, "uuid": "11701a30-8f4a-4e5c-a423-d734eed57b78", "comment": "Malware payload (ArkeiStealer)", "value": "9093b947a71903420af73e15a03196a237e0d082e69bc32758c705aa76deaadeb09e0c4e1b87d376d7cd0b322c453d7c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676114, "uuid": "9ec5258e-eec6-403a-9224-62a65c034d8f", "value": "T17F062373125120CAD0D9E9BD8637FE91B1F613BB8F46E8B5A7CE6AC429315E0D213943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676114, "uuid": "64614a31-d96c-4c65-8f05-b0efbee89f7f", "value": "acbbb57a9e219cbd48d9ce15a64944ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676114, "uuid": "7ae1200c-08f8-413c-922c-da31d87c9d52", "value": "98304:aVZ0gaAV265MWQT+VagEfsjjTNKBxeY19ICtHm:C3h2ChRogXjXNKBxemtHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674676114, "uuid": "06248a2a-4122-4884-8b98-d74ebc57e25a", "value": 3999744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674676114, "uuid": "f59c1be5-8861-4d29-a182-8904e1606366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676114, "uuid": "bd004997-1bd0-45e9-abfc-3dcca3c0e606", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7d976d-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1674678790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678790, "uuid": "697c1b77-5866-4a7f-ad26-66c75a517297", "comment": "Malware payload (ArkeiStealer)", "value": "1751d7594be6ea432904805587fb23a8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678790, "uuid": "388a4b15-e1f8-4a57-a6a6-de4979194139", "comment": "Malware payload (ArkeiStealer)", "value": "6589bdf9c86bae4396d89769538a7ab15ae9050efcfb40998f668ee1ae881a2f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678790, "uuid": "53fb0c62-ba1f-42bf-bff4-46b8d8e117ec", "comment": "Malware payload (ArkeiStealer)", "value": "86dca9fcdcf8a3c40840c5dae97cb4de044de42a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678790, "uuid": "3987e0e6-90c7-4ea8-8d06-00ca6de01a3c", "comment": "Malware payload (ArkeiStealer)", "value": "5dc43c37926f678325ac307ab466b258cb530be1dadee58ce644693d92ea074b890c60de98c2e3c6d551cac91216de58", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678790, "uuid": "dee5bf3f-b4c9-4b63-8b52-2c52964dabee", "value": "T16F271262FB4331D1D5E4887188277CF731B17D6B87C05B3AA4F8758108A279ABA36937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678790, "uuid": "d6124a5b-8e6b-4f31-8685-17aa92e07e53", "value": "9f95eae0e562cdd8c0f94b7ddd3234c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678790, "uuid": "7a76c0cf-bacf-4b4c-b537-9a91baced940", "value": "98304:HAYXBtgbPrAuVAE6lu0gaq8JmGnVFJIBjg9KXQup70J8RgB0hJk48JI72P8qz7gX:FRtgPrAXEBXuwg9Mtx0JhunkJ4qz4FNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678790, "uuid": "c968c037-59c6-4e26-b81d-97befa6e9c3a", "value": 20956931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678790, "uuid": "47320124-68cb-4279-9b8a-decb6324a1fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678790, "uuid": "3b477277-9e2f-45d0-896d-28521de1a91f", "value": "1751d7594be6ea432904805587fb23a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c7d3f6-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674678965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678965, "uuid": "77a77f64-b6ae-47b9-9baf-dafd0a82a9ae", "comment": "Malware payload (SnakeKeylogger)", "value": "f138efe87edfdf3c00c056a0c15ab6be", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678965, "uuid": "8a709746-26d9-49d1-b445-ffa3f01de751", "comment": "Malware payload (SnakeKeylogger)", "value": "65a05590fb4b94e7d0c0ee211536d467c72019a0b323f3e709b8356d9f2e3de7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678965, "uuid": "46a94b2e-0cfb-4c62-9968-17650e823977", "comment": "Malware payload (SnakeKeylogger)", "value": "6cd2eabe20498719b37bb5444d9ea73ff311e889", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678965, "uuid": "f1a77a77-45d4-4ecf-9316-7e657f52b56f", "comment": "Malware payload (SnakeKeylogger)", "value": "53e6432899af040f26a3210a7a272ba751a8f44448ff45c7be85a239941c729da6145a3b999e1a58d64d7e823ae4b20f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678965, "uuid": "563ee6a3-6a06-4afd-b09f-981295b265ae", "value": "T15074D009B785D997F99303388893CA963329FC4C7F4246073A647F1E7CB16B44B2A799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678965, "uuid": "ce5132f4-858e-49cf-a724-116abb68485a", "value": "6144:Th0k5eq1h0k5eqnh0k5eO6h0k5eqiZ+RwPONXoRjDhIcp0fDlavx+W26nAEW6rU9:Tykdykvykmykh4DYRqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678965, "uuid": "b247e1ba-ae7b-484a-ac02-e1b03274a865", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678965, "uuid": "0ab19f02-fd54-4c3b-80d7-229e11b5d304", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678965, "uuid": "f5b3494d-5711-4e76-ad94-82af3688ecbc", "value": "Confirmation Hsbc Swift.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2638b586-9ce9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674676070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676070, "uuid": "eaf100c6-aede-4cf2-9b9f-f67375b6542d", "comment": "Malware payload (Smoke Loader)", "value": "c2310ecf0e8708584ad34c7411612667", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676070, "uuid": "a37d7079-9bca-4f6c-a23e-8cb01f0d5242", "comment": "Malware payload (Smoke Loader)", "value": "65f802f59f7439187188f9ec1590d4e9487f7c270ee1b05a995e3e9028ec248e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676070, "uuid": "d7174d08-2ff0-4b20-83f9-cb59d26c436b", "comment": "Malware payload (Smoke Loader)", "value": "c0e73ab13b34b52f47bfabfdbd4d20602f0266d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676070, "uuid": "10afa0f0-2959-45e4-8c9d-c7a2f9ee8163", "comment": "Malware payload (Smoke Loader)", "value": "58e14457139955f678f3a134d4e20e1b1ba6033fee2615979702261e385572f6c7adaad7860353a1cdfea5d3ce673e9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676070, "uuid": "450cf2db-bf0d-4eb5-94c4-9ef8b69c6a93", "value": "T15A64AE2271E0ACA0F91E4A79CD1ADBD4792EF8D28F3C735732D4E61F19722A0D52621D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676070, "uuid": "d3dc85bf-f8f9-444c-9181-8a691e6a9a26", "value": "8ec76f5c59a9f0c161f9365e55dfcda6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676070, "uuid": "cc53d12f-099b-4bde-82a9-e95e472fc302", "value": "6144:W8Lh0iVd34PYpcWoLzcbRTxf2XI0+MOKXJUTW:W8SiVdIPYpmLzcbR9f24WtUTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674676070, "uuid": "6ef667e2-2366-40ff-bccc-896bceb0e174", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674676070, "uuid": "1edd6cf2-0e36-463c-b15f-bf6af02af884", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676070, "uuid": "0095f4d0-659b-4b82-a1ea-6e611fa1f98d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b50684-9ca1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1674645219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674645219, "uuid": "5636dcf8-1450-4e62-afdc-aaea4a485773", "comment": "Malware payload (RecordBreaker)", "value": "030eb10b5870ab3d80954c2cde57958d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674645219, "uuid": "5b33bd26-0269-446f-9c56-7b5e30fd8b6e", "comment": "Malware payload (RecordBreaker)", "value": "6645ff72ed5da7482e0d3f3a9bbdec8c20bf16474f2138b007599f8ce45ca51e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674645219, "uuid": "696dc172-a66a-4482-b90b-e02193b8fbc5", "comment": "Malware payload (RecordBreaker)", "value": "234bfd0aed54e6c43c22ced5ac90257b305ed1a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674645219, "uuid": "7b21c361-70fd-440b-b3d3-91748d6ade9a", "comment": "Malware payload (RecordBreaker)", "value": "3fee0711176b21c374e05a5923fac448c0767955d334458fe2c8b459e0d0800a946a22aba2f227fc8499cfa0f3487d64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674645219, "uuid": "cb8afac4-50d2-4245-a8f4-1caa000cd714", "value": "T1B1748D02E298BE91F59DDA318D1EABEC763DF9408D187726322D7A3F19701E1C52A31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674645219, "uuid": "3e38f464-5e34-4b92-8be5-9026cdbf999c", "value": "787cd3f7e6d0161bfca0cbd92375e751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674645219, "uuid": "d479fb43-8ad9-4c4e-9090-8bb28d1e53b9", "value": "6144:GbLpceowVd1lUIjmto/aYYOjq7VWRFBMolz90KvQm:utcJode4i7VWR5lzBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674645219, "uuid": "1d981fbf-8eac-4ab5-8e1c-4a87a6e0c6c4", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674645219, "uuid": "eaf85352-5406-43ae-a2be-f4ba3131f900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674645219, "uuid": "75160780-346f-41f8-873d-971de5b769b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d002365-9c80-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1674630957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630957, "uuid": "064ae703-84b2-4f1f-819c-f79139015363", "comment": "Malware payload (IcedID)", "value": "b385c9fafe941568eee3f736c2f757ba", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630957, "uuid": "33a1d630-5b57-4606-8e4b-866162c40993", "comment": "Malware payload (IcedID)", "value": "682ed1519f0c21d7fd38bb4f087f13ff031727792ad5fbd3ee18c2f2c8c8bdb2", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630957, "uuid": "d04979f4-9b34-40f2-8c54-957d06936812", "comment": "Malware payload (IcedID)", "value": "2c901ddb353d8447c5921099572db56b9333a0f5", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630957, "uuid": "4cde8249-80a4-465a-9ac1-0a16d3f79d3d", "comment": "Malware payload (IcedID)", "value": "be2f4854d3609e8d7f7b7652f4ee5d584275aa5b73f9f47a4acc89106ca741e41637bab78d5f834c96d952b25a8093e5", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630957, "uuid": "b5793e81-1aaa-4784-a3b9-87e4265b00ae", "value": "T1131512BCE4322782C1CAE4F455F85FF90BB8FCB319AA29C9891D910D88E554F991AB05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630957, "uuid": "e8991bbc-bc9c-4929-a02b-68bfd41b1bb7", "value": "3072:0w3D57Q9xcjANZeSxYl833AzGVllBI/eXetBoEfDcsoZ4IX7PMnNTqUYcUCJolT:z31QHISp3AY02XaBDc9eNTqUObd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674630957, "uuid": "349f0748-599a-4f14-a8f2-151d1dd6fb07", "value": 878517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674630957, "uuid": "7cd82216-6a2d-4be2-968e-2b88ce02546a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630957, "uuid": "ba71ff53-f40f-417c-ba49-e2ae9d747059", "value": "Setup_Win_25-01-2023_03-07-48.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828e33ef-9cd6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674668064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668064, "uuid": "2dd63a08-70e9-4414-9531-533e84bf3d5d", "comment": "Malware payload (Gafgyt)", "value": "5a48beaf7ffc542e1961bd91cb223ecd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668064, "uuid": "05b9c224-50ac-4e2c-bd92-78395850df76", "comment": "Malware payload (Gafgyt)", "value": "68f5eb3dafc259d87a70ed1ed938c9f9c332b706f22ebd791e3db494fb4fccd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668064, "uuid": "305fc131-1f2f-4f14-a3b8-88ae050a7290", "comment": "Malware payload (Gafgyt)", "value": "bff7f4f09c70be1e6d4f5cec07838f6d2a32a6c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668064, "uuid": "4aa4558c-e173-4ac0-bd6a-0e383d041122", "comment": "Malware payload (Gafgyt)", "value": "26577650a6c7ec628319731ad6fa13350c7c396fec4e6791f209339557250447fbb699bd4d66969c0cb49c4766b677ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668064, "uuid": "97be7c2f-83c4-4742-9f72-bb041e81e983", "value": "T19C930892B800DFB7F40ED77A08D34725B670FBA24E531662731779A6AE322D43822F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668064, "uuid": "e24cdd5a-fab9-4ce8-91a9-bfdd8385db4c", "value": "1536:QKx+uX58NlGUGYgFQmjHdJANn9zofeQyBUgMN2s1U/TmQ9VqXjewf2Le:TTX0luYWTo9ofeQyBUB8bmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668064, "uuid": "fee9067e-4971-4ff8-812b-bf6c98d64a17", "value": 91091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668064, "uuid": "fe40d96e-f1da-47a5-bf33-78b240a5ef33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668064, "uuid": "9263400e-98e2-4483-be76-ff68f98e97ed", "value": "5a48beaf7ffc542e1961bd91cb223ecd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69cb711b-9ccc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674663728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674663728, "uuid": "32999193-7645-4047-88df-995796b3e1e2", "comment": "Malware payload (AgentTesla)", "value": "bdaa5d5fa8e12cac9e6ccd89f0565719", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674663728, "uuid": "418cf644-b95d-4fbe-a03c-89f1ae8f89e1", "comment": "Malware payload (AgentTesla)", "value": "6910ddded2d5d26211f0db7a9f09437cd7fca18ddda43bd70f830b1380b3ea8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674663728, "uuid": "ec1aede3-00d4-406f-a1b7-f0e596aa786a", "comment": "Malware payload (AgentTesla)", "value": "428ee8728eb23e8505f954dcfef642feaa76c3af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674663728, "uuid": "fd8d0aea-b73a-4e70-bf70-8d9d6a091905", "comment": "Malware payload (AgentTesla)", "value": "b116c5f922b14f5c00a6b4697207895745af1f0aea440a15cdea9a530c291fef2855c354ebeee380753527b201eb48a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674663728, "uuid": "ecf38fc2-4b2e-4010-bb21-ad26235f1188", "value": "T135E45A411A7B87E2E4F94E78163CA5182BA11CD147ACB13EBD827DBA8CE774F0095723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674663728, "uuid": "f809eef5-e7a3-4dc2-8a13-e260667f3b56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674663728, "uuid": "d7a028ea-2c50-4fff-a02e-d4e5b0ae586f", "value": "12288:NSmTlinu0bkBOWPiFKWsiylBsbtDdD5UVyDir39IE2S2:kmTli3kBOWaFKTiy45ZOYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674663728, "uuid": "7ded7066-b7c9-48ff-bc39-1fa16ca2f46a", "value": 675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674663728, "uuid": "33cee49a-e5a8-4038-aaaf-16f743c0b4f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674663728, "uuid": "d4803fc6-8e70-474d-b9c0-6319a1f0736e", "value": "sat\u0131n alma emri.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a920ed5e-9c85-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1674633340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633340, "uuid": "bc12323c-18c3-4707-a276-834891a2f5d1", "comment": "Malware payload (Stop)", "value": "cbd5866823162fabe718f129da023984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633340, "uuid": "63973109-f092-429d-990b-049981e24902", "comment": "Malware payload (Stop)", "value": "69ac7dbf2ec81c66dcfe1b1e560972c8ed26ebff9706f88b8aa4ce9926f96df8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633340, "uuid": "294430a4-e84c-4f7d-bdd4-1e7731d72571", "comment": "Malware payload (Stop)", "value": "cedfb93c59a41c0650b2aaa279bf94c0de35c826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633340, "uuid": "b6161e6c-65ea-4ce0-8986-06ac28407227", "comment": "Malware payload (Stop)", "value": "4b65d4ae732896f940b27a7d372dfad70ff2176b20737cbf25bd659f880b77372bfcac8a0e746d4f8336da3c257f7885", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633340, "uuid": "1bbd07e2-b39d-4f83-925e-db599ea9adf0", "value": "T15BE422217870C072CB1605754866CAD4AFBEF43293A9D9B333680A6D4F767F0A57A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633340, "uuid": "09cced02-ef93-48dd-9fc7-eeaa2f81a4f2", "value": "39a12ed3ec7befeb872d2cda1d789974", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633340, "uuid": "a848b242-fa6e-4f9a-a15e-e541625b82e4", "value": "12288:la11841UdETCRpNL6GlDmI+Gvap6hBasBBHmo7AUWO8qLeeIwy9:l4841wNLLDm1GvcMbXAUWOue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674633340, "uuid": "c848dc6e-b5fc-41a8-af95-31be1b23dff4", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674633340, "uuid": "ac27126d-8d38-451c-9a36-8e209256dff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633340, "uuid": "88b1080c-974d-4d60-b8c0-889bc96c1723", "value": "cbd5866823162fabe718f129da023984.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7dcda3-9c7d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674629913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674629913, "uuid": "20e23352-d277-412a-9222-3a96b040c8e5", "comment": "Malware payload", "value": "797f15c89fc3dc9d052061202c9d65cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674629913, "uuid": "9dd2c1c6-ba76-48c6-9fa1-c76454d6c207", "comment": "Malware payload", "value": "6a2df4801d1b40e34b9b1be91b0aaa6e49da66fd5ed09254d83af2ec86c8d81c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674629913, "uuid": "41b7c4b6-6bbb-4d05-8f7c-0a3bc94c2bc9", "comment": "Malware payload", "value": "d67178eedd91ab53c79ded28c0fd87d0149ac8ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674629913, "uuid": "2fb37cf8-7a21-41aa-a3c6-b58c6dee3f56", "comment": "Malware payload", "value": "0bb613c1934b99e3677ffaf7a1c5d4713caa4d482a4c96af48b91aca0235a30d680726fd90396a6b1c82e22682070bb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674629913, "uuid": "45fd3426-b146-48bc-b9ee-561c5d3692dd", "value": "T17E546C20B202D036FCA34473BDFEC9AE552C79200F6614E7B3C85EAEDE546D1A63175A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674629913, "uuid": "4f111045-92e5-45a0-a906-54b39d489f69", "value": "e88acaf620491944e2fca7bab702ad6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674629913, "uuid": "5654c704-4ee5-4e5e-8a8f-188a412b291d", "value": "6144:JKx4ytgiRFFTrouqPIJMWWnOYFqLBLMuHJ4BcpfLAOi7y:tyR1TrouqPIJMWWOYluHJqe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674629913, "uuid": "2567b34c-1551-4581-9169-b5eee1add81a", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674629913, "uuid": "ed14c968-632f-4096-baba-e318ee61005d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674629913, "uuid": "845cd51a-9796-418a-91e8-c3bb2eb52ec3", "value": "797f15c89fc3dc9d052061202c9d65cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67489c40-9c95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674640101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640101, "uuid": "1670e224-5bc2-4bb5-8405-fe485002e0eb", "comment": "Malware payload (Formbook)", "value": "695047dac64b9be83b7e39a3699d4f9a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640101, "uuid": "13f105e3-6f09-4b9a-8920-afb756827267", "comment": "Malware payload (Formbook)", "value": "6a6634a6754be1fdcb3a84e5a32a6bc1171b3975a85aa2f9e6deb5f3bfdf9d8b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640101, "uuid": "0a32223b-dbfe-4dd6-a6b0-7ace5fe60a39", "comment": "Malware payload (Formbook)", "value": "0fd82ec7cd187a071538230eb92efa539c5384c8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640101, "uuid": "a7c87078-0b70-471c-9f76-5c7e7d58a90a", "comment": "Malware payload (Formbook)", "value": "6c66185f84b78c2009cad70744b9cf18b9741d669f69d9123aa582426c8a7be6559c9be7900a7cdc213bf81681df8286", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640101, "uuid": "0d896d45-a057-4d6e-9f2e-b859ee31a5f9", "value": "T1D955E040AA784B57F4FC4FFC427D62861FB0286B63E3E3B51ED922D616537428601AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640101, "uuid": "48b5a53f-0176-4885-9675-16ed601ae426", "value": "24576:NRO6AAgZbQzlGIyZFggDJKES2J7GPzlz/MtP:DO6AnjIKFNDS2JyPzN/EP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674640101, "uuid": "b0f47a90-3090-4fb7-8aed-3e347be90ba0", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674640101, "uuid": "5d8a71d6-f76e-4974-8e1a-bf3882fa71da", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640101, "uuid": "3fb30821-df1c-470f-88e8-d6d1c5a1396a", "value": "DSX-air shower quotation.pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df98b90-9c5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1674615175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674615175, "uuid": "fe12634e-beac-416f-be41-592b7f5cac0b", "comment": "Malware payload (TeamBot)", "value": "b9692db9dbb1571056c4b6f85b08acf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674615175, "uuid": "3bbcc870-8cef-434d-badb-3b74a61209ac", "comment": "Malware payload (TeamBot)", "value": "6ae57927ebedd06074e9f6bb22bac94e04048cb3d620bafd0e1f47bd7a336673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674615175, "uuid": "8aa90b61-ad5e-4a85-b9b1-f71bd4c333c9", "comment": "Malware payload (TeamBot)", "value": "2cc121aa01977bd248f1ee564dd7b699a57696e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674615175, "uuid": "87f9961a-5c1a-4eb8-9ba5-8d98b5b2ebd4", "comment": "Malware payload (TeamBot)", "value": "73de3f24352544eb687bbe3a61a2ad5a61cb43208f970522c7db3553f181e8f8309d588b962a238d46e527ae76d444f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674615175, "uuid": "eb853497-8ec9-4f1c-b34b-0ad4afe50ab6", "value": "T1DD14E1217AE0C031C0D227781D60E7D4AF7DB97146E5A8877B981B7E6F306E1563638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674615175, "uuid": "b4c75f4c-6a82-4786-bfe9-9f59fa527788", "value": "5eb8e9ebd49d9ccce156e2e9eb6d0902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674615175, "uuid": "7d6da804-6a10-4e97-a6c6-60207aa0d475", "value": "3072:OLBN2Cxfl2mLhnfXlf+4W5WP6QjQCsN0SiRlmNahJLAGoMeud:O1HtLNlf+47QCsGoQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674615175, "uuid": "cb28c02a-36a4-4fdc-8e33-45b0f90bab83", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674615175, "uuid": "dd8ce02e-1cb4-476b-9cc0-eecc212027d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674615175, "uuid": "85bdd3d2-6ef5-43aa-aa4f-56ad5ce604ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb35e00-9c7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674630854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630854, "uuid": "608e051c-54e1-473a-be3d-135bd458f3db", "comment": "Malware payload (AgentTesla)", "value": "f76c279f998ef01d6da209ac26e6f027", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630854, "uuid": "e15107d1-6fb7-47c1-b619-a720ccfbd27b", "comment": "Malware payload (AgentTesla)", "value": "6bfbd4f78a54cb0628317d6cf0344e4f2824dc2d554ca0e18df4a85ab2c6ecd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630854, "uuid": "ae9ad9bd-42a8-420a-8aca-85b423d57f73", "comment": "Malware payload (AgentTesla)", "value": "58e8e55f593cdf80f5b779a57053299eeb0476a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630854, "uuid": "4095a6b3-f507-4a4b-8973-ae7e5a356c2e", "comment": "Malware payload (AgentTesla)", "value": "026c978f5645c5412fd9d2de01a5d9b19c98fc375bbcd353561ec768dc0c9cf765ae8b517d283b145a574d850bb0bcc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630854, "uuid": "bd02c72d-4bef-4808-a33f-d29a06213072", "value": "T1E9F4BEBC7790EC8FC0178F7B85542C00AA60F4B75B57E383A04B15A99A1EBDD8E546E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630854, "uuid": "f37efc05-976f-410d-bb4f-a20f363bae3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630854, "uuid": "edde72b0-14d9-43f2-9afe-d188c1fe61ef", "value": "12288:NNgTNLaOLw5HMO1YpyHVR9v5HDYnrEBex8zbyH5LQY8pbXrfDZ+PBbI9:NQNLaOLw5LmpyTHUpuE5L4pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674630854, "uuid": "360a6c3a-bc5d-45b3-b82d-0efdd31ff60f", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674630854, "uuid": "c654d742-217e-4542-9856-76187725361e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630854, "uuid": "eddc0bf6-081d-49ba-85cb-184acdf96d6a", "value": "DHL Express Shipping DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8663c8-9cf7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1674682122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682122, "uuid": "ba3fbe59-554c-467c-a3b1-a2a0c563a1fd", "comment": "Malware payload (AveMariaRAT)", "value": "01ff6e3e800d174e5d9a1b2b0b7ab5a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682122, "uuid": "8458b72b-4601-412c-bb51-d4487e0625cf", "comment": "Malware payload (AveMariaRAT)", "value": "6d49b257e1bdb9fabc8369f943c13fa820bc5a94636b040c22a4dda60c0a779f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682122, "uuid": "7a5d7764-c11a-4e92-8244-8be4a074410f", "comment": "Malware payload (AveMariaRAT)", "value": "3b84593d28fdcaf0c6d506be3d83e9858a166245", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682122, "uuid": "f779c3fa-979e-4478-81dd-4b76b12321f8", "comment": "Malware payload (AveMariaRAT)", "value": "18a49c3169cbfce678c9f43fb355d781b2705f207a6159ca9821b13100bafc664d1ba79a90f34842a97f87c886921610", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682122, "uuid": "f54b5400-3fae-4718-9e97-bba76317b60c", "value": "T11044120426E4E557ED672A71AEBE1773CAB5B12315DC264A5B900E58BD33084DF0E3B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682122, "uuid": "5346f43f-7069-47e5-a31e-bd69d69df8d4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682122, "uuid": "83f67b7c-9ee6-4471-969a-b9de1be6c938", "value": "6144:pYa6b4M6Ge1cNSeYDnWoKbDeMUE7akD/CC6Mjs4JW1J:pYN4MG1cNTYKBuN7kDq+sJ1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674682122, "uuid": "82227469-88f3-4a4a-a60d-3dfcdde96d34", "value": 264008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674682122, "uuid": "1225332b-f381-4190-a9f3-74962455a392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682122, "uuid": "e35d8479-a528-49f6-a7ab-b94333868b96", "value": "01ff6e3e800d174e5d9a1b2b0b7ab5a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07963226-9c4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674609876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674609876, "uuid": "e837bb69-2b76-4890-8d02-adc9ba7f3392", "comment": "Malware payload (Smoke Loader)", "value": "27327a809443f7af99f64e1b8a4a88f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674609876, "uuid": "997b9c0d-b4ec-4fa4-ab5f-3fb072956b98", "comment": "Malware payload (Smoke Loader)", "value": "6d7fbd8fe1154a18ec805fc5351678c4f3c4d34ea35e1f86b289b3cbbf10cfd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674609876, "uuid": "163c79be-caae-4169-9934-2991664eb63a", "comment": "Malware payload (Smoke Loader)", "value": "fcb74ca86eb2c0512c7becedd31eeecfedcd8286", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674609876, "uuid": "1fc4a7c4-933e-4890-835a-0e722e8a0998", "comment": "Malware payload (Smoke Loader)", "value": "7b73424a60a00ab536bb17e69263da7eea9b5cd9adb01575436737e6b21855ad9a99637443121359e97f7d3cffe1d514", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674609876, "uuid": "0bfc4e8f-15c2-44db-a8fc-8a551061495b", "value": "T1B514E01139A0C077C09501345870EBC47A7AF97217A99C4B7B981F7E6FB03D16A7A3DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674609876, "uuid": "dec96a95-f8dd-4d60-b6ac-2c7bc50b6c01", "value": "5eb8e9ebd49d9ccce156e2e9eb6d0902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674609876, "uuid": "87992a91-90e7-461b-b2b6-632b43d78d75", "value": "3072:nLBN2zgx7/O9L3Y1nxZ5c2YY6wgGIr/xT9p3FEvK7Vw:n1qqML2nxAKgGIZ9pFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674609876, "uuid": "bbfba0b2-c857-43ce-9c15-844c4856c934", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674609876, "uuid": "cecc49c1-0c05-4379-9bf3-13baa413062e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674609876, "uuid": "2cc77160-512d-4504-add1-53dd0d46d14e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a109c219-9cda-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1674669833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674669833, "uuid": "6ccea969-2f38-4c7c-bf4d-99d4e399a36b", "comment": "Malware payload (IcedID)", "value": "8ef6db743a14fdb8f1d3a775ec1d4bea", "object_relation": "md5", "Tag": [ { "name": "2546188793", "colour": "#0EF98D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-Info012423", "colour": "#482483", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674669833, "uuid": "3e5db4f5-31ed-4e58-954e-eed2e8e1e4b2", "comment": "Malware payload (IcedID)", "value": "6e0a64ae1c914961faa708b0ff5f43c30d3c04997e05bd2add145ffe07debf2a", "object_relation": "sha256", "Tag": [ { "name": "2546188793", "colour": "#0EF98D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-Info012423", "colour": "#482483", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674669833, "uuid": "414e7dcc-1295-45c8-bd9c-5aee55457425", "comment": "Malware payload (IcedID)", "value": "94d569e6f949fe101e0cefed924e9d3f5b1b3263", "object_relation": "sha1", "Tag": [ { "name": "2546188793", "colour": "#0EF98D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-Info012423", "colour": "#482483", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674669833, "uuid": "a6401906-7783-4b69-8e36-488eb054a060", "comment": "Malware payload (IcedID)", "value": "b906b5e33afeb6201a80734eb40287cf6a4a9f9f97879c27b9b087e39dff9cfc9c4451689d0cf41d1534d18db9f016c1", "object_relation": "sha3-384", "Tag": [ { "name": "2546188793", "colour": "#0EF98D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-Info012423", "colour": "#482483", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674669833, "uuid": "823fd306-0f9a-40e3-9833-16454edff0d3", "value": "T16FE433987DA8D0EA4C1626B5DECCE2E040FD4A65872BED044D4FCAEC5787CAF86D7844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674669833, "uuid": "c0a5e4d9-2775-4155-b05f-2defde9317ca", "value": "12288:hB5EeqxfGU8iNXSG1RmVvm9LzUuQcjynm/2ZpOuRn5BMEcLvhqXkWQbebPB2OZES:hlqxff8ivmVvm9LAuQcjAm/E5RGQXkW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674669833, "uuid": "4f38784d-70b1-4192-8af3-b3e550b25cbf", "value": 713738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674669833, "uuid": "e3d6e4ed-0bed-4878-b212-50bab7f0274e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674669833, "uuid": "f6aca732-4860-4c8c-8afd-e87c2e508761", "value": "ZoomInfoDBExtract16.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d735badf-9d0a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674690540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690540, "uuid": "359118d4-1ac3-43de-8313-43d80ceefb4e", "comment": "Malware payload", "value": "cf1372fe00348b96fc828649270180a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690540, "uuid": "b6acf2d9-a4eb-445c-b66e-1ee55b5e6eaf", "comment": "Malware payload", "value": "6e9ccdc0d1ad99f07d4ea2731dfb30b6243579d3c64f1647f224c24cb4ee60a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690540, "uuid": "added0b4-46ee-45d6-82cb-861e68100272", "comment": "Malware payload", "value": "de598cf71649464263a8452aee3e2a40cfabaadb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690540, "uuid": "51bd4f20-870f-49c4-854f-b5e078494001", "comment": "Malware payload", "value": "04a3ee18063a0b8740194dcf89dc4c61f9d2b24906fa98494c58c10712b079de8c1303443af87d2d3fcd6f8676bf5275", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690540, "uuid": "23ab491a-2b1f-45d7-b530-5bd623aaaaa7", "value": "T1E864AE2276E0A863FD1A4A36CD1ADBD4392EF8D28F3C73573294671F39721A0F126615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690540, "uuid": "7955f1c5-87b1-478a-aa88-9c377d31b28b", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690540, "uuid": "4954cd1b-1414-4d49-8063-c8a9eaf5d643", "value": "6144:ySL9duKauLbMfuRlVodHjPyd9vzuOOg0+MOKXZOUT:ySHJauL/DidHTyd9ruwWcUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674690540, "uuid": "83337c4e-e90c-4e62-a8e9-ad45c828e24e", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674690540, "uuid": "024a0d78-c2b8-45da-bdf8-321c1d1b13c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690540, "uuid": "e77da1c2-f1e5-4c7a-b6d9-125def1cf804", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7428e404-9c98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674641411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641411, "uuid": "a7a6fc30-fcf1-44ea-b4aa-9069ca35b84a", "comment": "Malware payload (Formbook)", "value": "fbc616e48a9bf3df5358dc4b7091cd50", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641411, "uuid": "5b69f59b-c507-4503-b5ff-a7df04e0a19a", "comment": "Malware payload (Formbook)", "value": "6f517346dda6fb2c2ebb5daa79accf165e866ec394a3bec9983b96a372cdfcda", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641411, "uuid": "a2c5ed05-0bf1-41c0-a407-74fc39effbdf", "comment": "Malware payload (Formbook)", "value": "3d2cf7ff523b5f81cebf93e683608b88063627d6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641411, "uuid": "77f086f3-d68f-4838-96e5-f9f695134b4e", "comment": "Malware payload (Formbook)", "value": "30af7c4b3acd38fafdceab13edef8af35d6166b2e922c24eacc2301a180773091240e9b3f7c60d120af85a9ccc9a76cd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641411, "uuid": "553cb0e5-4404-4a7c-844e-fc53d46620c3", "value": "T130D423723657FC92ADD830F133FAAD20504893221A1EF6D58CDBB5B1307A4B26DDDA64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641411, "uuid": "62afce2c-ceaa-4e67-8c9b-529a522dd12c", "value": "12288:tYd2/E5EXG+SF8zOqW5t86xhjeXvnafEOBr52ox1fpiCQmtxYDJUJt:tYd2s0k8dW5t86ufMDrrlLiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674641411, "uuid": "b45d2770-7b02-42ad-8c67-54c354579f35", "value": 627074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674641411, "uuid": "175c2359-0715-4847-95cc-da930ffc0ff7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641411, "uuid": "0dac49a0-b966-4ff6-8663-d4802ea24e80", "value": "Payment advice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5aec0c0-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674678914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678914, "uuid": "05223970-48f1-4ab6-943c-92f3d672ccc4", "comment": "Malware payload (Formbook)", "value": "6206f3ac6159ce7f8f632d8fb9ccbfaa", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678914, "uuid": "2d98af60-2c3d-4917-b51e-89152e92994f", "comment": "Malware payload (Formbook)", "value": "6f73d6879f3f916f05780e0d90b538cf6d01b976f21620a716e268c672906827", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678914, "uuid": "f78c9487-f92a-4bd5-a339-42494d230ffd", "comment": "Malware payload (Formbook)", "value": "d862bf89a8ed95704f6c05753de12f4c70504480", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678914, "uuid": "075c4219-9391-47d4-8671-a2efdacaddaf", "comment": "Malware payload (Formbook)", "value": "ac8cdf3a6da1b03d3f29827ac29dc41f5dfc6666caee89c2140eb0c2d15220d5ad50123a717279e347c58609ed667ba7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678914, "uuid": "7c3f0daa-1f99-4c79-8bf7-31acb3b12753", "value": "T12774D049B785D997F95303388893CAD6331AFC487B42460777643F0EBCB16B48B2A799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678914, "uuid": "911898bf-c2e4-438a-823c-caedd0b45fca", "value": "6144:Rh0k5eq1h0k5eqnh0k5eOxh0k5eqtZ+RwPONXoRjDhIcp0fDlavx+W26nADW6rUb:Rykdykvyklyk34DYgqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678914, "uuid": "c09fed21-9a4f-4fe1-bcfe-779993f5da87", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678914, "uuid": "c1211b81-0ac2-42e0-b83c-57082ccd1482", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678914, "uuid": "6047cfb5-5346-4e20-9c3c-61d508fb865f", "value": "P0-92901928.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ef3f6f-9cd6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674668144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668144, "uuid": "2ba5f00d-8e02-4f6f-ac7d-e0f54d0878b7", "comment": "Malware payload (Gafgyt)", "value": "f86a3689bb7640e696931bfff7140799", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668144, "uuid": "fef2f4ca-b4a9-4e21-a0df-d0fa6e042108", "comment": "Malware payload (Gafgyt)", "value": "7047c2e55f2a19daa8640b599533b4942003a68e6855a1a8a82277d1f6788d85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668144, "uuid": "6a5bf92e-720b-4899-8d30-158e789b50c4", "comment": "Malware payload (Gafgyt)", "value": "2f058beb3ae9a7229e81c836c6ef819212e9efa7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668144, "uuid": "5d3f8dfe-5b54-4bcb-9046-7f009cc7ac7a", "comment": "Malware payload (Gafgyt)", "value": "72dba353357006ab03530e466767527cc6a597b618180bb8c0080c8a5c541062c94c3bf8b0c0e01f28dfed5bc8f4e3c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668144, "uuid": "275c939e-22aa-4172-8b77-d6be5512b164", "value": "T1EFB32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668144, "uuid": "ac24a86b-e83c-40c5-815a-b482a4d5f727", "value": "3072:b6an17WtsWhdgYJM0D6mbPbmTQOWsXAOn:Wan17WPJM0D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668144, "uuid": "b401a98b-24d2-4eba-acd1-03a976ef5cea", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668144, "uuid": "51bfb455-fff0-4d0c-a6a7-6dbe0b5973c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668144, "uuid": "553f3627-779c-4c19-b41f-d94db83bf724", "value": "f86a3689bb7640e696931bfff7140799", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92bc0c1-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674679000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679000, "uuid": "86e2629d-0009-447e-8248-a9db14197a58", "comment": "Malware payload (AgentTesla)", "value": "72af4b046582fa39d8a302d460de50c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679000, "uuid": "9659fbcf-5f3d-4390-aebf-4fc5eea93258", "comment": "Malware payload (AgentTesla)", "value": "72342930696771d8f979442184cf8503588840bc32843f172d185ef334285664", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679000, "uuid": "3abba415-dcf6-4f29-850d-01c9ea4251a6", "comment": "Malware payload (AgentTesla)", "value": "79fb9c95dd88ed5e4343f0f8e2603b4a296150b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679000, "uuid": "212fa915-8d1c-4361-8a28-c6040b1a456c", "comment": "Malware payload (AgentTesla)", "value": "54bda4b929034a6a181235e7c7486357450ab14265c521a92a99988f0acaf3af25c1ea94db78ed91c6b375726c0a4532", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679000, "uuid": "52f4ba83-7293-4698-808b-75276c3d43b7", "value": "T11F4401A8A44F0571D294AC4D64D172197E76FE9230C89871239FE472CFA6FF5AEC009B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679000, "uuid": "cd5fb214-050c-4211-9b2e-60e1c6b6d028", "value": "1536:i+r5aosJaQf5UHZbv7bpGLJ/oj4lFSHTVFojaVbUxZVzFz76mAg5eeVhMDw5wfL8:id54+VzFtr5RDAw5wfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674679000, "uuid": "4da55bf8-6e68-4028-b707-45c424e7f6be", "value": 261837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674679000, "uuid": "dd4d5b1b-fd72-4d96-be99-eff0a48b5efa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679000, "uuid": "236639ed-0cb2-4eb3-a3ab-9a3bebf224ff", "value": "cpia rpida.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de87d30e-9c60-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674617538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674617538, "uuid": "fbc787d3-8c21-42d8-b751-3d6888957391", "comment": "Malware payload (GCleaner)", "value": "f4fec77823615a639ad389193726abbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674617538, "uuid": "c4a5b379-3e09-408f-8a9f-743cdfaf9d7c", "comment": "Malware payload (GCleaner)", "value": "72eeb296f92a3b232b48bd02c053e39f27e305e3ea031d377c44b0ec67ed607e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674617538, "uuid": "8afa7fab-9f42-48bd-b4a1-82d49710134c", "comment": "Malware payload (GCleaner)", "value": "85fdf0a2ae1e27f7f610534131703d7714ad1b2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674617538, "uuid": "4e28ccf4-2923-4e52-804f-b0ea2667ab3f", "comment": "Malware payload (GCleaner)", "value": "8c95c8895b4b9113444370718754e9e915bd303ce1eb5363beed48d735ecbd4a4110a7c602756259f7d8cbd892b45b5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674617538, "uuid": "7275e1a0-a17f-419f-879d-46fc4ab581a7", "value": "T189853312B9810D33C2F3D7B00C2E894643ABBE270D7891A57A4F5A8F4E159B2781D76F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674617538, "uuid": "e5571fbc-33a8-4df4-b0f5-b29b7365a78b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674617538, "uuid": "f983e972-00b7-453d-8264-057e24fddf4c", "value": "49152:ZUG4vM3bjWuZ/M82qPPtn6SJnUuSjtYdEtLCgv2MR:O5MmkMUwSxSjudExv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674617538, "uuid": "8c5489d5-983a-43c6-ae2d-2b15efd09e86", "value": 1777905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674617538, "uuid": "ea4e9b61-cc30-4e47-9322-42a839473bca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674617538, "uuid": "ebe64e03-5880-47ef-a7ba-d743e9a6668e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad04e71-9c44-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674605318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605318, "uuid": "836d70e3-816c-4f8c-8db3-50a744112517", "comment": "Malware payload (Mirai)", "value": "052cf647123a088cb892613379f912e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605318, "uuid": "26532f3f-17ed-481d-8b15-cb6d6c725360", "comment": "Malware payload (Mirai)", "value": "73bc754633b6ac89ec977b8198223cd72b2c7d573d3a442bb6701d7d79b7170a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605318, "uuid": "da9270b1-5bf6-48ba-a3a5-66bbfcb92375", "comment": "Malware payload (Mirai)", "value": "7d4c4798e128363599d5dfd7ddf9b95ee308dc1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605318, "uuid": "61c168d4-85b4-4023-872c-a8565da30be9", "comment": "Malware payload (Mirai)", "value": "59592fc60baee1d36ca72637a0d6c37095ad61b7426a00cccf2ecf13ea715a06bd0f064b8f2c41618aed0545286f6110", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605318, "uuid": "63a6b4eb-d16c-488e-9456-6311fd961b35", "value": "T16D142974D508570BC1D2237AA68B065D3F224FDBE3A733054538BAB83FD6799AE62D10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605318, "uuid": "f33ce503-7c9c-431d-8e63-1f06969eea9b", "value": "3072:apnaIzvqazpAieZ9Ya9fO1ichhKbUPhmNM/98cK7mzmvwwUCJDdNu:8dqazpAiebY5icabUPh4M/98cKyzmvwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674605318, "uuid": "ff53fd8c-231f-4095-a0d8-1d2df2551f83", "value": 190660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674605318, "uuid": "1c083007-2af2-41e5-a7ba-8e1418b14bee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605318, "uuid": "c5e37b47-5057-41d9-b41c-1492dfa9a1c4", "value": "052cf647123a088cb892613379f912e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c68ac5-9cf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674680735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680735, "uuid": "0e9d8b86-3002-4e27-a9d0-97a6b1378e6b", "comment": "Malware payload (njrat)", "value": "328f95a67c92885fbaf9946c913149bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680735, "uuid": "a55dfb84-dbc6-4c9e-b25e-5af1ac279965", "comment": "Malware payload (njrat)", "value": "7440f5212e00eaa2b9425e0cb29f7e92c481e82a9cefc313177aa61fbb9e8a60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680735, "uuid": "0e6a42bc-27ce-41e0-bb25-c5c612591309", "comment": "Malware payload (njrat)", "value": "99126da1502b0651fe7ccff6277e5fc1a13c0c48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680735, "uuid": "c4198602-454b-460e-b1b4-9f16c58bae8b", "comment": "Malware payload (njrat)", "value": "0890370936254d77fd7dec4faa8e3db4925694f6c773d976adcf777bd56acc84789ee977e3941eee57aa7256f4ade2ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680735, "uuid": "756e3236-be41-4acc-b4d5-d547861216b6", "value": "T1CB032B4D7FE181A8C5FD067B05B2D412077AE04B6E23D91E8EF164AA37636C18B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680735, "uuid": "7f1c23a9-3b81-4af7-8d3d-b0d5d6faae13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680735, "uuid": "b0157fa3-4818-4fc8-8e31-797ebb2c6b19", "value": "384:HkKvEiTbHvpWNcZ0y8f7CTvvrILkCwE3rAF+rMRTyN/0L+EcoinblneHQM3epzXW:EKXTZ38f7CTv8FwKrM+rMRa8Nurst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674680735, "uuid": "1c19c76c-374e-4ac3-b3e4-8703e2a14185", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674680735, "uuid": "5123a914-d5de-41d7-b55a-8bfbea2aca4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680735, "uuid": "95fffe00-24a6-427f-bb12-45d00321656c", "value": "7440F5212E00EAA2B9425E0CB29F7E92C481E82A9CEFC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2b5da0-9cfd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674684836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684836, "uuid": "cfac2fd8-b45c-4d02-85e4-049f6b5ae56c", "comment": "Malware payload", "value": "adbded27738926324e7f5f78d8223a4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684836, "uuid": "c7d04e8a-9dd7-4d0c-87de-b0cedac9fb9c", "comment": "Malware payload", "value": "744a33853e23e65ce46e59744ab94920bd56de268ac01b5ba17f58208e446303", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684836, "uuid": "0875f900-28e9-4867-a789-91374c0c9626", "comment": "Malware payload", "value": "e411866dc8a8a91033e6f58499e356c5f5e64dc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684836, "uuid": "932439db-6520-479f-97d7-6fd4b52df13f", "comment": "Malware payload", "value": "58855abcccc314c1b2b31656c5968ed490c4a091a1db327ea532ae927cebc1f0ea493f4276748d640ebac08392c51b1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684836, "uuid": "16f1096c-6cf2-482d-a5c2-34808ecd3a84", "value": "T1B884C022F5D0B860E9364A36DD1ADBD4392EF8D28F3C735732CCB61F18722A1C966615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684836, "uuid": "3c0756b0-6545-4221-a876-728924b41717", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684836, "uuid": "400b4225-bab0-4faa-a7c0-8b3c6caec400", "value": "6144:u7LlmpDMfXaXBvyG0DipgtmnEJw90AXy/2+4EQ0+MOKXNSeHUT:u7AJ8aXBvctK+wfXy/R4PWAMUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674684836, "uuid": "901cf041-7732-4c68-aede-be9d211cefcc", "value": 378368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674684836, "uuid": "b6eb6997-a209-4e2a-a7ef-b7fdd570f549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684836, "uuid": "5f591234-15c9-4dc3-b530-ddff77d4c6c0", "value": "adbded27738926324e7f5f78d8223a4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6212d8ef-9c44-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674605303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605303, "uuid": "c069f1b2-f1eb-46b3-a67a-51144572801b", "comment": "Malware payload", "value": "5e39763edfbca86f3273122541f6196e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605303, "uuid": "805e8e75-45f0-45da-9fc0-b660c6081883", "comment": "Malware payload", "value": "74f49b8fc9d1da04dbc1121b7a2d64a8fafe75861ae007acc9173dcc011ca03e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605303, "uuid": "a18e89bd-05af-45f4-946d-d40fc7c6a5ab", "comment": "Malware payload", "value": "914ab88306cf0954fea7e9df66a98435ca93f0dc", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605303, "uuid": "027aea77-bbeb-41b8-8d4c-af5d98b8683e", "comment": "Malware payload", "value": "273b6382e85878cf439e4b7c5dfe77416c025109df4dddfcfd5d646b0c75f88582b98444949b6f181384ad9aec9523ba", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605303, "uuid": "800e2b79-302b-4a0f-90da-7ee049559896", "value": "T1A4526287FB928A3BC495523444ABC23075B3E8B1EB621337250952B65F563CD2F2FB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605303, "uuid": "315b365c-451d-4e85-af1d-7555bdbb2d3a", "value": "192:GYzOcYF2xlF27H6F/PjTVRHybf4KHaWvS:nCcYF2x/2z6FPb0F6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674605303, "uuid": "d038786d-cd6b-4d8e-8f02-bc21b5a2563c", "value": 13464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674605303, "uuid": "fd20cc4d-e66d-4138-98f3-e1eea18903df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605303, "uuid": "a47891cf-f5bb-47b1-b5c6-1e0c69bcc375", "value": "5e39763edfbca86f3273122541f6196e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422edcc6-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1674678693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678693, "uuid": "375d9ed4-52c8-4c45-bc77-f40fd441f288", "comment": "Malware payload (RemcosRAT)", "value": "3aea32f20874a4d1808b78c084110478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678693, "uuid": "be46bcae-5fca-4273-bcc5-7f905eb75ce9", "comment": "Malware payload (RemcosRAT)", "value": "760ad3946a031d671d1abbc58cdd86f5d9cac5c3e741522d03c20a3900aa639a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678693, "uuid": "c1e40ffe-6910-4005-b172-7f28377b7343", "comment": "Malware payload (RemcosRAT)", "value": "e8714d2c1706acf90fba6803fd25544a93127124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678693, "uuid": "622e8884-cb3a-4125-9567-ae9bf94a2723", "comment": "Malware payload (RemcosRAT)", "value": "a7af430414990b28dfe097e445c04d5d454e248677b87c4634119f43ca0e039284b9af0f8e4ebb7f0723ba543b98a590", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678693, "uuid": "46d928ee-4cc0-4c86-b8a8-9e47ccac9c05", "value": "T11325DFBC7790EC8FC0578F7B85542C00AA60E4B71B47F383A45B15A99A1E7DE8E542E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678693, "uuid": "4812a60d-d233-4e05-bb29-5597215182ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678693, "uuid": "20737693-9418-47b2-a590-acb0fac0b17f", "value": "24576:32Rhg9MXHBwOSjiipZ2ugazXE/LhsNzK+O:2c4Brirgd/Lms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678693, "uuid": "6f29bb24-0361-4cc6-a7aa-2f9d7d974212", "value": 1051136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678693, "uuid": "55b4892f-5886-48ce-a0b1-dd219a90e0a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678693, "uuid": "7d0b66ff-3adb-4ce2-901e-b793ffdaa101", "value": "3aea32f20874a4d1808b78c084110478.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8473df18-9ce0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674672362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674672362, "uuid": "6398df92-88cd-4e35-9e0a-c8406f3bf71b", "comment": "Malware payload (GCleaner)", "value": "db603ff51964f58c35a7effb2d76a1e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674672362, "uuid": "4ac59f07-9735-4a68-b0fd-8da9de95bd9e", "comment": "Malware payload (GCleaner)", "value": "7636eb1c5b451711ff20d26f3714a2b2c1b00fe23d1aa4fbfcb08557b70e6898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674672362, "uuid": "533d201b-948a-4f75-bb50-a9f3d06924a9", "comment": "Malware payload (GCleaner)", "value": "873ae01134b87abd52d53853e1df4db88799322d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674672362, "uuid": "3c709d35-dc72-4058-979f-f3b1cb44d445", "comment": "Malware payload (GCleaner)", "value": "9e5b280b2d418413f80a7c273c281a83bcbc398f30b0caa5136cc26698d64663a0d7be86235d4b5ee823849d8937274b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674672362, "uuid": "7db131ba-9daf-489b-bdb1-dc1840129251", "value": "T1B68533468361C534F2239E391A67A681ED71BF362A71C250318FEFAE2F165934C8F791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674672362, "uuid": "73d2ab0f-89b7-4d9e-b79c-2b2296612158", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674672362, "uuid": "37b77671-cdae-4e75-9951-fa157ea4c1da", "value": "49152:ZRgwjR1f01aC0p1TG5mRUYsSMFs0yLCgv2MR:Xgw3ely1TG5rYcKv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674672362, "uuid": "b123fd72-b851-4ff2-8f5b-3315093d81c2", "value": 1819410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674672362, "uuid": "e67bdf70-587f-44de-9673-7ddbeeebb36e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674672362, "uuid": "3ac35504-710e-4be5-aef9-481f78a6e86f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc07f2ae-9c74-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674626124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674626124, "uuid": "6039fb77-783e-4bda-a83b-2cf20af4a4e6", "comment": "Malware payload (Mirai)", "value": "501099afee7f7a269ac3ae5fb0b42ec1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674626124, "uuid": "3f7d6a8f-5ae7-4452-add9-dd91f21e15b0", "comment": "Malware payload (Mirai)", "value": "771229b5b05e22d4f43e728b38c1e6f08fe7157e3c6dcade0e9af065f710f22d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674626124, "uuid": "a7efa3c7-48f7-4267-9273-80b0cfb40b2d", "comment": "Malware payload (Mirai)", "value": "045f912b0b80092e821ad376a275b59e8dad9811", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674626124, "uuid": "2c2c5a44-99b9-4e2f-94f6-80378fa51dec", "comment": "Malware payload (Mirai)", "value": "fe046f07bec651597fbbc3a27de0de2c57a855dd4b081ce654e1cb0bbbaa477f47885deae59ba63eaa9e7790bdc371e2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674626124, "uuid": "a7e9159e-0754-44dd-bed1-db73bc5fbb5c", "value": "T1C9534B03BAC181FDC54CE174476B7936E423387D123AB6A677C4FE367D06E604E2A986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674626124, "uuid": "cd289566-0e6e-4616-808d-61998155cb72", "value": "1536:XXOBO4zkF7xppJCCC9nlfQh584kRe1Ax37XbS32S:nOBOD77iCmfQh58xRlx37L7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674626124, "uuid": "d27526d3-62dc-4c16-9940-57b27cf3590d", "value": 66464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674626124, "uuid": "70b8bb3d-68e5-462a-af0a-860c5f8cd0f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674626124, "uuid": "34869907-f756-431f-b7d7-04575df0abb6", "value": "771229b5b05e22d4f43e728b38c1e6f08fe7157e3c6dcade0e9af065f710f22d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d371e0-9cbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674658354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674658354, "uuid": "d8a6a50b-1db6-479c-afa2-ea7ded6153fc", "comment": "Malware payload (Smoke Loader)", "value": "1392aef7cd09a1b87d26f81a0bf1c011", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674658354, "uuid": "5007ceca-9624-4450-a550-4b553a241df9", "comment": "Malware payload (Smoke Loader)", "value": "7734984082dfee605324264ad1c2cdc79180db273fa196bd3d2e48915d9d1e4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674658354, "uuid": "3e73de38-b374-4c79-ab3e-f4d6a77fe18e", "comment": "Malware payload (Smoke Loader)", "value": "ecd4c47b36236050394714423075dd0a4c42a46a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674658354, "uuid": "de3fe064-7f65-42c4-9e6b-c4800e8d2234", "comment": "Malware payload (Smoke Loader)", "value": "bdac1cd1ecb3d313ecabf03eb6b1a29bb394e982daa46f21733b11e52f2a069fe5b55fd1568bf4ef31bd5fe4c9f9fa5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674658354, "uuid": "2d6e2558-e357-4c78-9443-b43644a0e2c8", "value": "T175648D12F294B8F1F91ECA319C199BEC367EF8505E156666323E7B1F2A702E1C52E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674658354, "uuid": "b06fdc1f-1879-4cb9-9d5d-262a9720d30d", "value": "8f16ef841269728457dd532b4a807550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674658354, "uuid": "018b6de0-a8b0-41ba-a4d7-1a65445b4381", "value": "6144:XgLguekAZrJckrdjQUscX25cfuGq0VvRFBMolz2031M+:ws/LZrzZAcG5cfg0VvR5lzLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674658354, "uuid": "73d2fe09-a29b-40c2-a551-7f550e6dbd34", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674658354, "uuid": "af8bcba6-09f8-4c6b-befc-745201e35f20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674658354, "uuid": "8e647d88-2e79-45da-9883-72a3358facca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975319d5-9cd6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674668099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668099, "uuid": "f8b5df49-7746-4e95-9f20-f1c76ee15e8e", "comment": "Malware payload (Gafgyt)", "value": "67c364c518503fcf867628e22f87b03b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668099, "uuid": "d77c9395-b0b4-43e5-8847-b12992d3cf14", "comment": "Malware payload (Gafgyt)", "value": "7793f16161b8bf63770539d2b4ac52d299b5b3768605685645de20cc14f6c638", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668099, "uuid": "5899c5bc-b8da-4c7d-b842-034c0d753ea1", "comment": "Malware payload (Gafgyt)", "value": "06c7d9dac706038f7453efc7c6a930f1ba8c2557", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668099, "uuid": "1441811c-646a-44be-b68a-6df86106fd3b", "comment": "Malware payload (Gafgyt)", "value": "dabbaaeaf7770db70fc07bd56702faf4e47584d75a81004e46e6098ff01a534a07f001fe2855d6a0c0783bbf870f109f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668099, "uuid": "b3a8b13c-0a1f-459a-8495-b0889af00a2d", "value": "T133836B23A651C6BBC0875BF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668099, "uuid": "78c0e0fd-b892-4850-b58d-85931ec78d9f", "value": "1536:UB7crF7FePF5tZuEqdPUq0aJb9sqx3CjrM3X3uWIr8UmoIYuOVje+ZNne:URQFet5O7dPr0oSwyjr4X3uDnmrYuOVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668099, "uuid": "8af0c8c7-7adc-4c94-9b8e-19bc06deab19", "value": 85803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668099, "uuid": "42749eca-8d2e-4e65-8516-3845a6782462", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668099, "uuid": "9c0eb6ea-f55c-46b5-8d1e-32ddebec959d", "value": "67c364c518503fcf867628e22f87b03b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7032477-9c94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674639805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639805, "uuid": "73cf6987-bd78-4697-805d-0bc2a848057e", "comment": "Malware payload (Mirai)", "value": "2c58eec47842295db6d2df5918a4151b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639805, "uuid": "69056c0b-2615-458d-9f73-3972cf832941", "comment": "Malware payload (Mirai)", "value": "77a564a7895e07194bf062a92ef20131e1d16684d711dc46e933488ad644c565", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639805, "uuid": "38ea6583-f3a0-4e76-8a0f-a792a571e114", "comment": "Malware payload (Mirai)", "value": "d965f2608c845d9c58a4dcf77a5ecfcaf4593ecb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639805, "uuid": "9048733d-04d2-4c91-b9d6-1e8c8ac55ffa", "comment": "Malware payload (Mirai)", "value": "b4340480b4c3d23b26c285c40db7eda9d39efe947a685d285972f8578402f5e695307d077c5b839b07b85d880c98f42b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639805, "uuid": "d2e168af-22b7-4062-8e94-d162e2eac8a5", "value": "T1FC632A792949F2ACEAF55078F44320E539530B2837ACD1D361C3447BEFB8B48725AE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639805, "uuid": "631bc9d0-0776-400e-86d7-66ed777b25c8", "value": "768:45bofVgPLzOTjLKbV8H6ltXoq2OhfhfLANVefrc4ksf6wNC+5Iv3:45EdgPLzqilDSSfPksf6w15Iv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674639805, "uuid": "25ff3775-c0e5-465d-8625-2f9483f51888", "value": 67004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674639805, "uuid": "819278f8-17f8-4a5b-b08f-d9924b48f569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639805, "uuid": "09a81ec0-cee0-4f13-8583-81643a99a79f", "value": "2c58eec47842295db6d2df5918a4151b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad63d920-9c94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674639789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639789, "uuid": "a5f5911f-62b7-4331-a9b6-e2e040431f13", "comment": "Malware payload (Mirai)", "value": "65f25164071259d67b7e2c9acbda89a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639789, "uuid": "07aec01f-4157-4153-bbbf-f1d5fe444597", "comment": "Malware payload (Mirai)", "value": "7884b17c6e48fce8f158f1421f885d9fb2aeb652351302cf6ffda4484e14fcd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639789, "uuid": "9b815c41-0be3-4d08-97af-8f460da04eea", "comment": "Malware payload (Mirai)", "value": "bbe6b1ad9f0025f9170b6118923f30e993d28cef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639789, "uuid": "a9513011-7356-4b0f-8edb-df695c9870f4", "comment": "Malware payload (Mirai)", "value": "90cf62f58243dcd82678b7fcce67296e38586326c08c4b303acd1880f44c83d5222fd73e7064107f4f732f10db01dfdd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639789, "uuid": "12c5d4bc-f810-4b53-af07-abe7c762531a", "value": "T16A633A0233284A07D5531EF4693F17E1C3BEE99022E1F689650FDB5A8676E77018AF9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639789, "uuid": "45d4b7ae-1ded-49dd-b56d-27966441cf4a", "value": "1536:5e3U1hrVAK7DaRWbMqamBpdytyfgJqsXx+k85+334:5eJ9UVbyisXx74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674639789, "uuid": "8e7f7e64-2889-4ff4-b9d8-d325f27eaeae", "value": 66968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674639789, "uuid": "25ae07b2-371f-499e-8b00-ad795eb1bead", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639789, "uuid": "7ad99746-5073-4872-bd6e-8803e614fb72", "value": "65f25164071259d67b7e2c9acbda89a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af720dbf-9d09-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1674690044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690044, "uuid": "0e63041a-1238-48cb-82c8-592f25d8df5b", "comment": "Malware payload (AsyncRAT)", "value": "a730cdd08558f59a39d8ee68c0f03b8a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690044, "uuid": "8c4820d2-abcc-4a09-9464-d2b36d2af908", "comment": "Malware payload (AsyncRAT)", "value": "788c4960013613c29a0be5beaa6caa09bdde346938c52015469d11a04853f924", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690044, "uuid": "b1829752-21b0-40d3-b1e5-76ae90fe09c5", "comment": "Malware payload (AsyncRAT)", "value": "24f7f37d8757fdd255173f7cc03e3ff36e107d05", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690044, "uuid": "41ea218a-c44f-4e84-93a0-6d53c2acfb54", "comment": "Malware payload (AsyncRAT)", "value": "708e559a10374109b2eddd4580c941463a50a4f391e35308e5075435613723b0b014503031cddbf4e0af560a6686db24", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690044, "uuid": "eb6f453f-e061-470a-b423-bf07c68c9559", "value": "T1B1231B003BE8812BF2BE4F78ADF25145467EB2633603D64E2CC4519B5613BC69653AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690044, "uuid": "da2dc5b5-81d6-413f-b5f6-01a7de8becef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690044, "uuid": "0dc86253-cb75-46bb-aa89-7c4e5a56f23b", "value": "768:Fu2M1TwwL/dWUdU+3mo2qzSaLpLQQkOPILzjbPgXKixKTY8R0Ex9PJsQWNBDZGk:Fu2M1TwQP2NQk3L3b4XzxKTY85x9xEDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674690044, "uuid": "d3da0a17-7b13-4fad-ba97-1aa394d3d9bd", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674690044, "uuid": "8f7ad362-57ac-4567-b42b-a7d435440bc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690044, "uuid": "0489d49b-95da-4d04-aa03-7a7bba11534d", "value": "a730cdd08558f59a39d8ee68c0f03b8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39728413-9cf7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674682115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682115, "uuid": "1e4cdb69-b5a7-4ad7-8759-dc89da85062a", "comment": "Malware payload", "value": "df4bcb8211f980a6fccaf369e4e86140", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682115, "uuid": "f55593da-cd6d-41b9-9535-dce3d9437adc", "comment": "Malware payload", "value": "7901e6da6fafe2cb3a44e0aa7fdd00b589faea5a8a512eb93fcdd6d5c6794a4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682115, "uuid": "b8c26265-322f-4419-b15d-54f32a2e54f9", "comment": "Malware payload", "value": "da833e1e8186e77e85a5b66b87a860888d68ae66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682115, "uuid": "5109d5c2-f454-4bb7-8898-eeafe632c14e", "comment": "Malware payload", "value": "9e5b5e9c48e1ba9499fa8271e45d048cc7fc8ff77a55e6454a96e207f5d73f6444a47cb0211e29acf40db4bd13d9902e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682115, "uuid": "1dbcdca7-3902-4c5a-b8f1-5319eb931014", "value": "T129F49D0079F384D3F4E7487A403967CC9E21A5556742D63726F63BA46203AFBBAC6372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682115, "uuid": "43d65c93-17a1-4996-8471-310f6a33c72e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682115, "uuid": "5dd494b4-7b2d-46c4-b11b-72119383fea3", "value": "24576:hpZlh1cconBuOhjSXsXTNE5wrqhTPVcZLB1UeJO00x6uTgxBs:aXTNywrCPVc/dOD6u+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674682115, "uuid": "e053160d-0562-41fd-9f41-a707a0856f09", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674682115, "uuid": "9c958a2b-dc08-4afb-8b23-42b48ad72260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682115, "uuid": "56346dce-40d6-4988-80a4-8553c8fd9948", "value": "df4bcb8211f980a6fccaf369e4e86140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1fbeb6f-9cb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674652762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674652762, "uuid": "da15ecea-afef-40ab-b477-83fec1467c46", "comment": "Malware payload (Smoke Loader)", "value": "7315454cb46ae5c995453402848c092f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674652762, "uuid": "d928af17-e997-4909-b51a-903d5ac481a7", "comment": "Malware payload (Smoke Loader)", "value": "795dbc23ec266f52492486d0b1f2f7c40c53473a7229ae0ffea0224dffd2d9e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674652762, "uuid": "766d37a8-63e0-45cc-9bfe-b6b1fe21a323", "comment": "Malware payload (Smoke Loader)", "value": "263c2df6dcf0937d502ed8236e063441d99a551d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674652762, "uuid": "292829b2-2b15-40fb-9bef-bc0ee6069f4f", "comment": "Malware payload (Smoke Loader)", "value": "50ea2a2e89cf09b0ede476c2f1ef4ab4419de90beada75bd648c90c56f5e7d73530a728eb0900b4d05b4eceb2da8a229", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674652762, "uuid": "25aa6e24-d6e9-4cdb-859c-c535af146844", "value": "T1AF748D02F298BAD0F599CA318D1EABECB63DB9504D15672A322C7E3F25701E1C53A31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674652762, "uuid": "26871be4-361c-4bf1-a823-f14f6a192c63", "value": "787cd3f7e6d0161bfca0cbd92375e751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674652762, "uuid": "a7131a1e-8828-4210-bc6b-99e3c0a09c33", "value": "6144:GsLGJeAcDGIGNrKoZXXe+BTpMvOjq7VWRFBMolz90W:x6JJRRNrKe+sA7VWR5lzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674652762, "uuid": "92bedbd9-0bcf-49e1-8e60-77194d408c12", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674652762, "uuid": "fb4aacec-6b0c-4483-b72f-596a2463043b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674652762, "uuid": "63732455-c72b-4737-bd0b-fa8d1d74042a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e100273-9cd2-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1674666339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674666339, "uuid": "4588ccb5-4d77-4d46-9a08-eeabd91b7f45", "comment": "Malware payload (ArkeiStealer)", "value": "a39016d6379dbe90cc7e38dd22c0bd75", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674666339, "uuid": "901f64ec-3071-4498-9c5c-1a7d040983d9", "comment": "Malware payload (ArkeiStealer)", "value": "79ec5b54ddd1cbc30d23e679fa8d1740884aa29e89f10a3020c559f893ab4790", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674666339, "uuid": "d31ca5fa-8915-4048-9fd3-2e3157a52882", "comment": "Malware payload (ArkeiStealer)", "value": "512bd1217144b47c73ab0b7c06d0577adaa6fea5", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674666339, "uuid": "fc1053ff-4dc6-47d9-9120-1a4711b37429", "comment": "Malware payload (ArkeiStealer)", "value": "186c47db9c8c7ae1ce89d4472624745accbf483c5c7748425172b6df6c393d8c800cc8b384414e9b7c9e21ad97a9d75c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674666339, "uuid": "9e4de7f1-922b-45f7-9eb1-a2abdcc5e7ab", "value": "T1ACA4BFE38EF87D61E016287374A0603C27EF5E0D8869D735D1AFA20A7A12AD315D5F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674666339, "uuid": "6282fc48-a654-4c09-b04f-c2116ab1e6a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674666339, "uuid": "5299323a-a06c-4d1b-a03e-a0fed18061e0", "value": "6144:5axTZm8PfwTjDvdyyhq58k2GO1r8wBCmlmbLvdX05Yco2D6roq+kbkrY+w:5a3fwTd6E1TBC1bLdEFoCULdQ0+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674666339, "uuid": "b96c5dd4-34b3-4179-8687-d39febf07a0c", "value": 455680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674666339, "uuid": "21c312a9-5dfe-43cb-8c50-b049005c322f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674666339, "uuid": "201b49af-27e3-4bc0-9b7f-6b16ad844143", "value": "npp.Installer.x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a44765b-9caa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1674649206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649206, "uuid": "9dc35ca2-8892-45ad-b02e-ba427c654273", "comment": "Malware payload (Fabookie)", "value": "19226ab635c67ca1dba354c46e4b9dcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649206, "uuid": "feb86940-e957-45f8-90e0-63a6890c8657", "comment": "Malware payload (Fabookie)", "value": "7a0b4912722abcfd0be303208495df52a385794999da297a0be91ff03c5da210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649206, "uuid": "4fac23fa-9527-477d-9a30-fa29778371b3", "comment": "Malware payload (Fabookie)", "value": "9a68ec8f3c5b35b8468f76d4c8c697614d141f41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649206, "uuid": "27ca9cb6-8ea0-4b6a-9260-61dedccf3cb6", "comment": "Malware payload (Fabookie)", "value": "1dec47f01d5682790962894ae50f21a40b8966995cef73f034b753227b59332cf2a2a168a1f4d611158a3e7ca051297b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649206, "uuid": "e2e0423d-88c6-406a-b020-9c4a5e0a6bf6", "value": "T103F502BD628433ACC01ACD345527ED44B3B6951E07FCA9EEB2DBB6807F67410A626F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649206, "uuid": "779e9764-2ac7-4bc8-94cb-279598e1352c", "value": "245fbb05d3da4d7c6badd5cc3e1f9b98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649206, "uuid": "4e78f8de-1454-4532-9b7d-a913e763a0e1", "value": "98304:xJpHqm5WK2r2OxCCkxdIRF8MDBVb3PjHzbW2Fy:xH5+tk48MDTbHzbW2Fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674649206, "uuid": "527a9c81-2151-434e-b28a-457dce1dec03", "value": 3641856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674649206, "uuid": "2ce6af70-addb-4f3a-830b-b8c5ad82832d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649206, "uuid": "db928063-0207-4306-9872-729c7046b418", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c8d7d9-9cc8-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetWire)", "timestamp": 1674661892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661892, "uuid": "46f24ce6-64a1-464b-aba7-f371e8d43c9a", "comment": "Malware payload (NetWire)", "value": "76218662ffd8397441fadb34d12de1cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661892, "uuid": "19aeec80-2c27-47c1-bcd5-3e3561f80883", "comment": "Malware payload (NetWire)", "value": "7a0c3008b65ed5033cc3663e9104ed7b39707c2a073ef3626549e0acd64f15f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661892, "uuid": "ab39655c-abd1-4025-8cd1-a6194b603089", "comment": "Malware payload (NetWire)", "value": "6432944d6cb7e5acc434d8d7a017c2ae6c21b426", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661892, "uuid": "a294b636-3c5e-45dd-938f-3ad2aadc65c0", "comment": "Malware payload (NetWire)", "value": "40e1cd1d67592e6b7626f205551d819a11afc24504d5a1f485d4400e530711a5aed4545bed836e64b5675ca358ce8269", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661892, "uuid": "ba36132e-4ac0-4941-a118-9293280cb2b4", "value": "T160F4BFBC7690BD8FC0578F7B85142C00AA60F4B31B07F383A05B15A99A1E7DE9E556E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661892, "uuid": "e3ccd921-c22e-4c55-ad9d-04ee7fff6752", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661892, "uuid": "8ed02547-0c90-4fda-8d1a-40207fdfe1af", "value": "12288:Frp6gxML2DQ8iFoFEyK0xlDxjIWD7+j3c1z3tTm9OrncN6lcQBb:FrfxMXSCp0r6WmjM1z39AAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674661892, "uuid": "092d3b08-7127-4cb0-ae0e-595b76b8bb5c", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674661892, "uuid": "f7d771e5-f75e-4e87-8433-238532b23293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661892, "uuid": "09cb4b54-cb68-4c3d-9a3b-da2ebb40214b", "value": "76218662ffd8397441fadb34d12de1cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18198ab6-9cf0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674679052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679052, "uuid": "c2dc7844-c80a-4d0c-a7cd-c0f70286c303", "comment": "Malware payload", "value": "5c3cd7486e63a34965723061392943bd", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679052, "uuid": "63fd024d-3d18-42ac-a761-86c546ee1a42", "comment": "Malware payload", "value": "7a3f3883dfa53ad891db23ae80c19a6324d731cee29f471e39a2adbc7f1d06d8", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679052, "uuid": "c471c736-bc76-467d-8be7-93f946ff33cb", "comment": "Malware payload", "value": "2ca32ca0d4e31a059aae6a4b18773c491f105088", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679052, "uuid": "34b11f95-f90c-4a18-8ec1-f2092c78db0c", "comment": "Malware payload", "value": "37732a5e923fcb23782754710eb2fde1ffff80ea84ac02c9448e8cae2a6b7b5db63ec1483730283b4ea0ebb09026a7f4", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679052, "uuid": "369a8427-5f0f-41d3-a3c7-c93357082bbd", "value": "T1F313CF2DCFCA4A22D63B52784C1EA5F084479A70E1919F0B1EA9B29D1548CDC0B1BCAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679052, "uuid": "0a63cec7-0946-40e0-bbbd-0e31738af62c", "value": "768:kQL8fvj+qtTsv+nWL8hDBIJYfTH+niSpvfkBBGR2FFiKk/fa9Rz+n32su:JLuvqq+v+9G1Bh8/GR2FFi3/y903zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674679052, "uuid": "383e3549-8e82-4302-8ac4-0a77d56a6833", "value": 42830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674679052, "uuid": "421f3b8e-0abb-4674-a6af-544b79273ef3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679052, "uuid": "7db62a21-a588-4737-8503-384d97c9dc6c", "value": "PO2743.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77658b16-9cdf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674671911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674671911, "uuid": "9d827695-0f18-47b9-947a-650d3c3f45e1", "comment": "Malware payload", "value": "c462139475261ee39d419f6d7f8d4be6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674671911, "uuid": "0af12ce8-516a-4f3e-9cfa-708c43269ca1", "comment": "Malware payload", "value": "7b4c442ae9ef60b2f04dd893ab0a62385a2f016d4ad82793317b50b9fcd12e1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674671911, "uuid": "0d683967-4bb8-4301-ab83-83abe02fbd1e", "comment": "Malware payload", "value": "d36e26367c2896d8911f0d0078486d35f27b5355", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674671911, "uuid": "f186d7d1-1ee2-40a0-b5ad-d097589b980b", "comment": "Malware payload", "value": "493d24b8d518e8df52b51af020e8c978d05a8e48b8175e113777eed7f6287c3a09d9eb50e8786f655457bdd404781b8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674671911, "uuid": "7b14a6f2-a900-4b0f-bf13-92adf03bf309", "value": "T18574F111B68DE0B6D05125389464AFB70EF5A9311A1F489BFBD02A3E5E307D0637AF27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674671911, "uuid": "148dee13-2b0e-4b8e-aff1-e64a7e1744db", "value": "4f3d3533d176804f65e9257d1238d290", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674671911, "uuid": "7eaa169f-ff04-4d89-8a26-032c74ae3e51", "value": "6144:ROP61ALBLQgjiH8bT4vVqn/Umdv+i2hiU0uug74hww8+ACOgE1141:ROP61ALBEgjBeVEs8H2hiU067ywt+Aix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674671911, "uuid": "7bf64172-1c9d-46b3-9334-9a5530b1a198", "value": 370347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674671911, "uuid": "0c9db051-a30b-490b-ba49-2a44ce866f8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674671911, "uuid": "7c0ca579-cf39-407d-bea4-2a1f086c8cd3", "value": "7b4c442ae9ef60b2f04dd893ab0a62385a2f016d4ad82793317b50b9fcd12e1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216d8253-9ca8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674648144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648144, "uuid": "7cc9cd19-5949-46a4-a06e-d5c07482e3a6", "comment": "Malware payload", "value": "74189d47f1fad04b251a6b13f3de3550", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648144, "uuid": "20ea010e-e30f-47bd-9361-3542d187bb49", "comment": "Malware payload", "value": "7bfbceda5e2f75645b7ab2a1748e838b1ffbb6693d7b121083af460a9bb623a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648144, "uuid": "d16144c9-031a-49bf-9088-d7c3512c12a1", "comment": "Malware payload", "value": "5d5061e0b818e656ce077899ddf0728b351876cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648144, "uuid": "397527f4-5352-421d-bba9-774c02830f00", "comment": "Malware payload", "value": "fa7450595883681df45169d5bade7bc386fa9c44ed904bb5d3090b3a459d20e83e5fd5cd68b2b5d7ac4e0efb3ec1f07e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648144, "uuid": "f8b69590-3735-440d-8c97-fcbd90391aa1", "value": "T1A07633713DFDE8BDC0844475EB052FA79D46D6E40F19FC6FD2D448383B2816C8A2A666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648144, "uuid": "eb005921-2441-4984-b68b-0eec7a1da59b", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648144, "uuid": "ed232d04-9b14-4189-946f-b66187adc010", "value": "196608:91OlYvZ01UDB33Lg54n6V0SAjZB1Bo+uFJ1IPmopMYZb:3OCwEniKSA1a+8gPFFZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674648144, "uuid": "bceaa893-c81b-4e67-91ce-5a08b28e409a", "value": 7628166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674648144, "uuid": "ef54bf85-21e1-40aa-9f1f-8e4997e0c00c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648144, "uuid": "d25cbe08-9cb5-4e16-8ffe-8de289111ca5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a8e018-9cfc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674684524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684524, "uuid": "76a1e257-bbaa-42f3-8600-9d80229003bf", "comment": "Malware payload", "value": "b7a17c9d45a317c674f6c94fe33e0c32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684524, "uuid": "ecd144da-c2c7-4dc7-9bac-7c693b201ffe", "comment": "Malware payload", "value": "7c6768c3df66679759c311920c23a9474527e8c00cc64e708ef7d3cd3288f3ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684524, "uuid": "1db9f664-27a9-4f26-9425-a13ae0772f58", "comment": "Malware payload", "value": "d4f49fcb1a0f2462a750510f4c192f95edd25855", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684524, "uuid": "9ad04b40-e539-47a7-b380-7670286005ec", "comment": "Malware payload", "value": "ab5ef166866a9a3aa7b3732846aeba3a32760c1cac2db7857bc1208d9cdf72adbc54ac63ff34fef868eaa86b8b899f75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684524, "uuid": "96f09f25-d81f-461a-9c45-ba1b9135971d", "value": "T13555083526C35274C4A88E30A63850E413FA775FBB02CF6E25551BD9FF212976B221BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684524, "uuid": "96661446-f1a6-42ec-9f1d-8b81aeaf3307", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684524, "uuid": "c3679037-edd4-4a06-9e36-b79a17f476a1", "value": "6144:6Tl+GCvr3Kb3mpqhiRPRE8yrsOL4kUL+two9UUeCEbeiL8AX30jpBvke0j+ps3Uj:V32b3StRQrE2woe4iLWjQeNps3KdEnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674684524, "uuid": "d048b262-2e43-4f2a-ae82-284127d203db", "value": 1319688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674684524, "uuid": "c6232cb1-f7d5-43a5-b604-892ab7c8b695", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684524, "uuid": "4d499d7d-2019-4753-bdec-1b40d7a73a8d", "value": "Evon V3_debloated.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad5e0f4-9c49-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674607465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607465, "uuid": "1c0ee314-df9d-433e-808d-01f1dec96f46", "comment": "Malware payload (Mirai)", "value": "81378c824b8efd0b841e8177dce69541", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607465, "uuid": "10fc6dd3-41fc-46de-b85a-1fdedf7542bc", "comment": "Malware payload (Mirai)", "value": "7d019d856bda9194438f7d8814c5d278ccc10763681cee984b3ae61de278220a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607465, "uuid": "b8ff7ac1-9433-461e-becd-620cf68f7bdb", "comment": "Malware payload (Mirai)", "value": "203eaaf0c5c0b849f78cdc675c93f06935605663", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607465, "uuid": "007e4de9-32b0-4b77-ab66-62f51bb0ab3f", "comment": "Malware payload (Mirai)", "value": "8d389a512e999f92cd23ad774177430ea729ee4b518c631622324394f7ff19b5c1aa171c1dae612b1003f69b0f2f57a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607465, "uuid": "ea8d07af-88bf-4dc0-b249-ba375849d32c", "value": "T12C33094378817A17C5E4477AFAFE01ED332427AAE1DFB2238E222F11339591B2D67651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607465, "uuid": "89423ab4-94f6-4c6c-9d76-d5dbad097fc7", "value": "768:awkPcPHJ7XHSMxUeqRbDzSa7S4y16f0kFP+8NeHEifMs1JPjgqEveYYY:KPcPHJryeqxDzy8NMEifF1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674607465, "uuid": "52a64617-b32d-4d37-81b8-3f36166759a2", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674607465, "uuid": "37de3283-5dd9-4355-97c9-0ab47ea09e85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607465, "uuid": "957963f5-dd3a-43b1-bbdb-30e03f3f9686", "value": "81378c824b8efd0b841e8177dce69541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19452198-9cb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674651567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651567, "uuid": "27a1e483-0f88-470d-94d7-d4b4b3487c2a", "comment": "Malware payload (SnakeKeylogger)", "value": "48110241d04029bf30beb4525d876192", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651567, "uuid": "8c592027-28fd-4935-838f-657a945e6f10", "comment": "Malware payload (SnakeKeylogger)", "value": "7d1c91342282f5a34d6035a539fa1b3f0ae9e62182cb749c1269807b2deea2be", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651567, "uuid": "ee9870aa-8b59-4360-acd5-bd4c820c353f", "comment": "Malware payload (SnakeKeylogger)", "value": "5ab35ba90ef00edd3e28f62021401603902ed3c1", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651567, "uuid": "a10e6af1-3e08-4796-9d98-2bb77511c73d", "comment": "Malware payload (SnakeKeylogger)", "value": "8cc99d943a9d01d0bea633e545f5111304c2651c15bd47d9282e2921c5ed0eb7197f86f7265c3cb531bdc0b60bf126a7", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651567, "uuid": "53c53296-e714-4c91-9ae8-c260e52fcb59", "value": "T1E405BE106A78DF05DE764FF5001152600BA2AE5AEB20FA545CF3B1EB5A73FD13E809A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651567, "uuid": "9caf4428-b220-41d6-8b94-4f439940a7a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651567, "uuid": "67883f1d-3c53-4367-972d-e288176bd0c3", "value": "24576:R8kyGyO9QzlGI6AAgZh1Gsvi1igIMfWYn:R8kypO9jI6AXKXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674651567, "uuid": "3e4ba7cb-311f-4382-ad1f-840b2221952f", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674651567, "uuid": "62969c0d-6ace-4f19-a561-1417eafe0540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651567, "uuid": "98d526cf-2823-480c-bdbc-ff1fec6a3874", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e14e1b9-9c9f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674644327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674644327, "uuid": "08c4497e-4ce3-494f-8a99-7af8881da353", "comment": "Malware payload", "value": "38a593f57b168d0c9a0b659a77243d12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674644327, "uuid": "2a4558c2-e822-4d4b-9cfe-d8391f0e6608", "comment": "Malware payload", "value": "7d87031a25997b0f8104509b6fbc0efe5bff9d51e525297ffe92a4f9688d6ab8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674644327, "uuid": "0f6dc582-68d5-4799-95c4-5a56365edbc0", "comment": "Malware payload", "value": "a3c10181d35c747687d15d023277a1f3a40d5815", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674644327, "uuid": "eb7e0ba3-aa9f-4d88-bc46-213f0c8f933b", "comment": "Malware payload", "value": "23220605580b1ece7881542504085971dcff789e600e5f59f6c4a1dc718ad0dc6d57e407d7ba72a9e12772fdb2f48b71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674644327, "uuid": "319d6ac9-adc7-4131-8ecc-25c713d20217", "value": "T1F27633B07EE9C8F5C6420875CBF172D4E5D2DB5E0F910C2737B9E9BE3A2E80151265A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674644327, "uuid": "65926064-8f45-419d-a452-672f21d51814", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674644327, "uuid": "e764ab0c-4a61-46b8-b746-813bb930ef2c", "value": "196608:91OJC2/ztd+v19I/FKV9bv+DUPp+XOwTHS0hdCjHE6u:3OJfLtdaGKXJPp++wDRhQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674644327, "uuid": "f60f8bb9-d5b3-4cd4-844c-664f341dded2", "value": 7584848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674644327, "uuid": "b7521338-4bc9-4f18-96a9-dfbede6ceab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674644327, "uuid": "a6d00004-0b9d-4755-bd42-9c2220c4f86a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16062898-9cb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674651561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651561, "uuid": "cb90899a-3874-4d60-b087-be8f466b0a0f", "comment": "Malware payload (Smoke Loader)", "value": "d727100d1ee36c0159891fdd4e34f7cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651561, "uuid": "cebe2470-f545-4961-b043-3611ead1f996", "comment": "Malware payload (Smoke Loader)", "value": "7eadfbcd2b41b11e738dceb3bbb06afd22b4a23a853a19e546d1ce5b1d35147f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651561, "uuid": "fbba3621-39d4-4884-86b6-b81ea2e01705", "comment": "Malware payload (Smoke Loader)", "value": "028dd3f7db6b6e4c07de54650c5ecc87466fbddf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651561, "uuid": "67205347-1f4b-4367-8560-031378d95ea8", "comment": "Malware payload (Smoke Loader)", "value": "85fb3d3af908995bb5c5ec03e6422db3183c81f659829daf08246a5ea138dcdfd1d9bfbd7009908f96e1c4ee885b58d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651561, "uuid": "3d31b181-01ee-43e0-9881-9a5eb49ef6b2", "value": "T11E749E12E298BED8F599CA718D1EEBDC363DF8504D146366322D7A3F25701E0C12AB9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651561, "uuid": "86767819-7aab-485d-9d71-e8a0024c75a1", "value": "787cd3f7e6d0161bfca0cbd92375e751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651561, "uuid": "3040c9dc-4480-4480-ad79-3cfb434afed2", "value": "6144:4LmleOqyPG5wwi6NTeKOjq7VWRFBMolz90m5a:4aljqyuSgic7VWR5lz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674651561, "uuid": "e6d8de9d-ea2b-4bcd-89d3-13839bc74b61", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674651561, "uuid": "b206671d-1cd0-42b3-bfe7-dd565b0822ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651561, "uuid": "5946e847-21dc-4e88-a128-5039b01ad98b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f06de4-9c9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674642414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642414, "uuid": "732ceb3f-3305-432b-a005-b8babfae6d46", "comment": "Malware payload (AgentTesla)", "value": "d48d9b38fd7c6694faddfc56532a162f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642414, "uuid": "fe63de76-998f-471a-829d-a036b30b3708", "comment": "Malware payload (AgentTesla)", "value": "7ee91a4932e5cb653496cac1b636ba6ea5e301313e3c058d1c32ace08dffd96f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642414, "uuid": "13a90da4-9c45-4ad8-9277-1a570e06cf88", "comment": "Malware payload (AgentTesla)", "value": "5ea1aa18cfe7439ca327892f4b46a6a7347fb311", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642414, "uuid": "82c4b432-863f-445b-a154-d56d15a202ea", "comment": "Malware payload (AgentTesla)", "value": "47ce58ed7bf58f052182b958fd095f451865289bb421ad2262ddc924c0a59fa05c3b618934fe556df74d5c7041bba92d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642414, "uuid": "ba8d7931-2a09-4d8b-b9bf-62a14fe611bd", "value": "T1FEF423D8249ABAB6CCF5BE52CB90F93031455EA738DC8CB9C675DD5F091EC22F620429", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642414, "uuid": "d9fd7d15-bad4-4939-9a39-ecc2e7f8552d", "value": "12288:OMYJKUcJdEXAxb8JYi6en87CK8EdtfQNdAJ3EmLCsQJc+KBjwKAjZoAA+N5:O1XcJGXAxwJYipaZQXAJUu+4wKA1+s5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674642414, "uuid": "bc2e86e6-4f60-42a5-a9cf-bdc0b16cb72d", "value": 730363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674642414, "uuid": "d65e6335-948b-41a3-8c32-3a5274195364", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642414, "uuid": "947197a5-d81a-4155-b997-9969951979ec", "value": "invoice and packing list.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a944ecb9-9cbb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674656533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656533, "uuid": "973dffd0-6002-44cd-9821-eebc38d051c6", "comment": "Malware payload", "value": "0b5497660cfeb79798a9cd4a1169b2c8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656533, "uuid": "dc8d2aff-e95d-4b6a-8706-133698b7b20c", "comment": "Malware payload", "value": "7f582a0d6b6a310daebb97c42bb8c7eddda90734e13a0a335031f3d55cc060a8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656533, "uuid": "fcdf06a0-75f7-4397-b774-fb4b46d27881", "comment": "Malware payload", "value": "f8a954e7fc0f87cad0ad81807ef057f234ea2c46", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656533, "uuid": "6bdc607e-6c22-4ebe-9644-fd5882b8d247", "comment": "Malware payload", "value": "67b850bc630429aac81b0e5e408be9e07651ca02777b4a1ac7c73c6b0e9abef4d84751a34809866957b752a2bb916df4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656533, "uuid": "cdae64fc-c20e-4562-985c-337279fb8e7e", "value": "T12814541DAD5CFDEC62019917AA3BD5089F915CC9FA31ACA4C2DDCC62F03471C6E1A98E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656533, "uuid": "bd5bfbb7-2cb0-4c15-8d27-de15b6ffef68", "value": "3072:qtHPu3rjCmoGmHwR0lxRTrZfSJLVg/ihneliMv+Ja2CE3TiX8r/XvDwt8X/+lcWe:qtHPu7jCmoG+wR8xRTrZfSJLVg/onel0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674656533, "uuid": "6e3117a9-7aca-454f-992e-7ea4f97e922b", "value": 190703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674656533, "uuid": "0f54d687-ccf3-42a1-9acc-dfaa2464f189", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656533, "uuid": "27fe1e93-a7d6-4133-ac2e-b955afe44ac0", "value": "989bc6c3-b7c0-4656-999d-f6722cd18b49.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c0863b-9c9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674642112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642112, "uuid": "bcacf523-a81f-408a-939d-af5010e85f2a", "comment": "Malware payload (Formbook)", "value": "c5419c35b9c20fb07216aaecb7c7fde1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642112, "uuid": "803f6749-b5e9-437a-a890-29a9be0925a9", "comment": "Malware payload (Formbook)", "value": "7fa3be6313a31933b762a1eb84a4913ff764c30adebedec0d848d6ff78a9488f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642112, "uuid": "b6bbdc59-5033-40fb-8b48-bfb141209ac6", "comment": "Malware payload (Formbook)", "value": "aea3b88fd53a750c13f092882972f52aa5461fcc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642112, "uuid": "9f0c6c51-7dd8-46ee-90d7-174ac34db6d2", "comment": "Malware payload (Formbook)", "value": "8a82f98c4736b75a8476e3be17306821984f4e41a0429360c15f89724b5ea29ff66b3018b8d8285ec88923b1d06de5ff", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642112, "uuid": "5df29593-63fa-4aa7-8961-e1b587402c39", "value": "T102D423A3530E00BF9E0FAE521D7BA351106C956276B4326FF27869AD87C2E237B41774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642112, "uuid": "cb3469f0-a908-4fed-9ee0-9c96d1ef7d25", "value": "12288:CvwM5P5suCYj8aoqoD6zeCP4VqCaTO1xyb50J9raYb7rEPI3N41QF:4wM5P5Hlj8zqRwsm1xybCJ9rPbEwK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674642112, "uuid": "029bcf5c-5013-4113-8c1b-1b804e28baac", "value": 598873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674642112, "uuid": "4e2bbd0c-0dc1-4ab3-bd04-fad4928af763", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642112, "uuid": "4a776f53-a645-4ab2-b081-82568d41ec87", "value": "Halkbank,pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384e0c6f-9c66-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1674619836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674619836, "uuid": "c4e02220-1990-4099-bff1-49db426c3166", "comment": "Malware payload (DCRat)", "value": "f26bb4f3cc67c00580554bea3dac5e4a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674619836, "uuid": "aae4cd99-591b-4a5a-b47d-5c9046e7c5c5", "comment": "Malware payload (DCRat)", "value": "8148b7d10cc4d45ac6c2d1454119161a1ee677ac0986e4dd86e2f38a15b7ac19", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674619836, "uuid": "f440b852-6b1d-4eb5-8a89-5dbfaf1e6004", "comment": "Malware payload (DCRat)", "value": "14c7857a8edc29dce1a27379f60f0d9443303627", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674619836, "uuid": "0c7aa675-37dd-42fe-a172-9df4dd08143c", "comment": "Malware payload (DCRat)", "value": "27a1090ec27a098c6c6d5953bd19ca64bc8f094cb09b0723952e0c74ca198c18137efff137e97e9cffe4ad7be07acaac", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674619836, "uuid": "c228f8fa-5d9a-4b79-bb6e-0ae0cce9271d", "value": "T1FFA5BF017E45CE52F0091233C2EF854887B0AD616AA6E71B7EBA3B7D55123A73C0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674619836, "uuid": "e7b65e06-a4c5-430b-bbb6-cc046259c3bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674619836, "uuid": "0a4d1c0a-546d-4094-b3c1-8bd97bca0367", "value": "49152:tmyDQOI0/F/LopeanZ6QNo1y80nfLSx9ZEQCUn/ty374FM5YLCbtYY2Zy:kyDRZFTopJhTfe3ZtVy3x1btJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674619836, "uuid": "1857b1ba-5cfe-46b5-985b-3470eb954ec4", "value": 2239488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674619836, "uuid": "590af741-aa12-4a91-a48d-53f0d4c00acf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674619836, "uuid": "ba1129db-59b1-4df0-869e-11415ed8c0ed", "value": "8148B7D10CC4D45AC6C2D1454119161A1EE677AC0986E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a234edd2-9c98-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674641488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641488, "uuid": "0ade1ed4-a96c-45c5-b5d7-679339ac775b", "comment": "Malware payload", "value": "cc5b16d73491511b74c196b841d9b7fb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641488, "uuid": "6572f544-fb29-4638-8a69-47f2136e6282", "comment": "Malware payload", "value": "818e0bab11bfd5cd7c55356efce17fe8c2024a193d968cfb18f70d15a0d12951", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641488, "uuid": "bd77b7a1-f4fb-4c1f-8490-0ccf2b8abc8d", "comment": "Malware payload", "value": "a6731183befd09e6c6970d950b756ea1c3be16a6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641488, "uuid": "cd0621a1-ed9b-4be5-9a98-def744da8815", "comment": "Malware payload", "value": "08383a0c7af00797160cf75679e41db16cd5d336a836642553cdb2ad94aa18f20c4fa8c999fae6252201f93464b4cb59", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641488, "uuid": "6148e4da-babd-44d7-b260-6e5aa46d4891", "value": "T122C423F20F6746F0A15AC8955B5B13EFE89C7BC0DBEDED120114098B4E4A313A97B5A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641488, "uuid": "fc28053c-0ecc-438a-8674-b2077c5cfbc3", "value": "12288:bpyUo7l/0EfmW6Nem8pjq0/6P2XwXu4y/KF/+Ht/KmPW9uj8:Y0yaNemGqK6PWAubw89LbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674641488, "uuid": "2a934ec4-09ff-42a5-b77c-8724fdd5f8b2", "value": 558911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674641488, "uuid": "e7264c84-01aa-485a-b1d1-9b3cdc96455d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641488, "uuid": "32c3482f-170b-411b-a001-ef1953b4fff5", "value": "Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99e40a6-9cee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674678438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678438, "uuid": "8f38dc06-74ee-4bba-94a8-cdaba602c595", "comment": "Malware payload (AgentTesla)", "value": "2a32aad440bab9298c47537a5a0661e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678438, "uuid": "aae3f9b9-98b3-4d02-9009-24077e0f37b7", "comment": "Malware payload (AgentTesla)", "value": "81c0a1bcc6dbaaac2a3286dce14bbc6bd4db695083086703517bc96464c9b06e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678438, "uuid": "7c7ea672-5dba-4770-aca0-84ff9f830aa7", "comment": "Malware payload (AgentTesla)", "value": "ef5ca279012913f9c5ee1ece1630f9abedef4ca2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678438, "uuid": "f17d5de8-8d45-4eac-a99b-9291576488bb", "comment": "Malware payload (AgentTesla)", "value": "b8df219fcfb23e360ebe032fc4bf7602d70581d13d719bf06a77bac8b373678cdab8fde15a26a7c5cf71499385187bdf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678438, "uuid": "2c932928-54d5-4ae8-b7ac-c2614c31093e", "value": "T1C415EF50B278EB02EEA48FF9101191A147B22E5BEF60F3641C86B1E71673BD17E50E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678438, "uuid": "6fc48ba0-4de3-4179-8778-6c81b64372de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678438, "uuid": "fdf7df25-76c8-45bf-b51d-e372d5b99b1d", "value": "24576:R8kyGyOqQzlGI6AAgZ9izjXK9G4qQrmmcIo:R8kypOqjI6ABizjyK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678438, "uuid": "814c8f2f-1d77-4ceb-b1b0-f01b87e5ea44", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678438, "uuid": "d3597830-81c1-4903-88ad-33adb8d202f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678438, "uuid": "126838a9-dd98-463a-97d3-ff556c0b08b4", "value": "Confirmation Slips,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7acea35e-9cee-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674678359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678359, "uuid": "08af0188-8a4a-435d-954a-eec52a039a52", "comment": "Malware payload", "value": "d8492fc46e239f1a77d1a946bad68c6a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678359, "uuid": "e3d407c1-fd16-4e2f-a80f-5c43ad077994", "comment": "Malware payload", "value": "828523a3dbde6468b8a722dd1e24f759a941244bdd80050240906ccdeaef6004", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678359, "uuid": "ec0a9448-5dee-4618-805e-f45e265357c8", "comment": "Malware payload", "value": "03a1324c9cfb0d5ee4e0cd33d18202e0ff15b227", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678359, "uuid": "20408837-8997-4720-80ab-b771dce21e93", "comment": "Malware payload", "value": "c879417cdf72d3e48bf6ae40bf2b6f67fcdebab9ba39c420033f9b172b8c48a4109f3ff0280774d786d46dc11108a53d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678359, "uuid": "6eebd91c-e7b4-4f28-92e5-c51c9289e893", "value": "T14BC41271E6DBDD27D0929676C5B75AF5D8349F00C2320283AF387EB6F67A6414F0218A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678359, "uuid": "e716b9a4-c516-43dd-af06-1a2526e5d3f8", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678359, "uuid": "9d88aa4b-753a-45bd-ae8d-91517361bc42", "value": "12288:RLGdiKMhGJjoswqmNUHwXXkILAl6fBaVZOKnJNg:RCd+GJPwqm+QHkILAl6fBwOKnbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678359, "uuid": "ed61d5b6-48b6-4647-a181-b509d07c4087", "value": 545888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678359, "uuid": "ab539358-0403-45de-b3cd-2eb350cc7888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678359, "uuid": "f1f28798-0181-4952-a32a-16e5e02caea2", "value": "DHL_Shipment_Notification_Waybill_Number_9400184528.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f589be-9cd9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674669358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674669358, "uuid": "c46be6c1-23f3-4975-a3ca-1df099f260ad", "comment": "Malware payload (RedLineStealer)", "value": "b2df37a045babc8bf06b79566e992037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674669358, "uuid": "b40c74e2-7dcc-4282-b84e-0ca2322079c7", "comment": "Malware payload (RedLineStealer)", "value": "83e127f63c712cb81aa0113d30dcad2ca0466e0c2a2e25e35dbd548a579c3825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674669358, "uuid": "5f99484a-871d-4321-a864-60ec4e37ec5f", "comment": "Malware payload (RedLineStealer)", "value": "c4e8cd6a4aca7bfb3a3c563c5eac22531661e033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674669358, "uuid": "f35d9b89-1cbd-464b-ab50-352fa4f52c8a", "comment": "Malware payload (RedLineStealer)", "value": "103537e510210c32cf5d69fe126742f4ca517488d0970de841e5f0b052761c9d60f55e0c543eb0763422f5b887a9e461", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674669358, "uuid": "c429b9e9-5775-4ada-8f85-f2c0ed1d5151", "value": "T13F157C0AB0D94E18EB42EAF10640B5B03A973FED69DDA93D4EE93F8D0432518DD246DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674669358, "uuid": "c97b2cdb-c5ca-4461-8721-c9f79ee7ded2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674669358, "uuid": "0f99d565-a3f6-4123-be57-5a3d9c4f7266", "value": "12288:TcsP0QDliW6M31b3R/pFfaChSM8HbfAa6+tlWvOpWiqoj6yGF++IQg:gSDkWd1jR//MzptIGciN2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674669358, "uuid": "6e25b22b-cde1-4150-ac82-f747701e90a8", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674669358, "uuid": "7b9014eb-24ca-4060-a996-8f8eb84497d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674669358, "uuid": "4f0f7f9e-4539-4fa4-980e-b9d7684a2e0a", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b96eda-9cae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674650806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650806, "uuid": "75f5d0d1-9ff7-4245-a175-ca9fefa78c1f", "comment": "Malware payload (Mirai)", "value": "5f77c5db9daad78d868957acf6a720c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650806, "uuid": "775c8c2f-6f67-44a7-a69e-967d38c999f2", "comment": "Malware payload (Mirai)", "value": "84502816c2b5149267c63849e06412e95e0bb1fc8e231ccb39342bf6781c344e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650806, "uuid": "02f9acd1-c7ed-4774-91e6-054374a047f5", "comment": "Malware payload (Mirai)", "value": "1ae6ba52299bee965cdba2aec850554b96d63a3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650806, "uuid": "63ba6d82-91e3-443f-b9dc-628738e3db2d", "comment": "Malware payload (Mirai)", "value": "0517969103243bc1657726f9bcfa715a4536be5447d087a9cd1dad87cf8a60ddb62c29b6de7f3a4af0342684d508b46e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650806, "uuid": "4d259f9a-79b8-41eb-8499-fa1dce3fa634", "value": "T13D03E16225C5D271E6B08830586B8E57B9781634D6CB7911E4E90B98EF73C43FAA9F03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650806, "uuid": "c3a9d361-ccac-45c2-8c95-b3c80bbcaefa", "value": "768:oCt8xQyKEXdvcsU2fPmK/dP2zSenplLfkktpBnM9Qyq3UILYF:oGSzJsvIPPip5kkt3t1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674650806, "uuid": "e00aaaff-e6a0-4aed-8c95-076d5c02bca4", "value": 37896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674650806, "uuid": "cea666f6-8265-4e21-af45-33257f6fce22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650806, "uuid": "d16d3351-cb90-4547-a983-447077cdc1e3", "value": "5f77c5db9daad78d868957acf6a720c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ce2f24-9c56-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674613064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674613064, "uuid": "670a8594-deff-4678-a7dd-e89e4b5bf2e3", "comment": "Malware payload (GCleaner)", "value": "ac247dd2da0b4a06d6c6fb5952bc452d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674613064, "uuid": "a2befb94-6714-402b-aac9-0ef399af7859", "comment": "Malware payload (GCleaner)", "value": "851b305ebeb25a896378b7e452fe5d0ad9e1b92f46d0e1435e90c086f75a3e5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674613064, "uuid": "3083596b-b4a4-4042-ad62-4a927ec8dcd7", "comment": "Malware payload (GCleaner)", "value": "353d6fd837030871249cf64ceda71b97183b1b0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674613064, "uuid": "1f92d56e-4402-4892-a94b-f2b4ca72b21b", "comment": "Malware payload (GCleaner)", "value": "863a9663b0a151634f5648d5587c699bbc670b5e85cb5c1d819990c58f3396264f89666d56e6824828e2f0a45dd691d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674613064, "uuid": "2b0f0c15-733a-4f60-ad2b-684a8f200b30", "value": "T1318533438255C675C123EDBC102E80894DA7FE1764FC3158364EAA8D9F2F640E9B7BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674613064, "uuid": "ad51aa16-3d34-4ba9-9415-43f22d14d941", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674613064, "uuid": "3804095f-ea40-4e08-8ab5-744be0b8002b", "value": "24576:Z3iJtEIwsqz/HNPg1272z/jL2BrG9htbHpphGYB7o34Cqdfm64wTszCIryGTLC16:ZRTNez/P2Bk79oIBfN4jzrr3LCgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674613064, "uuid": "f9ef5826-e195-419c-b007-5d73badfb9ef", "value": 1775273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674613064, "uuid": "d6d34204-8bc3-42e2-be36-81eb7e87b8d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674613064, "uuid": "2a980cf1-b0b6-48ce-9551-86cf250057db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2977d883-9ca6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674647299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647299, "uuid": "4d616bcf-caa6-4307-ae7a-a9bf022da27d", "comment": "Malware payload (Formbook)", "value": "c2602ee2264cc628ac166c949d95efe7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647299, "uuid": "738e4d6c-3260-417d-aebb-bb63b702607e", "comment": "Malware payload (Formbook)", "value": "85592e4ce36367dd325f7b210f2f648a85f97571547ff02bd81fe060717805a9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647299, "uuid": "d919caf6-f9a4-4722-9c7b-0e672d1eb208", "comment": "Malware payload (Formbook)", "value": "b26f74ae22041a3b9bc2f8532d60fe57e0f22aa6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647299, "uuid": "3e7be8e1-89b0-4397-af84-d257307dec2f", "comment": "Malware payload (Formbook)", "value": "b10fae031651eec91890bd19e666b4a45af456e289138eae7dcbfd562a0dd27196dd5934c4bacb2fc705fec1d810f3da", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647299, "uuid": "488b0f0f-ac3f-4477-80dc-b2098edce6ce", "value": "T140E433CDD5375EE85CD91B0046B2E785E9CFE35517996A08C1A0EF8CB84108A5FFDAC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647299, "uuid": "16326a72-381f-450c-bec1-1c2350e5ae9a", "value": "12288:tpu6md7A/AC6teynBTW6nBDKPy/ge7a4gKvdhIW/aNZA6YUaoHeCOllXAi7+fXfU:tMJK/z+XnBDKqYMamdhIWyNZve/lt3+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674647299, "uuid": "d3575c4b-5b89-4a5e-8be7-82d9e75592c9", "value": 688115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674647299, "uuid": "90878cc8-b113-4214-9b46-28cfa145bfaa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647299, "uuid": "c3cf81d5-ed41-4e8a-86d4-f1bf6a03fb5e", "value": "Confirm!!_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62cde20e-9ca6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674647395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647395, "uuid": "43617b4b-aa23-424d-8ce6-5848be05c941", "comment": "Malware payload (AgentTesla)", "value": "70cbe946ce455bc38c630348cf08fcac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647395, "uuid": "ad223e85-e486-4dcc-a9ef-3374f5a6a350", "comment": "Malware payload (AgentTesla)", "value": "85913d4430d1da9a29e295d98d21997c90edf6d3dea08c709c81e5c8302c3e0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647395, "uuid": "aae70fe7-f4fd-43a7-ac4e-db99660f89d2", "comment": "Malware payload (AgentTesla)", "value": "289dd1babdd5efe719a7336eb7a14c8eb2669008", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647395, "uuid": "00adcb57-94ed-4930-b6ec-ad526abc4262", "comment": "Malware payload (AgentTesla)", "value": "e05cf684e01fe0bf2eef989322a2fbb0f7eb93c2651b9728001bda2d902f02387c793744979a84ace5d1aa7f02763d27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647395, "uuid": "63d8cccc-11c1-44f0-aa07-ee2856b1d700", "value": "T14EF4D00D33B86B12EAFF03FCC452200493F5A103E25FD75D2DC6B4ED1AA27619A69697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647395, "uuid": "71e1ea80-abf9-4614-af32-c2789eb4cea0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647395, "uuid": "64e6620c-1f6c-43aa-8b09-960610a12658", "value": "24576:axEO7Z61GF5nqVGlxiYhSuy1IB74GrORG:YZ6wF5qMI1uBB74GiRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674647395, "uuid": "49e95304-1683-4db3-9420-71be9e0c5efe", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674647395, "uuid": "0d81ecbf-3158-4936-8d7b-50ce3323f670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647395, "uuid": "d26ed5ca-cb53-4155-a0bf-cda22bae8aed", "value": "SOA(12323).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f781df-9cf7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674682139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682139, "uuid": "5066523d-1b70-4831-92b6-0fa651e96204", "comment": "Malware payload", "value": "f3b6e921a2a12101f09ffc9ee7703b92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682139, "uuid": "91b0d782-ed93-43d2-aabe-9aa1dce14588", "comment": "Malware payload", "value": "85fff4ea220a5720f525c57578d362e5bf38e69ce53cd47a05c4de940b7d51c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682139, "uuid": "f406d638-f34b-4f90-a5a4-32cbcf424601", "comment": "Malware payload", "value": "6df20d243dc8383a263df65c2f917b08e057e0c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682139, "uuid": "2370209a-7c00-4d20-bbba-1e52bac990d9", "comment": "Malware payload", "value": "9aed00b40e4f51eec01f5cd3780a7ae6a533760d4daa7d6116cec070f1110287ddb1c8ee72d4b6b46742ac65f744e186", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682139, "uuid": "b73f72b7-fb78-4926-b4e9-c9fce09f7e42", "value": "T16D158C003AB28493F897487A11346EDC6E212D19564ED22726F4376723FF7BF7E81662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682139, "uuid": "1fe8e5c7-3e9b-42d6-ae1d-9bb5f75941db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682139, "uuid": "4b6339ce-e138-43a5-90ad-2a6528db7922", "value": "24576:9pZlh1cconBuOhjSXsYTNE5wrqhTPVcFemqQmJ96SqUwKFGnRBo:OYTNywrCPVcNqjHfwYIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674682139, "uuid": "dd70fa67-108d-471a-b52c-8885897a43f2", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674682139, "uuid": "a1f15f2e-e9d0-456c-b5d5-75f62986fd82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682139, "uuid": "be421359-8fb9-417a-b81e-163819f03880", "value": "f3b6e921a2a12101f09ffc9ee7703b92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c7c2ad-9c8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1674635822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674635822, "uuid": "f9c8a18f-dc1e-4304-9ae9-aef1fa87f69e", "comment": "Malware payload (ModiLoader)", "value": "378537e9488dd3f336df2bea731deb3e", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "r05", "colour": "#7FF751", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674635822, "uuid": "12532d22-46c5-4c06-aec7-1b8ba00ebf91", "comment": "Malware payload (ModiLoader)", "value": "87118b6ec9d961ec0d6507868c974be9f74795479e6325cf8837c0916d013c34", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "r05", "colour": "#7FF751", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674635822, "uuid": "68a0e45f-eb03-4522-aec5-5be89e0df7c0", "comment": "Malware payload (ModiLoader)", "value": "f7244ffd1b78eaf66eb6d6ae8e3a7abc240e1020", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "r05", "colour": "#7FF751", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674635822, "uuid": "3ee75ded-dba9-46ec-a1b7-1c59458cf7cf", "comment": "Malware payload (ModiLoader)", "value": "63713291ced9753033aa6a6ce07b5592332944ef962392127e2fcb7e3a85e23130e2cd1676c776e3b46b53b8fd5d54d1", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "r05", "colour": "#7FF751", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674635822, "uuid": "86197473-6bd9-4d33-9dd6-f21b1be05e58", "value": "T1434423B3E5F2E7082E1B46E4F1F191474A7630CEE7EB1644BB38525631A9028DD4D0BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674635822, "uuid": "efeca721-f288-42dd-9e1e-1f3834953f2b", "value": "6144:0g1NMXT+ipiKU/jD92jSXpkX/BTz2GrycGGr:xEpfs92jSXevBTz5aGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674635822, "uuid": "20d015d1-d9ea-40a4-93ad-33ce69c72f3c", "value": 277303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674635822, "uuid": "9e17cee6-608a-4c99-9d48-771b384fc1db", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674635822, "uuid": "b2114aba-0767-4f26-9afb-82bae6913376", "value": "Re Purchase Order-23.01.2023.r05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e81353-9cb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1674655131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655131, "uuid": "e714675e-3f46-4aa1-bf39-910e8b8e2678", "comment": "Malware payload (CoinMiner)", "value": "53512dc3571d30c7003a748c53a312c7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655131, "uuid": "f4c72317-3764-464a-abff-76db973fb232", "comment": "Malware payload (CoinMiner)", "value": "872f113fce13192bf279c6f1fbc6e981d4a5cc51ccc9e7e94cfe8de4a59fc5d9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655131, "uuid": "9180c8da-ee42-4317-aeb3-9c350dee24fa", "comment": "Malware payload (CoinMiner)", "value": "548e138ba8709c3989cb528f131d61f8be623b78", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655131, "uuid": "f41a8a83-d5b1-4492-9120-ab25f0ede8ad", "comment": "Malware payload (CoinMiner)", "value": "1ca032b5cfac51147ddb3741d229f2b901929fd65397fb07eea009b48d6a826d685350353da7ecd20c6e941ab8613693", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655131, "uuid": "7a4d842d-b1a2-4b13-868a-d26181dea1af", "value": "T123065C5BF1A320FCC19BD030475BD7636A31B8A902307E7B2684EA752E72E60676DF51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655131, "uuid": "33b705c7-0bc6-4d9a-976d-e3b4b66e402d", "value": "98304:MKcs9o0vF9kOuymfS2eyGGtr1mLA/dRnrP/+DBfh3VHfyDuaJY+PdGrvUEX:Ocy/dRnrP/+DBfffyDuaJHlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674655131, "uuid": "a27eddee-499f-41f8-a840-77b78707e612", "value": 3873353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674655131, "uuid": "ae7eb751-8eca-4c29-b06f-e94f655796db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655131, "uuid": "8d55ca42-2cb6-49b2-b844-8f8bfeb0e71c", "value": "872f113fce13192bf279c6f1fbc6e981d4a5cc51ccc9e7e94cfe8de4a59fc5d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd9b51f6-9cb9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674655815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655815, "uuid": "444206cd-7643-4e45-a166-987cf01beff0", "comment": "Malware payload (RedLineStealer)", "value": "74b5bc703d209a4f51293a2ef52ed98a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655815, "uuid": "3b4b7f42-419e-4b4f-97fc-b44501d212ea", "comment": "Malware payload (RedLineStealer)", "value": "8821f917d3d2f7c31507d816a5a0959bcc1d88039d7216c0fc7bc386fae8bc67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655815, "uuid": "9fbb91b6-cce1-4bb2-9bc4-c3eb5839b116", "comment": "Malware payload (RedLineStealer)", "value": "32a5d601984cc51063421d9fa06d8ac4725f1b31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655815, "uuid": "a2d2ef77-531b-40cc-aac2-33ac0ccafe08", "comment": "Malware payload (RedLineStealer)", "value": "01740747e22f3822523d5ea894ad8619af9b1ed097b9dd559892c81998088b518f285efafcdc7bac92d1917467ba814f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655815, "uuid": "43617b30-93e5-4b5e-bf4b-8cf1a6d0a9a0", "value": "T1E7649D12F2B4B8E0F51ECA318D1A9BDC36BFB9519D156266327C7A1F29703E0C66E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655815, "uuid": "f337420d-3c75-4270-b463-8d931e106a26", "value": "8f16ef841269728457dd532b4a807550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655815, "uuid": "ee0aca0a-f3b1-453f-a1e0-d42f47a05f75", "value": "6144:BNLOUebeS9RJhDTttSMAGq0VvRFBMolz20TU6y:TaVbeOBt8Mu0VvR5lz1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674655815, "uuid": "c6f6504f-fdd9-4f2e-8f0d-f9fb25da692f", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674655815, "uuid": "d05734f3-584b-4fb6-b038-c9f51d3b9d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655815, "uuid": "501e0f14-1dca-4d98-b82f-52763d72603c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35389ab9-9ced-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674677813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677813, "uuid": "dca14ec2-6f44-4364-be79-e507a4f109bc", "comment": "Malware payload", "value": "f7b5b9fd8c7020dedb138ef75190dffc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677813, "uuid": "08ac0406-4225-4c5e-b1a5-9ea91367f1e4", "comment": "Malware payload", "value": "8843bafbb4a43a6c7a77c62a513908d1e2352ae5f58bd8bfa6d604bc795dcd12", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677813, "uuid": "86d866cd-46ea-470e-9f7f-520700f6ec28", "comment": "Malware payload", "value": "adebd8a52b6dc9ad35dee583eae8d93e0040b837", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677813, "uuid": "b313872f-58f2-438e-a316-40dd3fc5d6e8", "comment": "Malware payload", "value": "d6c33725b3de99c54f79e2ca294f73145258b37cfecb8bdb41a8a0ae668b7b07b6e35635ee6b85ad426f95327d6d72c3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677813, "uuid": "383b4ba2-d2b5-4b41-a06b-be6427dfce04", "value": "T104E35C21BEE2E5CDC53BD9744676C7B27570F834CB31AF7B22A896702C28E405E5E894", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677813, "uuid": "99606b64-ee77-43c8-9148-31051475619a", "value": "7c4ef15b75d09eb970ab96fa0abfa509", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677813, "uuid": "a938916a-3ff9-41f7-b639-860feb9fa7bd", "value": "1536:t92ZZAgmDjOVkMvuk4WvpVpqeGLmuRxPv8/aJS1CjhSI8t8yjkFTyHoQaj0DGAwa:tUiOflLpqPLmuHz38t3HkCBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674677813, "uuid": "8c7297a0-7090-4524-b82f-291df3c2f0c2", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674677813, "uuid": "0ff0c69c-9acb-47ee-9219-32552182d8f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677813, "uuid": "44d6ba07-9c14-4071-9b34-80a4f9a56a47", "value": "8843bafbb4a43a6c7a77c62a513908d1e2352ae5f58bd8bfa6d604bc795dcd12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbde7d3-9c9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674642444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642444, "uuid": "3b5cecaa-0b25-470d-b110-adb9a85ba113", "comment": "Malware payload (RedLineStealer)", "value": "e97323e7179ec5b50092db05784cae8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642444, "uuid": "4ce7269f-55a8-43c0-aede-67ecfc6a4169", "comment": "Malware payload (RedLineStealer)", "value": "8860322da9acde535927b05c46775e527b499330765d098d5d8ff8db790e6563", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642444, "uuid": "267b74f3-6fb3-4d71-9583-ceef3db97f2a", "comment": "Malware payload (RedLineStealer)", "value": "4881f0be7a06949eb8bccb0d056aafa7423fac87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642444, "uuid": "d9787b69-abff-449e-b3b3-2be1c52849f7", "comment": "Malware payload (RedLineStealer)", "value": "f99d04be4a3f64c1e40d8133d3c8122ec00dea596cba68ef78505df5a2a138939b89b8642fab204a2f79c7291fc65bd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642444, "uuid": "642bc828-1d24-4f67-b663-314b4ae396e3", "value": "T1C4C4AE02F1C1E9F9F7A030344B6597E686BD74761E2694C7F7E01E1F4AA02C26E35B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642444, "uuid": "95bf5d85-7e14-4e64-ae92-0a9856fb57da", "value": "1fe5ca85469e0d085105cb25e3befff9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642444, "uuid": "3d76e4bd-1c64-4541-bc4a-f51eb2a4ec16", "value": "12288:y6Kp+vUQyzW88fE9pjA+3Cph6D4s21rwBd0CMQ8LIgsEtt9:y6Kp+vezW88fE9gv6Dfi8d3M3IAtt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674642444, "uuid": "76f77845-051d-4852-aa04-f57680e7f5ee", "value": 571920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674642444, "uuid": "990f4d72-d034-4d45-b29c-b6795e69f764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642444, "uuid": "d9d261ae-0a54-44f7-a212-446f4edd82e5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c197bba-9cee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674678281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678281, "uuid": "7cd9b985-5edf-443e-92a7-f3155921ab0e", "comment": "Malware payload (Smoke Loader)", "value": "23224d3cede2d4ab8ffecff6cabfef9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678281, "uuid": "46d5abb4-ef4c-4307-a826-b8ce1f05b213", "comment": "Malware payload (Smoke Loader)", "value": "88bc0d720a906f0272c7bb1a11b598069cc5e3edcc5cadbf0869a164a3e822e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678281, "uuid": "0de54050-eda6-4784-ab12-fd02104973f0", "comment": "Malware payload (Smoke Loader)", "value": "148dd7d3c4a065a39d8d03d97514c9b41d78408d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678281, "uuid": "742dbca0-8929-4c5a-a532-cc2e49329830", "comment": "Malware payload (Smoke Loader)", "value": "dae681bf547ce68e57d694b87611f076ef1f9b8507c8c02a7e657dc08b0e06eb874ad8a3de70643bdbdcdbc44ed07271", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678281, "uuid": "9ce5c04a-8777-4e7c-aa1e-089e4cf907e4", "value": "T105649E21FE90A860F91A4A36CD1ADBD4396EF8D2CF3C735B32D4661F29721E0D166235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678281, "uuid": "b6c7b48e-a201-4f34-a34a-d1397cca9f85", "value": "8ec76f5c59a9f0c161f9365e55dfcda6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678281, "uuid": "45245a14-31ea-46d5-87b7-038c3302913f", "value": "6144:Td6LhFaiLmc90O6EJa670WzuboFu5I0+MOKXZcZgUTn:TA3atTb6oWzuoW+ZgUTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678281, "uuid": "6c4f7fe7-603d-4320-9d80-c7ac9baf1e76", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678281, "uuid": "685106e8-bbba-402c-b2b5-2fa50764d86d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678281, "uuid": "6af477e1-08d1-4006-9d62-489e87671e3c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e087671c-9ccb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674663497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674663497, "uuid": "4ddf47ae-c81f-4934-b643-ac154bbd82ba", "comment": "Malware payload (Smoke Loader)", "value": "afbd8e52989e6c8b335c874f4f74c015", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674663497, "uuid": "6401989d-433a-424a-b1ec-303245bdc07b", "comment": "Malware payload (Smoke Loader)", "value": "890dfe325d463ad633a56cb8ce222b8079dad72ed6511eaea5456794d037c006", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674663497, "uuid": "68579586-ef44-4dd1-b2e5-80de68906615", "comment": "Malware payload (Smoke Loader)", "value": "e5c76fac5da444871bd525eefbe8c99e0e5f88c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674663497, "uuid": "a06ef35a-02bf-4aa6-a269-5f8bfd52fa51", "comment": "Malware payload (Smoke Loader)", "value": "7a843e0383a7cbb251563a61df70baddc181770a12b854b68244b49cb70c941adf93268bec2dd2975273c79afd55baaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674663497, "uuid": "22db9b72-8bf9-43a5-abfa-2f0089bf4ec3", "value": "T14A64BF1276D0A9A0F91A4A36CD2ADBD4392EF8D28F3D735732D46B1F19733A0C536225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674663497, "uuid": "37ec4014-c615-4e61-aea0-ee5c4b10a1c7", "value": "8ec76f5c59a9f0c161f9365e55dfcda6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674663497, "uuid": "5727b1be-1a23-4c54-8f62-7f68433a3de0", "value": "6144:O/L7D95aQ6Ls6uejntZjoKTz60+MOKXxkUTx:O/L9QhfTGWFkUTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674663497, "uuid": "7e3ba402-04ed-423f-93b4-0692ce4421e2", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674663497, "uuid": "d379664d-7285-4b83-adc9-9710291009e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674663497, "uuid": "990822ff-ae7e-4394-9bda-ecf112d8599b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4af7a70-9c7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674630889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630889, "uuid": "8bbdf04b-ff07-40e7-927f-2380bdaac376", "comment": "Malware payload (Formbook)", "value": "c4c2ff54c64f07a4cb850560b85b4e96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630889, "uuid": "1b9ead98-ff36-402d-9215-2c8c5d99caad", "comment": "Malware payload (Formbook)", "value": "894ae4a50a815abb4b4e17090735c2ea38689d7e167052bb04ce8b38205213a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630889, "uuid": "9b5420b3-6598-4502-928a-2e1db8c0b344", "comment": "Malware payload (Formbook)", "value": "cc1a212efdc23571ac9fbe87ba843dbd3fe01ad6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630889, "uuid": "ceaf32b3-97ed-401c-94f6-d411af15cecc", "comment": "Malware payload (Formbook)", "value": "efd0d322af07bc5fe7f608f53776cc9f25d3befcd9c08ca53e8a2b2301f215ecab0f64c489d45526d21c13be76bad207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630889, "uuid": "6a1f2ba6-6a04-4a25-9b74-1b6fa5d908ba", "value": "T10DF4BEBC7690AC8FC0278FBBC5442D00AA61B4771F47E383A05B15A95E1E7DE8E516E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630889, "uuid": "d9180a13-a0aa-42ae-b2a7-f63faa63b239", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630889, "uuid": "923681a9-10e6-4ee9-b49d-90de45b90f47", "value": "12288:sW55JkUAXi0Vm+qsUvsQeXSToZIpvV/vKeWio68kTYSgI2oxC0cWYrperOIbVflQ:sWvypo+3PQeXSMI/CeWV68kTD2ScWup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674630889, "uuid": "c77656f9-b02a-4e24-aaf0-0ab696365e7a", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674630889, "uuid": "253c3a98-2b4a-4635-a563-23e05329c7ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630889, "uuid": "79888cbe-90c9-44b5-a8d3-a500d9fd2d58", "value": "DHL Notification_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82a7c75-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1674678891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678891, "uuid": "31a34e16-8e84-4321-b4fe-cdb8ea510351", "comment": "Malware payload (Rhadamanthys)", "value": "5ae7793a7aa8fd1e1f51e6b1790809da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678891, "uuid": "5fb592b5-48b9-41d3-97fd-e312dbec44fe", "comment": "Malware payload (Rhadamanthys)", "value": "896b55f30336dbbbcc20dcd3404c67fbfd59f02bc14e98d5a5075ef9c9604d95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678891, "uuid": "53a16b4e-1117-44b7-9b1d-96bea302c2e8", "comment": "Malware payload (Rhadamanthys)", "value": "2ea0a5a5e71093cf717ad8151bef1ef252d980a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678891, "uuid": "5a06880a-8109-4033-8b53-62d134b28fee", "comment": "Malware payload (Rhadamanthys)", "value": "9218928590a42fa3f2cde609990c1215b0dce8c96e05501c6ba1857c0fe50d959282058243cec559f2a8fcd596931531", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678891, "uuid": "7b6f5b56-407b-40fb-9fa2-2cc8619507b4", "value": "T1CB34F1213EA1C072D6F245743824C6D06B76BD3246A5949B7B6C0A6E2F703D0AF2B35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678891, "uuid": "41aa1bc9-3af0-4991-9519-a549feb258fa", "value": "39a12ed3ec7befeb872d2cda1d789974", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678891, "uuid": "905eea90-ea64-4673-b716-da3a3fd9d535", "value": "3072:xBN2B6mAjLSe8/nQG58itJhragFRKWhKi6bE4dlH8SdwT6VObUIMmeoYhEnPQs:XS4LonQKJhegFR7KDbE4DdwGOMtouEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678891, "uuid": "9e39c296-84b6-4246-b6a7-b53122733612", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678891, "uuid": "d71276c1-4b25-400e-9e7d-73e2a5192929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678891, "uuid": "c79538ad-15c6-4297-9ec3-8fd1187cfadf", "value": "5ae7793a7aa8fd1e1f51e6b1790809da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9d6f01-9ce9-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1674676109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676109, "uuid": "e19b6527-dc7f-4233-9507-ac0cfa9cf270", "comment": "Malware payload (CoinMiner)", "value": "30815e7574409c788e6cfb3247250ee7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676109, "uuid": "074b5505-110a-4487-96c1-4b21fa102d10", "comment": "Malware payload (CoinMiner)", "value": "89b2997d84ff0789fac1f4b9a2418ce8f74bed901c6eec51560a9f3b5c639e4b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676109, "uuid": "186e5277-734d-42bd-a2e7-9ba236f5f719", "comment": "Malware payload (CoinMiner)", "value": "940d9d02537afa8a892df4920ffc1f9a79c1895a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676109, "uuid": "1c5595c3-5c7f-4232-8d5c-b2b892797476", "comment": "Malware payload (CoinMiner)", "value": "a616d5b63d97722ff1e362d843784d285a242af5e612c60d19e57b706dcc7918c05525aecd153ed46f83158cbc8f2b04", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676109, "uuid": "6016739f-060c-421f-85ab-dad6794e5763", "value": "T1D8D5DF59FE1BD0A3F66E8434C46A85B94E20EC25A6C2522E397CFE3D527434224BD73D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676109, "uuid": "5a42e18b-cde6-4562-b950-e57ffdbf244a", "value": "cdd73a766273625b53bd22f0062b1110", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676109, "uuid": "f1a41805-f303-4a2a-ad28-55c42f637b43", "value": "49152:rQZ/9ZcgVR0HptbPPlmaN/eefrGDzQtz:rE1Zc51PFN/daXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674676109, "uuid": "fb01319f-afcf-41f3-ad4b-39e2fb8ef26a", "value": 2866176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674676109, "uuid": "af00a819-3b00-4d84-95db-cc7c2dd348f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676109, "uuid": "875e6be0-ab56-45f2-bf53-9c4bea22a7ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f44802-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674678676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678676, "uuid": "1afec40d-f1f3-45a1-8ba8-9df40bb534d8", "comment": "Malware payload (SnakeKeylogger)", "value": "06e50d688d5b79ffea6135c7a55402cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678676, "uuid": "4e276986-a197-4036-bf4e-ecce72d8b33b", "comment": "Malware payload (SnakeKeylogger)", "value": "8a349d1d7b21f1e8fc16ed7347bb447444db0d0223cb33e4b397eb3d8e82b4c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678676, "uuid": "14b63d5c-2c88-4a4b-991d-d483e45aa737", "comment": "Malware payload (SnakeKeylogger)", "value": "ad58274e8425775b284ee1f314f879100d437340", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678676, "uuid": "5d958e72-37f2-4973-a241-2af230d87a31", "comment": "Malware payload (SnakeKeylogger)", "value": "aff783b8607c9327977b1bf6170fb6272c951372ee0a6ce60a71b791044e31e6aa8d165bb39f835def597b741829cb5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678676, "uuid": "cedadd96-eb73-4187-bb1c-9774b4e9d796", "value": "T134E4BFBC7794BC8EC0278FBBC5042D00AA60A4771F07F383A45B15699A1E7DE8E556E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678676, "uuid": "1c53f61c-c73c-4f61-b232-434d63f17dff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678676, "uuid": "b8f70432-e9a6-44c2-934b-bafd898b24b5", "value": "12288:EHRqkSXSs/YmRd9L5/uM6d4+Fb36XV+ulhc64Ye3egS/0sPcklsLIUtnrLhuapHr:sdSiPm1L5WM6d426lAOgS/ckm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678676, "uuid": "9bc6de47-e440-4586-ab42-638f297b3613", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678676, "uuid": "ee75a346-5ca8-4632-897e-7d9a93032083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678676, "uuid": "b72f3897-8677-4607-b9b9-1280fb9435b1", "value": "RFQ order confirmation 2211206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d655c8a-9c9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674642635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642635, "uuid": "f7b79378-49d9-4f22-9b3c-d4fd26f39290", "comment": "Malware payload (Formbook)", "value": "be7a9bc01cfea694a22d463ec14e7e3b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642635, "uuid": "5112f69b-f5ee-4fcf-a6d7-60604f379233", "comment": "Malware payload (Formbook)", "value": "8d9987b12667c1d3cfd71161c7d18fe4b152557157bed38264120baa49b184be", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642635, "uuid": "3446fd4a-71ae-459a-89f4-6022c416b4ed", "comment": "Malware payload (Formbook)", "value": "1bc1b452bb230be5d4a51484ff4f2771f3792619", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642635, "uuid": "766900ff-157b-45da-9581-a36896f8b3d3", "comment": "Malware payload (Formbook)", "value": "e00535b4b8362c683980c6c468c469cb25b9122d8411d8d24f496bdd0ab86ee050b319a515c148b4e7bd7c9eae069040", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642635, "uuid": "e7d3b4d3-bbb2-473b-af17-54dbcb22445a", "value": "T1DAE423B6A4F8C0DED9E5401C22C364CD74FD1D64A553260B483B96A85BEB2E87FBB40D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642635, "uuid": "4223a27e-f962-4a13-93c2-a9ff377441cc", "value": "12288:frxQKDBSm3Wn/xyqZ8/uZv7Ddv4s00jN5jLelzGpEXiqYGwTtfOjOzVcV:tDn3Wn/sqH7Ddgs00/qlYEyLTAi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674642635, "uuid": "2c3fdd1d-39d4-4a53-8889-f76f955ff217", "value": 660139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674642635, "uuid": "9f20f70c-ea1e-4001-9916-e593a532eeca", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642635, "uuid": "830470c9-f93e-4bb4-b63a-31c2ec2b2b65", "value": "Doc_230125.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98afb0ad-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1674678839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678839, "uuid": "077c0b98-2383-4b63-9b23-a16005052322", "comment": "Malware payload (Rhadamanthys)", "value": "e9aeec0fbf9576ae75e7a7fe948a70cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678839, "uuid": "00c4625c-12bb-4299-98fd-5858fbead7eb", "comment": "Malware payload (Rhadamanthys)", "value": "8edb77b291073351d4c54aa1d6c9f77dd3382c1c5137af447ccd76e627326ce2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678839, "uuid": "93cc4196-bfbe-4305-8ef1-e1f46e67760b", "comment": "Malware payload (Rhadamanthys)", "value": "6d785acb473d5aa09569cfb0302430b43952067f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678839, "uuid": "e9b1578a-e175-4b4c-96c6-7ac4a40fa76e", "comment": "Malware payload (Rhadamanthys)", "value": "2c1ad670ffe842c260448f1ccc6cef31be0f65389ac76881b09abad3fb9c49999e287f211fd6dc9babb22d8693a24c3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678839, "uuid": "162b3d0f-0c2d-4b92-96d2-067df660a0e4", "value": "T17284AE02E2A8BD90F599CA318D1EA7DC363EB9514E1467A6323DBA3F19701E1C52B71C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678839, "uuid": "fb78b5f5-9339-4eaf-9a21-dce940087e3f", "value": "861af707b319724b1132a7a971c54bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678839, "uuid": "2f9e612f-1ae5-4501-9655-6b6bfdb10b7e", "value": "6144:t6zLfcmWtRXNHa37WHIHVIFJWeINmI4z5rRLjq7VWRFBMolz90c:tggmWhHkxk4NmTU7VWR5lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678839, "uuid": "79d30db0-8183-493d-8582-41cb32c658cb", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678839, "uuid": "e7a9c8cf-651a-4617-ab2b-e02564515854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678839, "uuid": "75d627ae-b8fd-404a-9bc4-704e83609a50", "value": "e9aeec0fbf9576ae75e7a7fe948a70cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431315ba-9c8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674635745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674635745, "uuid": "0b761e76-ae01-44db-84f9-9191351b3707", "comment": "Malware payload (RedLineStealer)", "value": "f62872fe4592273abda6f704fb27b3ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674635745, "uuid": "73d9db95-264c-40d3-88c1-2d7e6e89d7ea", "comment": "Malware payload (RedLineStealer)", "value": "8f136c424f604be973a76795d1de0dca7281ca25e543e264565d753e2dea404c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674635745, "uuid": "cd20a227-a85f-47ac-b011-183ba9fed362", "comment": "Malware payload (RedLineStealer)", "value": "c9f193458f5b59a81b3fcb6fed90112d6d0dd48f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674635745, "uuid": "61891ef7-bbaf-4fb1-b363-0d23a96334ff", "comment": "Malware payload (RedLineStealer)", "value": "02ff395224eae59bb9bfbe1c7844ddd4405214078e02dbdcb8fc6c85d9afe2b592dc0b6165107154c20317aa2009839f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674635745, "uuid": "94dd7808-a37c-4b61-ba1c-09f2a04c025d", "value": "T192B51CD7BF11219BDB1F88BC51E9BB336D2F6EF18130C5119B6A343CE692C903A49691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674635745, "uuid": "dbb2eaf1-0b12-44d0-8280-904ace2e367b", "value": "0757a8f986ddb3ab9e2a579b3f752934", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674635745, "uuid": "0fed9da9-5958-465d-a6f5-42638b8568c5", "value": "24576:SbS0tTtCM79UnERXLb9HOlSEE2Rly1luF/6yQhA68NNMOJMD+WDeQGl4Z1cb8zQi:y7TLhwSEeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674635745, "uuid": "829860cf-56b0-42ab-bb95-014ddf485a5c", "value": 2306455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674635745, "uuid": "a757730b-c91d-4f3b-b9c3-c6fe4f058a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674635745, "uuid": "b2f39ab4-45b8-4fdb-b8a9-dac2a6e4384e", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdff2c2-9c7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674630366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630366, "uuid": "7e71cebf-ec6d-4465-a260-e58ab6bada07", "comment": "Malware payload (Smoke Loader)", "value": "dc4a077b2f082179816ef091cd21f33f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630366, "uuid": "696a3b6a-afda-48b2-82b5-abb4d8a67ddf", "comment": "Malware payload (Smoke Loader)", "value": "8f25fa1ed25371850338e50cdd688e6463d29cd1443a45a577c34af3e9ca631e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630366, "uuid": "7340fd58-bc28-4e57-a00f-2f8cc48bbb39", "comment": "Malware payload (Smoke Loader)", "value": "34046ece6555af660e4023ed2e147f13030c8dce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630366, "uuid": "e0e3ac03-9d5e-4e00-92b0-502c97290f7b", "comment": "Malware payload (Smoke Loader)", "value": "d9b260bef50edba421132bd9fac946010ed6d95cf09f4afc728cdb708459eff3e744a2ac4a6e09a7310ad518aa3d5f69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630366, "uuid": "0a96f04f-7156-4a74-bb86-7b1bdaf4285c", "value": "T1FA748E02E2D8BED0F499CA318D1EABDC7E3EF9504D1866A5322D7A3F15701E1C56A31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630366, "uuid": "e4a374e3-efb5-4f40-9653-0265338e2338", "value": "861af707b319724b1132a7a971c54bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630366, "uuid": "130cbe47-f248-4700-bfff-2ca7bcc37f1d", "value": "6144:lzOMLR0nNG7ptz95dE6ptXUrJ9VH2J5jq7VWRFBMolz90Yfq:lqMKnNeE6Xkr9X7VWR5lzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674630366, "uuid": "582d2228-46e0-432f-b08d-5f494eedfb12", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674630366, "uuid": "b0f4bd19-4e92-4646-a857-2c7801d9f476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630366, "uuid": "c7cd158d-1ccb-4379-83b2-9be2120f2e88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2166056-9ce8-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1674675955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675955, "uuid": "a2720daa-c3ee-4a15-ade2-f1c73c9ea75e", "comment": "Malware payload (ArkeiStealer)", "value": "3dbc3817050496871431db302ecb4ffc", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675955, "uuid": "b8be6f50-2d14-4a1f-95e8-e4e759112316", "comment": "Malware payload (ArkeiStealer)", "value": "90e7c78ca1612b6f6e0f2c25e00e4c73e9df86936a243a03a488a3b155334eea", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675955, "uuid": "84efca68-3ec2-4749-a54f-7f884d7c5021", "comment": "Malware payload (ArkeiStealer)", "value": "5b5bbabc32224349467142385ae77b96a299a59a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675955, "uuid": "2976895e-a6c8-42d1-afdc-883724ffce93", "comment": "Malware payload (ArkeiStealer)", "value": "b60baaa3ef7abe48960979f1b2ad2400f66595e010dc33dae258c06cb6ad7ab9fcc7e9abcea5bd284d3330b73902d548", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675955, "uuid": "24ed3b1d-aee1-4a4d-b8c7-42752fcfb738", "value": "T1FC063343EDEB8294D690CC32D36588EF4EA675742AC5B8B6F18C851F81966D2D7CF2C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675955, "uuid": "43a67ed6-929b-47c2-a34c-666becea490e", "value": "ba682b08474414ef441da52664156d0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675955, "uuid": "f69fa4d9-0f94-4928-9b8f-186ddfc6ec54", "value": "49152:FDHrATS9GPSiK6Wl6n+XXZEk4fvXAFXr4ND9pv/OSt5GjhCbhontKH5ck6JjH:FDHoPnWoUSXhjpv//t0jhC+ntkOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674675955, "uuid": "b9ba3c23-2e97-45ab-9981-628bf48a67dd", "value": 3783680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674675955, "uuid": "a8dc73d3-e9f3-460e-9603-b864e8fd4b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675955, "uuid": "e960c83e-1484-491a-82f7-b09cd679aef9", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3edcb4ed-9cd5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Meterpreter)", "timestamp": 1674667521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674667521, "uuid": "69b67c12-e635-4b2e-83d4-72ee242ec440", "comment": "Malware payload (Meterpreter)", "value": "e2f38e610e1eb51b549fc7e49b8df2fd", "object_relation": "md5", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674667521, "uuid": "d35c7b50-8011-493f-81e4-06429e55c794", "comment": "Malware payload (Meterpreter)", "value": "90f7f2a6acaa52850e60eac82c37276cea12426a24f10cca944eaa6746cfeb65", "object_relation": "sha256", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674667521, "uuid": "77569c48-fb5e-4266-ba76-76878378467a", "comment": "Malware payload (Meterpreter)", "value": "bbdd6e7b0fbc39cc32e7772c249750e8c6fb9b85", "object_relation": "sha1", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674667521, "uuid": "27df65bd-9a24-4e79-802f-987700381ed8", "comment": "Malware payload (Meterpreter)", "value": "efcdf8347887b1edb5561f4079d6f3a42a0151528ef6d88206fb99b7c56ab6ffc6278d9eeefdd7b659313f162148aa9e", "object_relation": "sha3-384", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674667521, "uuid": "6ae623d8-6985-4c28-a612-2af671fcf8db", "value": "T11E5105E631A1B59E818747353F8867EB907FC114C9DA6800B58C9F69F4CDDA3258D7C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674667521, "uuid": "d95e7807-b663-4e55-a589-4de6c872edc8", "value": "48:3+MTHimb7uS2nAffAseYsEIY6HhXb56dkHA3crn:uGRXrXXDIYipFWkHScrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674667521, "uuid": "0f4b126c-1206-4fb3-a7d3-1356321fa59a", "value": 2862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674667521, "uuid": "56fd3a85-1420-4481-b437-8c9ebac2b321", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674667521, "uuid": "2ff674c4-716c-4e34-9275-b155f70fc4b7", "value": "3ZfuWmST.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d332bd9-9cae-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674650822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650822, "uuid": "06748f68-b9cb-43b0-bcf6-3dd189e2bf5a", "comment": "Malware payload (GCleaner)", "value": "f62b257bf556ccbe2791d8dc0a282cd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650822, "uuid": "1d2fb216-d4a8-4101-abb8-1a9b71bf32a1", "comment": "Malware payload (GCleaner)", "value": "9185c50563a6b8e2b4f96c05094bddbb844035ca89df5f2701bcce261320b96a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650822, "uuid": "92298f23-ba85-4695-992d-025b2c3872fd", "comment": "Malware payload (GCleaner)", "value": "d5d8d97a04a54722a4f2dbf409efddde869fb18e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650822, "uuid": "2626ddf4-5580-4778-9936-1aeb08ea1363", "comment": "Malware payload (GCleaner)", "value": "1c900ab0003b9cb538095963d6a39bab5b2773337f85876421add20173a35718d6ed94cf027c5f4a120d630d4d8ff33b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650822, "uuid": "161bfe93-73bd-4be4-9fab-d01c9fcf91b4", "value": "T17185337121517CF0F3A1ABB11A65D694BED37B669036912CF89D730F8B63280E46F3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650822, "uuid": "f81b83fe-d360-46cb-9889-3528b72217b0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650822, "uuid": "6f87737f-3693-46ab-8d33-74cf2ff58707", "value": "49152:ZaEN6qsFTzYdWeE+eLRQ3hIqlr4xGkN2+RLCgv2MR:QENVstgK1Q3aCkYw9v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674650822, "uuid": "bd1a7424-e0fe-41c2-91b8-0f58c2747823", "value": 1795097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674650822, "uuid": "a5986a8f-0c17-450c-bb42-5ca076301bd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650822, "uuid": "fb367cde-6198-4a4a-823e-50e39cddf4fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720b3c53-9ce6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674674908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674674908, "uuid": "217acecc-0ba7-4859-9d65-491baf19a608", "comment": "Malware payload (RedLineStealer)", "value": "2b15e413c2a41594fc13aade6ae19691", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674674908, "uuid": "79dd603e-59e0-48ad-9e2f-42f21c63a15b", "comment": "Malware payload (RedLineStealer)", "value": "927d4ef83decafb147835df57e314d9506884260c9123951dd141f019eea2776", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674674908, "uuid": "c21f4c65-cca2-43d8-aecb-1530703d4596", "comment": "Malware payload (RedLineStealer)", "value": "ebd51aa93ba4e1a9788e0a6e65d5a0217473a428", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674674908, "uuid": "db4df061-2fa0-4b18-a884-45de957f7cc6", "comment": "Malware payload (RedLineStealer)", "value": "0aaedf359a637394d2faa5ba786b22ceba1257b272e93823a773e3696dfcb8b709e8719df9af9d8de9fbb42ea38f8984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674674908, "uuid": "73ac1c6f-9fcd-43b5-829a-3038eef14d7b", "value": "T1A9649E327ED0B850F91AC6368D1ADBD4F96FB8928F3C765732C4661F19723A0C16E225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674674908, "uuid": "0574dd58-f65f-4263-aa0e-29e52a60e392", "value": "8ec76f5c59a9f0c161f9365e55dfcda6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674674908, "uuid": "46fc6ecb-1d45-405b-846c-7d641c8c0999", "value": "6144:hT2LyrRJS7Uk+amWfot/1iS+zRoe0+MOKXAsTA0yD0UTn:hycRc4zFWfot/1iS+thW7Q0UTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674674908, "uuid": "db6f9ac1-be4a-4583-8440-ea6dabb35903", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674674908, "uuid": "95d45ef7-d7a4-4f0c-a298-c23971e2f42a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674674908, "uuid": "acd91725-c35f-4fa4-a354-6478296e60d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae35a1ea-9caa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674649239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649239, "uuid": "98dd2d97-0f2a-4319-8414-3b1c2fa1e28f", "comment": "Malware payload (Smoke Loader)", "value": "4edc2181db86513f593f18793d30ebf9", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649239, "uuid": "f162f1f0-29bb-46fb-a3be-46d7e9a99b24", "comment": "Malware payload (Smoke Loader)", "value": "92f5bc1c04cfa529056b7f6cead4ec4aa2ce280ea51b166e4f62b7c40e0e32de", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649239, "uuid": "2c8bebde-284a-4a59-978a-08f6fb6cd341", "comment": "Malware payload (Smoke Loader)", "value": "33a4a18759143c258703147bb5a05a19f9be65d6", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649239, "uuid": "04d13521-aac7-4c6d-9db3-159a74812e27", "comment": "Malware payload (Smoke Loader)", "value": "e56f4f64e440f797bd77a26fc3e7cac4fa2ecc5972ba2fc456bf5a41a0ad7102d37f866fb7352840637d757cc951975b", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649239, "uuid": "c2feaff6-0ff3-4b3b-981e-0d8ab6fa5d6b", "value": "T1B5B23F05A398D27DFC633E34ACA706704B7AEDC9C822AF9F9C007AD6A979741C615320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649239, "uuid": "386f196e-ecda-4355-874b-01ba5465885f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649239, "uuid": "1fcc8e08-9c3f-48aa-8729-dc23e710a157", "value": "96:TbpKgeeUZvHZ6mkIWjT4nLkjDUPRx0UxkRbkPf4LNiRB4e3T3e3Lvn1fzNt:Y8AvQdIWfoLkjD8TOQPf4L9bnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674649239, "uuid": "aa2865b5-f749-4bdc-9773-01954aa07ad0", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674649239, "uuid": "0ebd5cb0-03a0-44eb-ad3e-f68d10ffbcb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649239, "uuid": "1d858ca5-80f2-425e-91f5-4ffbd8dd442b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f2da06-9cbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674658248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674658248, "uuid": "0cf7254d-f194-4264-ab70-c944eb06490c", "comment": "Malware payload (RedLineStealer)", "value": "b27df3c074aad2f2eb672cce06c62db7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674658248, "uuid": "74382f4b-e2a7-4abe-9f10-5f7b86399a44", "comment": "Malware payload (RedLineStealer)", "value": "93840fe484f03d26ef3045eb9526b315c57a7611436ca5ca6be47b0cc9a390c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674658248, "uuid": "805c13fb-5763-4e57-9a50-7f5e59d8d85d", "comment": "Malware payload (RedLineStealer)", "value": "e001ac79fa9953cee258ccf84d000d4cf0cbe105", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674658248, "uuid": "b614b4a4-789b-481b-bfae-d49e3fd6e61e", "comment": "Malware payload (RedLineStealer)", "value": "b072c73c0428c36f8877febcc7dcf9fcaff3badd8a54195c5e688c9c815c035ba5a9e394ed7018d194482e914c08eb8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674658248, "uuid": "c852b775-e100-4b45-a5eb-2ab4e47f3bb2", "value": "T19E04D51437FCDD11D1BA5A3FA961A05086BF9802A842F75B76C367CD0E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674658248, "uuid": "985e99f1-d7fe-4519-b7db-43fdb838b704", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674658248, "uuid": "08d64773-7ee0-4186-b69f-33c336dddda3", "value": "3072:8xqZWJBaKULo3YteV5F/hP/xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+ca0:SqZIYW/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674658248, "uuid": "cedb3525-c42b-4c34-9ed8-64850bb254e7", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674658248, "uuid": "d87fc859-d816-4a68-ba6b-407bc1856129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674658248, "uuid": "8e511f05-3163-4035-8e98-933845547ec1", "value": "b27df3c074aad2f2eb672cce06c62db7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a7a8f5-9c8a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674635285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674635285, "uuid": "a9a38e90-82b9-4062-90b4-7f32ab094c7a", "comment": "Malware payload", "value": "4be211623b05f3e255296981877d00a8", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674635285, "uuid": "1ec7c68c-a37c-4069-b859-7f2108aadf31", "comment": "Malware payload", "value": "94f5c5099a5c3aba3f626eb9c0cc0b6dd7dedf501d7e5b4aed45e986bb0a7cbe", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674635285, "uuid": "edd476d0-d3cb-491b-9704-3d3f166a0ada", "comment": "Malware payload", "value": "f32331d94e3df2022ed60ee0b3a43b27de6861b0", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674635285, "uuid": "5f5e31d2-69ba-4273-b33d-e18215e1593b", "comment": "Malware payload", "value": "f85799577a7ba31ab78570e2d8e2594651e18cfa1c043a23511bd2ada5572ee3b123def33db8f821b20da6b49348abbc", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674635285, "uuid": "e800609e-6335-4530-942a-d11f9dc3c359", "value": "T17052B0DFFE294ECEA65EA73C1CD3F02D8D0EA9568E51E6DE809D4D3405131B2B31506A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674635285, "uuid": "7f44cb5b-01cd-4725-baf3-72eff7d87ba5", "value": "384:k33SsmUts2Y8i332poPJhoQvANEx2NIAzl3STv5+H:kysHts2+4oRvA2OSTv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674635285, "uuid": "1ad7bb90-6464-47e1-9068-3d901bfb10ad", "value": 13555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674635285, "uuid": "b7353610-33eb-44be-bfde-364d461b27ac", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674635285, "uuid": "05c7d434-f26a-4d9b-8303-14f5cb787092", "value": "1f809524-929f-47b5-aaa7-08dafe31b66f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55958441-9c44-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674605282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605282, "uuid": "c81585e1-f22f-4dce-90d9-0f5f8299ad27", "comment": "Malware payload (Mirai)", "value": "ce91e25195a2cbc8eb28d7e033678778", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605282, "uuid": "d97b53ad-430e-4294-9ab1-23054bd35b78", "comment": "Malware payload (Mirai)", "value": "9535ac178448446a9938c44c14d28a513b098390504a367e7b9d037d952d5530", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605282, "uuid": "6ff3b0b7-4b57-4c94-91d6-14bbe11e8bf5", "comment": "Malware payload (Mirai)", "value": "cc7bbc08fc612396d3bf19b1539c0f135081ddf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605282, "uuid": "a43a6320-35c8-4e22-883e-727f4e476703", "comment": "Malware payload (Mirai)", "value": "da541b28c34da49c23e9f7546258aca00fb5fd2990572489e9ccb9ffdc6f22a12cf4ad7aaedcc4ebca51f2416074b2d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605282, "uuid": "b5155916-9e63-41d8-958e-c38001bb0fc2", "value": "T1E7C319B794586E7BC041657115AB5E300F1AACDB8B6B0E45223CB6B8063F4CDFA8EF54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605282, "uuid": "9391fed4-d8c1-47ae-9d14-31d4e1c89279", "value": "3072:VE+/KHnAIAXFtQyCXhkMKSo2ma1cNzmvn6cN/:VE+yHnATdCkjSo2ma1cNzmvn6cN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674605282, "uuid": "4ff9f79b-f866-4d26-bfd5-e623e0757c6e", "value": 120992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674605282, "uuid": "73d1d358-c03d-4a90-b2c9-f451fe5c51c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605282, "uuid": "5118548b-8de8-4325-952c-86c93eead5e0", "value": "ce91e25195a2cbc8eb28d7e033678778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c868ba-9c49-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674607452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607452, "uuid": "1f623163-8ac3-4ddf-b3ce-15e6c426d6e5", "comment": "Malware payload (Mirai)", "value": "ce86c029b162770683ffccccdfe8714e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607452, "uuid": "224da7e9-d5fc-40ce-8179-1ce92de2e3c2", "comment": "Malware payload (Mirai)", "value": "96a37603e4b8fbc741d8662e302babeb781708eab986e540cb493f67b96c4080", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607452, "uuid": "907268d9-4bc0-4d61-be9d-37e3e6df2f0a", "comment": "Malware payload (Mirai)", "value": "cdbc40e48520365b9667a31c7534421ef67e2282", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607452, "uuid": "f3316d2e-b181-4250-a2a4-0306a968d194", "comment": "Malware payload (Mirai)", "value": "9dad4fbaf57977375f7cb8167aba3deb5cb043a696c19ef6c559d5068637969ea19742bbca4d48863b3eacdc87f1e6b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607452, "uuid": "b5780e4c-8414-4385-a61f-9afb97dec352", "value": "T12943A80A9E259FECFB59C6344BB38B316AD43FD62691D5C8D19CD9001EA034F245BBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607452, "uuid": "9dbdb658-8b1f-4cf7-b5d4-a049a7eb45cd", "value": "768:DhvQlahOth/IAppF+w2e0hYGIh8TUPM1RzMfca1bdRyMf21bgURQS+roh6HDCyb2:DO+weCh8TUk1fUfUCSDvybalzDXhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674607452, "uuid": "6fe2d405-a6d1-479e-9873-0c0b42949588", "value": 60388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674607452, "uuid": "8bee2712-855f-49aa-b2e8-d5618d80f059", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607452, "uuid": "b16a212e-cad9-49f5-b83a-01311285622f", "value": "ce86c029b162770683ffccccdfe8714e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac28f0c6-9cb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1674655249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655249, "uuid": "7e331eab-39b4-450f-b610-2c7cf603ebe8", "comment": "Malware payload (Stop)", "value": "38197a129c9d124e0ac9889289596bad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655249, "uuid": "527d35bb-6680-45d3-bfaf-ee02d74afa17", "comment": "Malware payload (Stop)", "value": "9727caabf7c10e0190cce2d32157edc7eed99517cf4e0508d26ed23da6e0ecba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655249, "uuid": "2b26784b-12a0-47e8-8570-a06ea8d54978", "comment": "Malware payload (Stop)", "value": "9338cd6e6188719e07c894c1b1b34557e6ce4ad9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655249, "uuid": "684cad39-e0e3-4e15-aa7b-182510738532", "comment": "Malware payload (Stop)", "value": "b792116a79dbe9b715a7f74786e406871dad471c27126b3fe903965b7e5be46031a000ad6fcd9ecb30e50cec11637277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655249, "uuid": "3abaecd6-0823-4c94-a95b-4536513f8285", "value": "T1E205F101E2E9B990F59D8E319D0EE7DC263EB9904E145325322D7A7F2D781E0C63A72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655249, "uuid": "12cc39b0-b057-4fcf-9b8d-182ba39727de", "value": "861af707b319724b1132a7a971c54bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655249, "uuid": "5d60da05-159f-4fee-8d4c-926dca276715", "value": "24576:cIaMHjkABgMMxp6q/GX4Sl9iLq2xPw7VWR5V2X:7aukwopnuX57iLlw7V0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674655249, "uuid": "ca4f9ea9-bae6-4949-b965-39ac214afd3e", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674655249, "uuid": "a2f3a098-3d93-460e-b6b8-2942a8a28e1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655249, "uuid": "63643fd9-36cc-430e-970a-09f0b165b31f", "value": "38197a129c9d124e0ac9889289596bad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8aa299f-9c88-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674634681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674634681, "uuid": "47d9132f-ab71-4502-811b-0b487c13b73a", "comment": "Malware payload (Smoke Loader)", "value": "6d5d798324ad93df1ac15313d6848fad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674634681, "uuid": "8b79f647-0b5f-499c-b884-7522f741a43b", "comment": "Malware payload (Smoke Loader)", "value": "97571d8cdca847b598b6014c7e03ad242f8edb2531b85e5db59740a4181fea4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674634681, "uuid": "24cc2c91-39ce-4ff5-ab58-e2314742f5c5", "comment": "Malware payload (Smoke Loader)", "value": "022e673fe8b28c9d818d4f5bd6c52652a8115bce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674634681, "uuid": "f45b7a2e-fa2b-4e7d-b941-edf0824b17b9", "comment": "Malware payload (Smoke Loader)", "value": "9ca5ddd1243912a1a73e1c0d67e8c29c9148feb2725d825803cebbafe85c03e2de4f17e3d138eafe7a5d65f8daa052d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674634681, "uuid": "d95cbd04-8d5e-42fa-a5b7-a3a46f43c009", "value": "T186749E01E298BED1F499CA318D1EA7DCBE3EF9504D1467A6322D7A3F25711E1C62A31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674634681, "uuid": "5b19095d-5458-4c7a-a9a9-c476bd7f948c", "value": "861af707b319724b1132a7a971c54bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674634681, "uuid": "31197b13-2dc0-4daa-8b35-a067ae45bc56", "value": "6144:cALctHIW3Pk7Mm/LZfvZWY3jq7VWRFBMolz90Q:huHIW3c7MgtvZq7VWR5lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674634681, "uuid": "9b33f371-bf6a-4360-84b4-a3f969fb6fef", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674634681, "uuid": "683c0250-1119-4879-a213-949fd4e20f0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674634681, "uuid": "f1e9b24c-5ea8-4c85-8c9b-ec9b6056c35c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdea8bdb-9c9a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674642501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642501, "uuid": "52787630-e026-4f18-a198-2f663a3b9960", "comment": "Malware payload", "value": "3b55f26f6133c7aa72573a8bb77a9b8e", "object_relation": "md5", "Tag": [ { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642501, "uuid": "d730ab10-99cb-4bc2-978f-573b93588bdc", "comment": "Malware payload", "value": "98219120ee952bdc7b7dbf8e6ce0eff28c42fd5dd4df4e33b582b833fde37101", "object_relation": "sha256", "Tag": [ { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642501, "uuid": "6705d007-4b23-461f-b3a5-199a74cb8236", "comment": "Malware payload", "value": "ae6bd95e8a282c662afeb3f943cb2d349b32432e", "object_relation": "sha1", "Tag": [ { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642501, "uuid": "43759915-113b-4197-9461-5904106f82dd", "comment": "Malware payload", "value": "5a728b87c6e2d846764f3a31c0c02b0c82653f1e37308f49aabcb59091a514e7ecba658f31c05f006fb563c8880d3d86", "object_relation": "sha3-384", "Tag": [ { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642501, "uuid": "aae8f33d-8550-450c-845c-083d2a4e946f", "value": "T13963D02CD942F861D766AABEC44D11E1FB095243E2459E9F39D0F38E6E0089F0B579CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642501, "uuid": "a879ce59-fcf0-479f-af64-0535f16ca18e", "value": "1536:rZT2fcMHOVEQux6qJvc3F7I4JHBZi1tJaH/W:VKc1uxkO0BMpafW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674642501, "uuid": "90435cb2-e70c-4026-8685-4114e3c1bdb4", "value": 70059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674642501, "uuid": "ab821fff-d2f6-4fb8-858c-456a47ff1961", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642501, "uuid": "fdf37573-848f-44bf-b6b7-48215412d028", "value": "COVID-19 Instructions to Agents Updated - Copy.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df407b3-9c44-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674605296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605296, "uuid": "9c55ffc3-7141-440c-bd82-cef50ec2c212", "comment": "Malware payload (Mirai)", "value": "d47d385ab804e508ceb8c77fd258d0c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605296, "uuid": "78e577ae-2d2f-4688-89d4-5e8461fe19a6", "comment": "Malware payload (Mirai)", "value": "98ece9fbfbdbf5f0ae79ac686de6f6f0196f991c7294eb800a19f32d3f2ba610", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605296, "uuid": "e2f25284-a656-4504-bfc8-c08f682a79d6", "comment": "Malware payload (Mirai)", "value": "6b325f773c677505da782763d524f8a6762b0ccb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605296, "uuid": "3cf0abae-c671-4cc5-875a-069b18bfe03a", "comment": "Malware payload (Mirai)", "value": "37e34482cb1a9b227a7808ceb87c3facc55aef155648bde7cba1ae53cf771a2cc84d744cfc1da1651b4e2f9ff9ad1a26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605296, "uuid": "1f623433-4e3e-4ac5-9cda-705ccaa4349d", "value": "T13ED3F8B0E808631FC2D227B6964B4A5C3F391EDBD3A733115A3879B81BE97847F65910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605296, "uuid": "3c196dcd-d959-4ef8-9f1b-cc1999f840fe", "value": "3072:JXuA8y+SBsrvRCSKtabBtOmE/L7Q/kWGfgoNb:QAkSB4IBtabmmE/L7Q/kWGfgoNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674605296, "uuid": "47ecc7cf-4ee8-4bb5-890f-ffd636bca2e7", "value": 133522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674605296, "uuid": "db8a01f8-1518-4088-ad7c-3896a8940b3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605296, "uuid": "f2f3f3c3-e902-4ef1-8e7c-95925177963d", "value": "d47d385ab804e508ceb8c77fd258d0c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b483ee67-9c4b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674608448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608448, "uuid": "ad0048d2-c22d-4658-882f-47287584b94b", "comment": "Malware payload (AgentTesla)", "value": "5e4650f096f4767cc8eb59d8cfdef889", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608448, "uuid": "f9df888e-3cc5-49d5-bbd3-e25e8fe72a59", "comment": "Malware payload (AgentTesla)", "value": "9a4b49e3b6ca261023638a7c0e8a1a1cc5144e6278f40390c4ee88bd693d3fb3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608448, "uuid": "432e59ea-7dbf-4fbb-8e92-3c6438d293d8", "comment": "Malware payload (AgentTesla)", "value": "e00806b9b69343f3336dfa5869f4bffc4d4d9f99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608448, "uuid": "72c34b6c-6da1-4ebc-8756-5f0a85a7e6fb", "comment": "Malware payload (AgentTesla)", "value": "619dce97c5e59bfb29fd278a26e1e4e6c77cd031aab4ba6a9654be4a271da1b6192f29262410eed668f71ce84a28b72d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608448, "uuid": "9b6826a2-1557-447e-a2b6-e231b0166237", "value": "T191E42371FF415513DA2383F08D762612AFD1D2220CD48F4E5B92A34E76251AAE83FB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608448, "uuid": "c0e626f1-a7cb-44b4-bb5f-200b468bb89d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608448, "uuid": "5ad44a26-8f9a-4653-8f74-0b4a517ce847", "value": "12288:PYBOhZxa3mJ6GULFqjuqcyprkJaLPF0bZHvZ+zvvRngSAP/Wx7fjJrPKdWcj:PYBOxa1PwuTs4QPqp8ztAP/WxbjJrYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674608448, "uuid": "cbceee56-c08c-4c62-8859-441cb790c1a9", "value": 661875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674608448, "uuid": "14f8a99a-72f9-4a6d-b655-a72bff8b1c20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608448, "uuid": "b2fdcc48-9c56-4cab-8dd4-bdeb482d5152", "value": "PROFOMA FACTURA 24012023_PDF.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd4ed47-9ca6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674647309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647309, "uuid": "babfe55a-f7ea-4b02-bfac-98a6e5353d27", "comment": "Malware payload (AgentTesla)", "value": "bc6f553a5c2ed8a20525dcdb32d6327e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647309, "uuid": "5113b773-9217-4b7f-af15-388e6713f6f5", "comment": "Malware payload (AgentTesla)", "value": "9a5397f3aef009d0c4254b6619a4bd3bdd9e7954286043322d67ddb600d10053", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647309, "uuid": "6a945cb6-d7db-4fc2-a259-66f399a06816", "comment": "Malware payload (AgentTesla)", "value": "bc05a558d31ab78d74382cc2e65bb4359ffb05eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647309, "uuid": "5d41c0d0-bdf2-420b-9d12-f2b5bf6f14ba", "comment": "Malware payload (AgentTesla)", "value": "9c8dd0a29edbe25329c2730b8288503234747dec9c42bc4bd98577b76b2d3101bfe34ca8ac5ef62500738794bfc49887", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647309, "uuid": "5fabe85f-56b6-448f-824f-db878da049cb", "value": "T15E5423DF33576D7D21667A8EB5B035B4310F0FB08D8BCDE8E2125A3D5EE5A59008D209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647309, "uuid": "631bb0f5-6004-4c85-8013-ad9045ff94f0", "value": "6144:AV55Q27tekhecfI/KfdZzzClYJHzxXK87tMkZX+VxE1kWX0zHexog96:W5ugtvasdBCaDX/Os1kC0g96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674647309, "uuid": "d30eae81-3a41-441e-8c52-1c8f5f449801", "value": 295412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674647309, "uuid": "978e6f4c-1a0a-4bfb-a95f-65f09167328b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647309, "uuid": "1aad914d-e916-4257-9373-a37cd5b25a30", "value": "Order5466337.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60e6a97-9cee-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674678432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678432, "uuid": "eb1ef763-de7e-4280-8876-904d3b05f57b", "comment": "Malware payload (SnakeKeylogger)", "value": "4bb45b7230853a0139bf5d681256cb55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678432, "uuid": "fc80d8d5-db0c-400e-beea-1c5529b9dda7", "comment": "Malware payload (SnakeKeylogger)", "value": "9b5ec4049e14aa89f83aa1e7268533d5560664710c1de74c4f866d07381880d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678432, "uuid": "25789272-7e6d-4444-bcca-12a4af4dd763", "comment": "Malware payload (SnakeKeylogger)", "value": "edc1a3ea602e035c350c531f82f077fa4b337d41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678432, "uuid": "9ba5116f-d8b1-4db7-b3d0-582ad95e1e36", "comment": "Malware payload (SnakeKeylogger)", "value": "5763726ee7d7517ca641f21d94f47d59394efd7d415ba2de4210d750cec19723dfb7f2406a86186e8c9f378d86c47928", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678432, "uuid": "da2ba807-84e4-4c76-9374-6e4de40cd8f6", "value": "T1A205D0507278DB02EEA48FF5101161914BB22E6BEF68F3641C86B2E71A73BD13E50E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678432, "uuid": "83e9cfdd-4046-46a4-a498-9c9aa410f1eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678432, "uuid": "52f91341-55b2-4e73-91b2-6ab479b9ee1f", "value": "12288:GPr8kyGy+ysPQzjkATGds3MtEwcU3gZ+Cy4WgzEfTkcrp3dNTrgHZ7rWu:y8kyGyOPQzlGI6AAgZvWgzCTkEtBgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678432, "uuid": "71d5f104-38fd-4f1e-801f-e483ee20cce3", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678432, "uuid": "6402712a-e49c-4146-b929-a5166bc25746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678432, "uuid": "ab3da9f2-870d-41a1-acdc-8106efc11eaf", "value": "Ordem de Compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e68b9b3-9cb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674652568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674652568, "uuid": "9aa65c91-2bc0-4c83-a23f-295e01d82745", "comment": "Malware payload (Smoke Loader)", "value": "db9a87fd2b95bff60eb9ecf45e6c6346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674652568, "uuid": "706d3b7a-2e12-4278-8410-c03eb1f60664", "comment": "Malware payload (Smoke Loader)", "value": "9c664f5b83efd0667e9590ce445621be356588b925c60f6afc36dfcd059772d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674652568, "uuid": "b91ed9b7-91dc-40cb-8d8c-6e39a2f0bb99", "comment": "Malware payload (Smoke Loader)", "value": "09027476b213e68a2c1092bfa57092aca2d9d910", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674652568, "uuid": "70d8eea4-c0e5-42db-b491-af688623bfb2", "comment": "Malware payload (Smoke Loader)", "value": "1c0ffa8bc5a5e4a545a0adb62da3ddaecf77e1064d347b71c55a9dcfb2c82f12d3d97eee5934962e3d9c56c1bf26b663", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674652568, "uuid": "dae7b6f1-f404-4dec-97bd-c32fae301c19", "value": "T15F748E02E2D8BAD1F599CA718D1EA7DC763EF8508D146766322C7A3F29703E1C12A71D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674652568, "uuid": "30861261-6a61-4dd0-9b74-f9a6da1954d4", "value": "787cd3f7e6d0161bfca0cbd92375e751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674652568, "uuid": "3b47a8bf-f29d-46b0-ac8a-1900c5cae16a", "value": "6144:icLwnedneiwNWwcL2jfi5Ojq7VWRFBMolz90ZR:icUnEneiwF6z7VWR5lzSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674652568, "uuid": "cb3f0391-39e8-481a-bd96-c14f1b56615c", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674652568, "uuid": "e22a3f3f-ca17-444e-bc19-9602f510319c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674652568, "uuid": "82e0e578-c03c-4f78-b635-022b6b47252a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25f9e66-9c48-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674607209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607209, "uuid": "15838179-f89c-4ebb-b127-9c272a5f1016", "comment": "Malware payload (Smoke Loader)", "value": "9fb6cf3c6b150052f272319937a42dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607209, "uuid": "84ee521f-16b3-4bec-a4fd-699fe1368876", "comment": "Malware payload (Smoke Loader)", "value": "9cd1ae6e301120154f99d7e20c235f2e07a56d7b9102474c1bcffe610f3a3cc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607209, "uuid": "67a96dd2-788d-4d54-bd44-444799ce8191", "comment": "Malware payload (Smoke Loader)", "value": "7ca8492a30dfed1bd860dcad855f9474f7a9ad14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607209, "uuid": "1df1ab8b-fea1-4e01-83f6-abe40c5900a8", "comment": "Malware payload (Smoke Loader)", "value": "0436d7dac95d2e69470245b23c91377745cce32e01add65fd1c4f1ca0fdae1dda52e74e068a4d0ea48eec16eafd1f28d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607209, "uuid": "1e5a7d67-da19-44bb-9ab6-2442767f032e", "value": "T17814E11276A0C072C0A7D1344870DBD0AE7AB97366D9898737980B7E6F707D25A3B397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607209, "uuid": "a56ff8fc-7db3-4644-9848-356e559488e5", "value": "5eb8e9ebd49d9ccce156e2e9eb6d0902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607209, "uuid": "02bbdb72-6503-495e-80a6-a25a5d5106e7", "value": "3072:7LBN2kgE7/O9L3Y1nxZ52Pq0AHTxAWtkDE6ejT/zX+DZ3Tj:71N9ML2nxQqRGYkDH8/zk5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674607209, "uuid": "8d0eed27-c9b2-44d9-8c23-c19607aafedd", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674607209, "uuid": "a0a7d26d-5056-417c-839d-ec7c39c3aa28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607209, "uuid": "45215c7f-1dd8-4c13-b110-a08a5af0ff0d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd6400e-9cce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674664781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674664781, "uuid": "515dfb97-3d12-4ae3-bce3-b753745f7eef", "comment": "Malware payload (SnakeKeylogger)", "value": "5344e37c86b3d841a58be30d101b9172", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674664781, "uuid": "b3420c3c-6b2a-4f7e-a232-dadebbb423e7", "comment": "Malware payload (SnakeKeylogger)", "value": "9cef746651b3dc0dc351663360dc8b614e4bd4d82b44ed13a212e988d2f3c072", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674664781, "uuid": "26160082-b779-4913-a8f7-3419777dd8c9", "comment": "Malware payload (SnakeKeylogger)", "value": "bd05b90d215555d814425cd1063a8196b970c1a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674664781, "uuid": "db0abf6c-01f6-436c-be42-2fd8a792f1d5", "comment": "Malware payload (SnakeKeylogger)", "value": "bdf841bcc46df9e480a0105aaa25fb572dd607e724f2cae72a6ecc7b4f88a87f9865faaea038851744a0a590abbc2f85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674664781, "uuid": "5f9ba33c-20eb-4eb2-8c54-32104cdb3456", "value": "T1C805D0507278EB02EE648FF9101195A14BB22E1BEF64F3685C82B1E71A73BD13E50E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674664781, "uuid": "4fa9f47e-b13a-4ad0-8c8e-5095df8e8a72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674664781, "uuid": "42bdc853-c35f-4468-bf8a-5994c561837f", "value": "24576:t8kyGyOYQzlGI6AAgZ5KwJSXqfejQP+xyTAWHt:t8kypOYjI6A1r8XKmxkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674664781, "uuid": "73a901d0-53a2-4af3-a70b-c2afa70e4a05", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674664781, "uuid": "1f755c04-07d5-48db-af0d-41e44611e70a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674664781, "uuid": "bf992e13-6e51-402e-ade7-710ddf0a9b1e", "value": "5344e37c86b3d841a58be30d101b9172", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f652a87-9cd0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674665535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665535, "uuid": "2aa5ef2b-fbdb-4a9f-98b4-362e148bf1dd", "comment": "Malware payload (Smoke Loader)", "value": "80f6f796e1b7989421b10efacb5ca9f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665535, "uuid": "4922c1b8-c223-4f9a-8d21-8d032c752328", "comment": "Malware payload (Smoke Loader)", "value": "9d0b6607401e3aa33378bff1f520e36438661628c74c4f2f6ad1ed380e0cf2b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665535, "uuid": "b0eea216-a622-4398-a6e0-e8ecc3e217b6", "comment": "Malware payload (Smoke Loader)", "value": "691df2fd9a11521e682917a47d037e1e4de5d89e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665535, "uuid": "67dee1e2-76d9-4d5a-81e7-045cc0c3f4cd", "comment": "Malware payload (Smoke Loader)", "value": "885641fc7d67c690c2ea3f4769e9ad5abef9dc28a389912c767a1ce25e473cd05063e4ce8742336ab63b97a5358fd2cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665535, "uuid": "6fd794a9-06a4-474e-adc6-0a3504a750ea", "value": "T15064AF2672D0BC50FB1A4A358D2ADBD4792EF8F28F3C735B32D4A71F19722A1D126215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665535, "uuid": "7599e8a3-b94d-4b57-8fce-fc3918ee32a7", "value": "8ec76f5c59a9f0c161f9365e55dfcda6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665535, "uuid": "15ae1dbe-b787-45c0-8f53-df42913b3c68", "value": "6144:9gLRk/4s9rLtWPdwGtHz8qwxWb/4O8b60+MOKXCmUTx:9gFy4sBhXQT5wxWbgOdWVUTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674665535, "uuid": "4271452b-9816-401c-b3f9-1fe5f625524d", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674665535, "uuid": "aeed9a5c-e5ef-4baf-b32c-d80dcd0520cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665535, "uuid": "ebd60c4a-37ea-4b76-93b4-251decbc83fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd082a9c-9c51-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674611066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674611066, "uuid": "017efef4-9639-4c0c-bc1c-6e701100ef04", "comment": "Malware payload (Smoke Loader)", "value": "4bfd996b26450bd25997c900c23083c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674611066, "uuid": "979b7c54-a0fe-469f-b756-61d15569ef3a", "comment": "Malware payload (Smoke Loader)", "value": "9dbedb0caaa6cef3b8fee39d573f47cc6eac02174cc8b4db23227f51d6efe277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674611066, "uuid": "0908ce5f-eb9a-492d-966a-a61f025b4b6d", "comment": "Malware payload (Smoke Loader)", "value": "9e72f42d7aa5fe4864f029cd23aeac2a22c09cbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674611066, "uuid": "9bb74b75-3b3b-4fde-bb80-39c4e284653f", "comment": "Malware payload (Smoke Loader)", "value": "2e977e04ee19550124f0eb77a9b7b9a5eaa9902ae919d69364fadaf0dec394bb476e97ce2fefb4315a32ed0986ee19c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674611066, "uuid": "794a89af-64ad-4dde-bf0c-fdd196943b53", "value": "T19414D0223A60C073C8A645345C6CDAC4BE79F93357B58C8737980ABE5F706D1663A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674611066, "uuid": "0839a582-e8c7-4d53-bded-61ca8078158b", "value": "5eb8e9ebd49d9ccce156e2e9eb6d0902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674611066, "uuid": "b46202b6-eae6-44bf-9bef-89bbdb2c15b7", "value": "3072:mLBN2IKro7fLfo838uSnql54tpMuHjvpeD9/xc3cdpBxx90wcXoelrHzip:m1P7LZSnq6ppDvgWMdpB90wCoelrTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674611066, "uuid": "b04dad0b-03e6-48c1-a96f-8de190e48927", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674611066, "uuid": "e5d0e3ed-0bcd-48ef-a692-5ad111fb9837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674611066, "uuid": "79ab4729-c2f0-47f5-9206-c7ef2f370501", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1430b52b-9cac-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1674649840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649840, "uuid": "9c3c825f-5e79-4612-95ea-455857dda22d", "comment": "Malware payload (VectorStealer)", "value": "81d8d0e132cc1fe211b6f16a92e135aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649840, "uuid": "4ee888d1-1ade-4576-bb09-c19305aeb72d", "comment": "Malware payload (VectorStealer)", "value": "9dcb2a2b604e475d5cfbb2c3e3a87a74ff91336173e9ef5edfa14a26402709c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649840, "uuid": "2c3511e5-a0b3-4f47-87ed-058b6106607a", "comment": "Malware payload (VectorStealer)", "value": "985e43ecf4aa037c23cff2d759f1f2d24e1adbf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649840, "uuid": "f4d7d598-01dd-4c9e-a1ad-30acbf6f9c52", "comment": "Malware payload (VectorStealer)", "value": "981130bcc78273e79a762aba9c776f06df176782e159d21920e22d0bdd3c13a873c4e48e3c0c19c548b88eef8dcfce93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649840, "uuid": "057a39e4-3984-479c-8a72-bbf0bbd7aa48", "value": "T1C3452256EEB2EF34DE24113F8741B6218E2F0E9581F0798E7509B2762EFDC41D4127AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649840, "uuid": "8ee636a9-dbf7-4054-8d0d-9abab9e750ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649840, "uuid": "836530b2-7eb2-4cf0-bf9d-824f0c92965a", "value": "24576:FZEbyAkdLTLRBoTTB+DeU4FxgsilaxUA1Cm0f8vt/0Nd:FzLNY/gLlar1F0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674649840, "uuid": "274b8567-74bf-4941-9ce7-bdce4ed3846e", "value": 1204736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674649840, "uuid": "362b1be0-514f-42fe-9e58-f6f9869cb02f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649840, "uuid": "492287e9-d369-45c5-abf6-cd50cdb40490", "value": "QUOTATION#012523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e6fc31-9c6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674622845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622845, "uuid": "1b80605b-bdc0-47e0-9711-675ac1bd6cd4", "comment": "Malware payload (njrat)", "value": "f3b59a2311d2d8efc7b0e4dd0b5f8436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622845, "uuid": "f5a84cc2-42b5-419d-83d2-ba8d613a2286", "comment": "Malware payload (njrat)", "value": "9e9c786810231bb2222be822fbd43e21a02af06b96c6c7dd17f2275279eb63e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622845, "uuid": "7f01ef0f-b5ab-4708-9a75-42f6b3e50025", "comment": "Malware payload (njrat)", "value": "c2c5661db62307b974b9ccef3ef37ed1f265fabb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622845, "uuid": "79693cd8-26b7-4c0d-8900-70c0e7bb1f39", "comment": "Malware payload (njrat)", "value": "c13ed8f3dba11f97694a384d4c70c5c2c8b487a738874c6c30ace2d9c1e0b62ae2718aed88cf673594f116ba8ffb619c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622845, "uuid": "06882fd0-6061-4191-92c2-6fbf3540d75f", "value": "T18134F99AAD018E07C3FB21F2AF50D5B231291D767B61583959B93E3B32F8C879785720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622845, "uuid": "3a925c0c-45a5-48f7-be22-c621d827c2f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622845, "uuid": "808ad669-84f5-45f7-8bbe-f381835c565d", "value": "1536:K4RPnYi9b7iyYa4lmIQ1U3Ox7eD3Xaaaaa3aaaaaaaaaaaaaahNbd1EhDOLs/t2Q:K4PYi9bGVJlq1U3O9eSNbdiDOnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674622845, "uuid": "c245c569-6bb6-4083-be0f-636c299a0101", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674622845, "uuid": "a6bd8f90-0188-4c02-8e61-fc6cc8272182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622845, "uuid": "4dbe08d5-2532-41b9-8b63-e0db5cb02ed2", "value": "9E9C786810231BB2222BE822FBD43E21A02AF06B96C6C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9888bd-9c6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1674622316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622316, "uuid": "a4279a74-d9c3-4db7-ad12-6ab136d14ff7", "comment": "Malware payload (RemcosRAT)", "value": "0a0b11e6b7cbcab7fb1a4c68893fbbbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622316, "uuid": "49817a54-274a-4b76-820c-45569d3b7f7e", "comment": "Malware payload (RemcosRAT)", "value": "9ef247402ff781f7f8c5f01d6e611d2e2350e2a421530e1774d3cc4050637540", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622316, "uuid": "32b368b4-d500-41c2-97da-5cd65bd7ee86", "comment": "Malware payload (RemcosRAT)", "value": "d90db234a23674548ce04f02c9e3abf2aea025fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622316, "uuid": "b350ce3e-36f9-471b-a5a9-4568345f457f", "comment": "Malware payload (RemcosRAT)", "value": "a55cd9fb8336d511c67deb94b4e003ef820eec4051c03a43612a9df46e5da83b2809b359f6d8ee710f0fd23385643657", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622316, "uuid": "afe42cd2-4522-4cce-91aa-73deb75a5f28", "value": "T148F1D801B3AC8235EDB20B725C7753505778EB4198678F2F68A4B10BFC166868962B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622316, "uuid": "18676696-2509-40ca-8e41-ec15688ecd0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622316, "uuid": "07fa28a9-cbd3-43f0-947a-df38299e62e2", "value": "96:zoqpKge6jUa73ifvMKYqD5nYKLWRlvAkOD1TIoDB/ewuW7UWwWzNt:Awh73QvFYC3LW7vR0D0W7UW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674622316, "uuid": "d6536fcd-e4a4-4b00-923c-b18fded71092", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674622316, "uuid": "5a30614b-3778-42d1-be18-c4826f556a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622316, "uuid": "24b68929-19a5-4a1f-95c5-dc5eb76bf66c", "value": "0a0b11e6b7cbcab7fb1a4c68893fbbbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebcc88f4-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674678978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678978, "uuid": "f6dce1e0-9e63-4fc3-8a72-70519904cf60", "comment": "Malware payload (SnakeKeylogger)", "value": "018386ba4e4d173eb0bbf9e8e311c5f3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678978, "uuid": "009975b2-f8ed-4095-87a9-7d91c0289e08", "comment": "Malware payload (SnakeKeylogger)", "value": "9f01959edcca8c6cf51eb06f6b338b97d0efda2d965656e318e888f424930e69", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678978, "uuid": "e8fcc4c7-1f78-4503-931f-c123c4b376c9", "comment": "Malware payload (SnakeKeylogger)", "value": "012533677da0b18348d4c458ed79aa2aa9ffcd4c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678978, "uuid": "3047cfc3-f3df-468b-9ad9-1457ead304db", "comment": "Malware payload (SnakeKeylogger)", "value": "ef81b21f6da4658d63e1d7817caf48535c84c5befd056e1d16b22c8548c46f16b4652b4e70b49123de0c5aad118652f1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678978, "uuid": "0ef5db8d-70a1-47c6-bb33-559b239d1858", "value": "T12B74D005B796D997F99313388893CA963329FC487F4246073B647F0E7CB16B04B2A799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678978, "uuid": "a668263c-2df7-4475-afa6-067c58cd1f8a", "value": "6144:hh0k5eq1h0k5eqnh0k5eOdh0k5eq4s9Z+RwPONXoRjDhIcp0fDlavx+W26nACW6+:hykdykvyk5ykgsS4DYRqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678978, "uuid": "4c3ea210-7d11-422b-a639-f74f57aa50ad", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678978, "uuid": "7d8af361-91ac-4024-9f72-aafdf0ced3d0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678978, "uuid": "2a24524c-f24d-449f-b0fe-388e0ebe1c98", "value": "Product List.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe6de75-9cdc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674670818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670818, "uuid": "93dda2e8-ca9e-4783-b348-21e31744e364", "comment": "Malware payload (Smoke Loader)", "value": "0fe09eef2b67fe7d0e7504b06942e86b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670818, "uuid": "677cf555-345b-43d1-8c41-4885931fe41e", "comment": "Malware payload (Smoke Loader)", "value": "9fe9ad299ba15cdf412710731def58f5622a0b996f334f5e6a70c9e079b8cb83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670818, "uuid": "8df91150-f119-4a85-8887-540fe6348ad6", "comment": "Malware payload (Smoke Loader)", "value": "82058a4d83daae5801a95fe580679ec5074cc9da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670818, "uuid": "59c10c3d-7d5e-4026-bcce-c59011bcd367", "comment": "Malware payload (Smoke Loader)", "value": "795a67799d91c659523ab5b3e4e486a429a057a43a82eb7fb608a8517397a4b1661681de1c652f8b4b0a2ab5a32d5d07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670818, "uuid": "af1e03f3-96b0-4de3-b2c0-de6883707043", "value": "T12664BF1276D0B860FB164A35CD2ADBD479AEF8DA8F3C337732C4661F29732A0C566215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670818, "uuid": "babfc433-9683-480c-86c8-59957404a00f", "value": "8ec76f5c59a9f0c161f9365e55dfcda6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670818, "uuid": "edace304-39dd-4805-bd5f-557eab5cf0f5", "value": "6144:D+dSLBF6Ui/CsCWpyDSS3ifoII0+MOKX4VUTn:64X6tVpuSSyfGWMVUTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674670818, "uuid": "e0fe23d5-7500-44e2-ac7f-a6de6c0fcb97", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674670818, "uuid": "f05ac610-2374-4484-9c3f-fcd36ddef9cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670818, "uuid": "adafdbd4-1ba0-44a1-b67c-8c4f6d202cc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692032d5-9cb9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Shikitega)", "timestamp": 1674655566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655566, "uuid": "7dbe9d54-91eb-4b03-95e6-8e0e30a693d3", "comment": "Malware payload (Shikitega)", "value": "997c9f285c57a5e808cbfed36443d23d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Shikitega", "colour": "#C8F58F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655566, "uuid": "5cf79a0d-0ed7-4963-a238-732cf91caa52", "comment": "Malware payload (Shikitega)", "value": "a01a676d674665bfc15a5f593b135957f0585e9d16919ab25ae2103912072f89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Shikitega", "colour": "#C8F58F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655566, "uuid": "6b8f7228-710d-475d-a853-5be472d1cd10", "comment": "Malware payload (Shikitega)", "value": "f73a6d5d17c51abbd47674e4ca2dcfb4aadf735b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Shikitega", "colour": "#C8F58F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655566, "uuid": "81417849-109f-4350-a4af-12c19f197f98", "comment": "Malware payload (Shikitega)", "value": "f36d5681b44cf813673d0cb9f4e5c26fa4bac7a557907c856cdcc434fe2550a91f57e42026502c97b4ab424b57f87572", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Shikitega", "colour": "#C8F58F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655566, "uuid": "0913b2bb-8253-42ec-9551-fe7e91182f19", "value": "T13921E75A4303586FFE00C63A279B0FDCA62027C10D0E892062EE7A3ED8C444AA907324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655566, "uuid": "a7b88ad7-129d-49cf-8f95-f733d96057de", "value": "24:FllX6wlcJbmOmq3K34YnjTtUdvpWk7bOyFKXTaFAw7aXSI7icZTMM8cIBw:flXqJbmu3K3TnjTlk7bOnXmDaXD7/ZTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674655566, "uuid": "33afb9be-e118-478b-b05d-dfedea7fb51a", "value": 1266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674655566, "uuid": "20500f8b-d296-490b-8794-256a2aeb9355", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655566, "uuid": "30f025ab-bf5f-4d02-b332-1ae1f751dc42", "value": "pwer", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5512b0e8-9c49-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674607429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607429, "uuid": "cfb8853c-f3f1-40c0-98d6-4a7ca60c911f", "comment": "Malware payload (Mirai)", "value": "732e9f8620de0421092d98104dafb3f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607429, "uuid": "baac1913-b0a0-4691-972d-fe3daa03c7ee", "comment": "Malware payload (Mirai)", "value": "a046332332e07fa63e8289b1adf46e1b61000788e16fb855381ceb54c5219911", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607429, "uuid": "6fc03b88-1e2d-436b-b147-d0971702665b", "comment": "Malware payload (Mirai)", "value": "ae3724cf7a43055e9a8bc430c95070dfdd4ed1a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607429, "uuid": "3ed0df60-ea11-4416-a523-42ae0fdd29f3", "comment": "Malware payload (Mirai)", "value": "8bb41dae8718f98ea46a74e5d7e1eff10643e9940e0084b1be163b6699486d693d8f8731c1f17ebffeff6c2cd667db7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607429, "uuid": "f698c045-a76d-41c0-80f7-91c2854ce7fc", "value": "T11C53A3067F610FB7DC5ACC3309A91725298CA61A61F53B37B934DC28F64F22E15E38A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607429, "uuid": "b229b679-5ccc-4783-8a95-fc7388041d8c", "value": "768:REH9s5tUHuYjcvIyQyKLbjOeA8e1eUIeIYGWZd5NtXijl49Aooo6:RYs5tUHTcAz++sJIxTWZd5Ult", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674607429, "uuid": "3c36c22c-f3e2-499b-8aff-e13d4d988e33", "value": 63652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674607429, "uuid": "f3297989-7c36-4290-8d75-7b20fb332132", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607429, "uuid": "6a191fa0-d3f5-43d3-8145-4295e0d85e2e", "value": "732e9f8620de0421092d98104dafb3f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0662ae-9cb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674653366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674653366, "uuid": "156e4add-c8de-4f47-b0a1-cd0509387ebe", "comment": "Malware payload (Smoke Loader)", "value": "fedc0b38644311331d10c7774d482467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674653366, "uuid": "33d917a8-3e1f-4828-b0d6-31ef9d618d1b", "comment": "Malware payload (Smoke Loader)", "value": "a0bde8c464aab2236721a405f690d8de30165a23be23926eb67733e187f6e943", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674653366, "uuid": "183c4727-f769-4315-8058-68cd653bd075", "comment": "Malware payload (Smoke Loader)", "value": "8f3c442965bb116ceb29caef6f7b3adea1fe679f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674653366, "uuid": "0a099c79-1dd3-4565-83ab-b015d829c203", "comment": "Malware payload (Smoke Loader)", "value": "eb15a3536d7aefaeafad952f5013f948771efae5ced2f69c1defb776ccd7b58b7417478cb857761e63ccbb38382eb147", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674653366, "uuid": "31c92e52-1c05-4459-beb1-ae83b2b0dcad", "value": "T1B9649E92F2A4B8E1F51ECA33CD16DFDC767EB8404D146676322D7A1F29702E0C96A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674653366, "uuid": "68a7ade1-b460-496d-840c-bedba3adf324", "value": "8f16ef841269728457dd532b4a807550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674653366, "uuid": "eda7067a-15e2-4e2d-94bf-9ec95aadaa04", "value": "6144:Y8qLMmaQ2FYCeSzyPCrqEF8I48Sq0VvRFBMolz209w:K4RQ2inhKX0VvR5lzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674653366, "uuid": "3d8a371c-e5e9-4bd4-89d2-e3ca141085c3", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674653366, "uuid": "1b105b32-cd10-49f7-999d-9e4503a2ff9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674653366, "uuid": "f38dc991-350d-4727-856f-305f30036a00", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e7421f-9ca8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674648125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648125, "uuid": "389ba891-5dbb-4143-8d1e-5fbc0b6e21d6", "comment": "Malware payload (Smoke Loader)", "value": "9ffb30d2ff8f04cf809852e991bd3220", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648125, "uuid": "e6fa0255-b59b-40a3-94a9-dde87ddb7401", "comment": "Malware payload (Smoke Loader)", "value": "a193f36bad6f817eaeefc8cf71b560908f9aba7c1edb0ddb19a98bb73649c370", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648125, "uuid": "796de7e0-eb9c-4e17-85e5-dae48e68c885", "comment": "Malware payload (Smoke Loader)", "value": "5d0b09054cfaa20f1448940b2189da02dc0241b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648125, "uuid": "5a1576f1-3dce-4ad7-8fd1-7313ff78b87f", "comment": "Malware payload (Smoke Loader)", "value": "a2139c089155a3a02e93ab19dfcbfdb503071c96293a0d6fd3f3ff9753b1b36be6b88f01c8bac69764bcb1526e15d4ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648125, "uuid": "8c39400e-83fa-4b3d-899a-03423a247fee", "value": "T190748E02E298BAD1F599CA318D1EA7EC763EB9504E146325323C7A7F1D701E0C96A71F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648125, "uuid": "1617c05e-4660-4756-b459-60115f8c734b", "value": "787cd3f7e6d0161bfca0cbd92375e751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648125, "uuid": "243abe7b-0d7d-4324-ae90-2e24eefd3a39", "value": "6144:5LNhegZFxr1iSiQIgVN3hfROjq7VWRFBMolz90MmQm:5RhxhhSgLRT7VWR5lzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674648125, "uuid": "368302cd-5565-46cf-a1c7-caa84b7cf829", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674648125, "uuid": "da9572a9-194e-4cbe-9658-fe4951cc7265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648125, "uuid": "9cb0dacf-ea5b-4b8e-8c88-34914f627cb7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3aec30-9c49-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674607419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607419, "uuid": "b68ba02e-e7ce-48a0-8d86-accce3b3299b", "comment": "Malware payload (Mirai)", "value": "66fe4ea193041035ae6fbfe56c79d1cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607419, "uuid": "8f133510-b2b9-4add-9644-ed985713c7f6", "comment": "Malware payload (Mirai)", "value": "a36bbd688e1cdeb7bbc3067bb8ce3526e22bc463e6ec2bd4c003145a60755b5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607419, "uuid": "ea3b732f-3edf-4f4d-9c5f-355be6cc6dda", "comment": "Malware payload (Mirai)", "value": "f6059901e659bc827d9e5c7f0c13791c7de84d6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607419, "uuid": "0afac23c-3a06-4c30-8348-5595e88fae2a", "comment": "Malware payload (Mirai)", "value": "9e4208614ba1aad8bc987f313d69513739eb9d29514697c2aa6ee5249c4b121223d334a9997cfe8a28829458b00dfd5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607419, "uuid": "38dbab14-0bc0-401e-8b1e-5a86e437cb77", "value": "T1E32319CEF4427C2CFB1FEEB954D60A09EE60230261831B26536BFDA35D33165AE52D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607419, "uuid": "8e556b9f-3dbe-4708-8239-94f29b55b90c", "value": "768:18eeBZLndiiG1MHn8XPmBPGRk6iDrBbBbBbBs:fQZTdiYn8X6PGRZiJddds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674607419, "uuid": "ce9076f1-9048-4f36-8ddd-9987fa54df22", "value": 47192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674607419, "uuid": "aaf524cf-5c03-4945-a48a-e4f397500533", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607419, "uuid": "4c5886c5-df18-4e24-aa9f-1d3713d0f588", "value": "66fe4ea193041035ae6fbfe56c79d1cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c831c0d9-9c79-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674628238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674628238, "uuid": "ab74fad4-9928-4013-bbee-4ede9978a285", "comment": "Malware payload (RedLineStealer)", "value": "ff9b911a6f2ae86a843158ad0c15b155", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674628238, "uuid": "a81311cf-a7a7-40d7-a23a-3cbf5be5bec6", "comment": "Malware payload (RedLineStealer)", "value": "a3aea103b419665bacda87f8752ab1ebde31ef6b692a5ddaaf08122487deed2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674628238, "uuid": "db793a1e-6b45-4aba-abd4-83f4e26a0f04", "comment": "Malware payload (RedLineStealer)", "value": "99aa8cf544e70fb1503085728811411b8ad8e32f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674628238, "uuid": "1ce3e1a4-633a-4fed-8c41-482737cb7da6", "comment": "Malware payload (RedLineStealer)", "value": "2153b901fc5a83011f41cfa13b9f1b886e21c8dda86940869b1f80e321956769759196399b6fd52149e36f18ccb198a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674628238, "uuid": "574d9464-3b47-496b-b003-5aecdce3de15", "value": "T132748D02D298BAD1F59DCA318D1EA7EC763DF9504D146726322DBA3F2B702E1C52A31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674628238, "uuid": "a59d6408-7cc1-4019-9937-94e7b9b16e0f", "value": "861af707b319724b1132a7a971c54bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674628238, "uuid": "85cf6ccb-7238-46d3-b659-4cd67a03681c", "value": "6144:jSvLkpambuzBVDP7yz4J5jq7VWRFBMolz9055:jEmamKNhyzF7VWR5lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674628238, "uuid": "8e4a14c3-55c1-4375-a96a-c3ea8a1a4ccf", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674628238, "uuid": "d478bcfc-1693-4ab0-bdf9-54444c76623c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674628238, "uuid": "99f4ab77-e0a6-4a7e-b97b-a57c65ba090f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88828396-9cc9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674662491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674662491, "uuid": "37fb59c7-71ab-41e9-8c0f-674f3803a7ff", "comment": "Malware payload (GCleaner)", "value": "ee2a3a34fdf9be21617459a5cc52e105", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674662491, "uuid": "ff44e5b8-9cef-43b1-bd37-75d73e9e5320", "comment": "Malware payload (GCleaner)", "value": "a3c140385289d3b244beabb9db43a3be371adabfccf8a4bbeecc1bbec0eeefcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674662491, "uuid": "2566be87-468f-4f89-888a-8005c6523bea", "comment": "Malware payload (GCleaner)", "value": "cae385e94c272c1bdf23d560b989f152835dce3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674662491, "uuid": "3efd800a-5edc-47f8-a02d-1785c692a817", "comment": "Malware payload (GCleaner)", "value": "65e5a8b4f8d07a48c00bad0cf5becc84da2df3c164ebfbaff56e39bd23dd79d659032207deb73be287425bcbfee2679c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674662491, "uuid": "b65b26dd-21ca-4ac8-839a-0a920b4e535a", "value": "T1868533894617D4BEE063DE78582B52045FF27533027436A438CE329E0E73A75E92A77B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674662491, "uuid": "96eaf2bb-b25e-4c39-8a38-eaf21c07b8ca", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674662491, "uuid": "f7fe2126-28c7-4acc-9c98-1ff35ce322c7", "value": "24576:Z35ovcvIOjR0/vaJMSLiUZT0YNWPrggTvS3z47HFZL25DYQgRySn2BseBLC15wvV:Zoca/vc3o8grggTKczK+GZLCgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674662491, "uuid": "14a9ae95-b8f5-4704-a7a7-c976bfbeefcb", "value": 1797515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674662491, "uuid": "923365aa-1a89-431d-9b38-df849f99178a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674662491, "uuid": "a36b9d1a-ace0-442b-a94b-d97416966f5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1690bcef-9cd8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674668742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668742, "uuid": "20765710-db21-49e2-ba02-b9ab7dc950bb", "comment": "Malware payload", "value": "7152eb1daf33e8a9eafab9df36e26953", "object_relation": "md5", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668742, "uuid": "77fdd364-52f6-46c9-b858-abf02d58a296", "comment": "Malware payload", "value": "a4856a672a0058d1996a165e09a08d5047548e2de66fd10cf7399cc304d024c2", "object_relation": "sha256", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668742, "uuid": "50bd7a29-d410-4e33-98dd-1a4c2e080881", "comment": "Malware payload", "value": "12bf8aa36a1b1bb7cde32361a4c65077f36b8d7f", "object_relation": "sha1", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668742, "uuid": "21be60df-b112-4b00-a0da-b73aa939f36e", "comment": "Malware payload", "value": "8774be8b78eb3cca9702e2e1f138e627a033ab9424c37f71cf98af3a1faf218f12b97c9e181a7308f8ee320f777e71e4", "object_relation": "sha3-384", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668742, "uuid": "57519697-6506-48a0-8339-50077a163f79", "value": "T1266423B1C202EA6ABC7743692C8C6BC870ADE0C406AD54C476EBF1BF16249D613D5F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668742, "uuid": "6ffa0b5f-b682-48fa-9024-1f5378b43d6c", "value": "6144:VuzuUbZc2SCUbGqPHW2FRLSZ2aZpkWbN6upXnqjYA+myl4eU7u2vlp:rUu2SzGqPHdROYaXN6kXMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668742, "uuid": "99f4ddba-9440-49c8-bca3-526f6d8e14d4", "value": 314221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668742, "uuid": "39b903f8-7c64-4cff-b707-87e623a7b75f", "value": "application/x-lzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668742, "uuid": "5250ff23-33cf-4b06-b4ea-acdb2bdc409a", "value": "Scan-002.tar.lz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b2ae84-9cf7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674682244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682244, "uuid": "519fc56d-63c5-43ed-987d-0aa12cd15920", "comment": "Malware payload", "value": "6de7762bdd5347e2d2fcc8f2a934d209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682244, "uuid": "471e1fd5-d894-44c7-8619-4fa75acbba01", "comment": "Malware payload", "value": "a51b89ea32cf160e638b8903f1399d3b76a48fa912644405d9d2938a2c71fdc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682244, "uuid": "a41d4c59-0039-46ca-8a55-1fef8f545d20", "comment": "Malware payload", "value": "0e6d6b1ab77f24407d52fc03ccd8c2267caf6b20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682244, "uuid": "b4c679d1-f0c1-48d4-8567-8d310eb3ff16", "comment": "Malware payload", "value": "26fea1c7cd8228308e3193e8b64e70c1e4ee80b0157ea680d719a4c6f28e5195aaa2b905d3f0973f57af558f4a436b06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682244, "uuid": "90e46540-7865-4922-96bb-7d730ad4cc0c", "value": "T10985334AAA46D073C1938B3459258D069967BC307DB022A9744E0F7BAF35BC3B2DB753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682244, "uuid": "7fca6256-608f-4367-9b7a-a82dc5ba9b4a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682244, "uuid": "25e8a1a3-6718-41c3-b0e6-70950dc3677d", "value": "49152:Z6XHh7lMx9Ou2x71OAx3QKgqAVL89ki4gLCgv2MR:wHfMnO5OyQiAVLHiZv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674682244, "uuid": "13b82b9c-14ca-46a6-8587-b6dc00814085", "value": 1771614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674682244, "uuid": "6be4855c-5252-4664-af2d-0f059911cfa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682244, "uuid": "fec9300a-d162-471a-bccb-c2cda395cfc3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5faceab-9c8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674637227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674637227, "uuid": "71eb75b5-f40b-4d1a-ad9b-34b9305486aa", "comment": "Malware payload (GCleaner)", "value": "14e09c7a5842688842f6c0bf61c17135", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674637227, "uuid": "8036c883-a44f-4e80-981a-acb63e8b65a3", "comment": "Malware payload (GCleaner)", "value": "a5ce2c21d3f92080a06e0aa7862303848b2661181b279a2db9b72b8f31a82702", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674637227, "uuid": "de15ebf6-1d4d-45d6-8987-0befdfffba7f", "comment": "Malware payload (GCleaner)", "value": "4c9e1cbcd933293268c396b3c79f3836665059a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674637227, "uuid": "6d52cde3-bcc7-4206-857f-0146e4eec32a", "comment": "Malware payload (GCleaner)", "value": "5b5ce289181a51f5ccc4a735735d1ad9449aebef498aac7b546d515337c90ab7120b8e966b88a00ed2f5ee16de2ac42f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674637227, "uuid": "43158986-1bc8-436f-82be-5e3ce83fced9", "value": "T17885335282B1D4B9E293A77C3C33DD692ED3BA1961781024331E56CF1F277A2AC4E356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674637227, "uuid": "e4e5d053-c3b7-46be-a8b4-3115f5e6fb54", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674637227, "uuid": "4a236999-8cc9-408e-801a-798121d0c2f9", "value": "49152:Zj8WUqIwpfvQvBkF9PPeaPhUMewEgjkdLCgv2MR:98WxIU+mzsv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674637227, "uuid": "36c9fa94-0e95-49d1-be65-57c1712e22b3", "value": 1782938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674637227, "uuid": "a95ac79b-063b-4a12-ad14-a568aba6a06e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674637227, "uuid": "4f0bd98a-d80e-48db-bf4e-3ec45a3d12e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcb0309-9c44-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674605326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605326, "uuid": "6d506174-6c8b-49d3-9352-c1e3a197af86", "comment": "Malware payload (Mirai)", "value": "8f4b2d280e4df6b710c05748b0c9ac1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605326, "uuid": "89a69814-a570-410d-af7a-350560502c7b", "comment": "Malware payload (Mirai)", "value": "a6b1b4a251686026afa95a71f3c7087c1dcf064b3ccecf2162d6fd62eba14146", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605326, "uuid": "9842db90-bf78-4893-b755-f90692050a59", "comment": "Malware payload (Mirai)", "value": "fe5cd36273c6dca21512faebff2d7b22224f8201", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605326, "uuid": "da6276c7-0398-4c81-a42a-44fb332eee32", "comment": "Malware payload (Mirai)", "value": "629ca2fcf96faddef789c05cb15cad1f988cc7d8b7d7aa0444df29f29e8697c50849bed809eab0e95cdcd9d11e74cb08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605326, "uuid": "7d833443-d6e1-4505-bb44-fc0879972422", "value": "T1ABD3D77B271B1A27C0C9107101E30B31AD69DEDF74B95A9369E07D5C2F3A9843A92FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605326, "uuid": "fb940840-9b6f-4066-a7f4-4c9fd4c75e0a", "value": "3072:s1t/cTaHTJXNPskKcKOn3dimX/QMNq71nCcNb:s1lWqVlOetimX/QMNq71nCcNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674605326, "uuid": "0e0dd4b4-f161-4bcf-ab0c-ef686c3cb2f2", "value": 139092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674605326, "uuid": "9efd0d4e-e9e1-4c93-939b-12ad8e9644d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605326, "uuid": "a9b3aa17-f8dd-422d-bf3a-2e3a3b83ca7c", "value": "8f4b2d280e4df6b710c05748b0c9ac1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da069b04-9c4b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674608511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608511, "uuid": "af19dc00-d0e6-40cf-bc9e-8da08a5f0189", "comment": "Malware payload (GCleaner)", "value": "3dff463ac587cf08ec56923244ee5e0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608511, "uuid": "e8e9577f-ad0d-4458-895c-f7da679ab3c1", "comment": "Malware payload (GCleaner)", "value": "a73c06c2b1ce84ab23f5371c5093c84a70b186304a61c47d9b75e7f6b53e0999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608511, "uuid": "cbbc6b7e-d629-4916-b9da-b2a7380ffee5", "comment": "Malware payload (GCleaner)", "value": "8c85b561d5510795d0aa969457940bda44a423a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674608511, "uuid": "92f68197-5f50-41ec-8fb2-1e208256c863", "comment": "Malware payload (GCleaner)", "value": "6ed21e92ae26bb83c4521f09d6aa0a627516eb422d77bacb02444fff0cc7d4aadc93a07aa8e1819281c406bc46ebc8ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608511, "uuid": "e5b3eba0-ea93-47fd-8fc6-63f5f9020041", "value": "T1F08533166D6068F0D2339A357837A65494BB3C772334E646314CEF9F6AFBB4054AA30E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608511, "uuid": "b19ce422-3388-4f8d-877f-3145be333e4b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608511, "uuid": "4b14fdc0-0754-49cd-bd6f-36956df63eab", "value": "49152:ZXMWFgH7OGBGk7opVrQ+siK96cg1eqNZLCgv2MR:NTMD8jLNKsNQQ1v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674608511, "uuid": "53f3be16-ca25-419c-a8cc-76b428889b75", "value": 1766302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674608511, "uuid": "c1815c55-2e90-4c5c-8b7e-1935795313c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674608511, "uuid": "fdd0ec38-6d63-4f68-bb2d-7e4939a2223f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a921819-9c51-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674610793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674610793, "uuid": "d8cb3b41-9226-4e1f-9154-d968bbb8da8b", "comment": "Malware payload", "value": "88167052a74057a93e12673599451baa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674610793, "uuid": "791abfc8-27be-42ad-bd46-636bb6beefc2", "comment": "Malware payload", "value": "aa48acaef62a7bfb3192f8a7d6e5229764618ac1ad1bd1b5f6d19a78864eb31f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674610793, "uuid": "a4790e9c-aa51-4c56-9d29-2329aa3e7971", "comment": "Malware payload", "value": "88e3a57c8d8919aed0200c04b19e08660ca3262e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674610793, "uuid": "326a1bfd-5c27-4e58-adab-c526803f3813", "comment": "Malware payload", "value": "b5593fcd694b97ba63e37b79e47095d9fc4dbd9c59407f034c95b96aa713ab502318568f2a7d689ca73c238b09bd3653", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674610793, "uuid": "b95007b4-87e0-4a60-9172-4375201cf14d", "value": "T16E83022A735C9BC3E2D7CAB42223A8BE556D976753335005DD0D3FF10E31A83CA2A651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674610793, "uuid": "5283b971-2196-4e67-b0b1-8a0fae5821d4", "value": "c553bba1c16035e5b169e415278908b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674610793, "uuid": "277b1ce6-cd76-4bc5-b309-bd300ef26a8f", "value": "1536:NQamf3Yj6J94A32pIHFN2L66+cz5jZqJXJQPJBzuoTOHWRqH:6p326wA5T2LRloDUluPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674610793, "uuid": "26ab8f25-3e77-4380-99f3-625fce72a6c8", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674610793, "uuid": "8f714374-e8d3-4e2c-83f4-07633e58b1c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674610793, "uuid": "da96abda-a8f4-4d8f-9dd8-ad94f473c97e", "value": "aa48acaef62a7bfb3192f8a7d6e5229764618ac1ad1bd1b5f6d19a78864eb31f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436cf4e9-9c49-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674607399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607399, "uuid": "42187555-d349-4901-af39-b678652bb708", "comment": "Malware payload (Mirai)", "value": "579d9e01767a30e7d5727e0cadd5da7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607399, "uuid": "9a717a15-6b27-4ecb-ba63-b5214b7d8d93", "comment": "Malware payload (Mirai)", "value": "aafab6fd7b624d47b40a3d1b1e186140a66c8c0e67ddc82487da0fd67ada773e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607399, "uuid": "cfe2fc72-a285-408f-946e-6e4402d7e8cc", "comment": "Malware payload (Mirai)", "value": "34e8452c31d51fad70bb805e30bce3b53dcf85cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607399, "uuid": "4f14d5bb-1a58-40f0-8458-f0019a564c4f", "comment": "Malware payload (Mirai)", "value": "da6ad3d00dc0f008c2a732195721eafa2431d56a92b401433b8f361c0a9240fe0d56b771d1850ab0875ce7053f0d4660", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607399, "uuid": "5104cf67-c4f0-429d-82d8-605491acd1fe", "value": "T14033F112D27A2325E1A894FF2D7EBADDC110610F0940BAF6EFD0737AE461A79B2153C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607399, "uuid": "8c95880e-3188-43ac-80e8-390b02daef1d", "value": "1536:SZRj4VZIsyhPJKPnvYKanb+AXHj2gxjnouy8mqw:SZhOZIsyhsPvtab+AXHj2gxboutHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674607399, "uuid": "b9744289-73ca-4c9b-a380-6d944357976a", "value": 50428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674607399, "uuid": "5fb9f66e-8680-44d2-bf07-86de6d77c53b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607399, "uuid": "28418186-39e3-4eba-b554-65a36783f135", "value": "579d9e01767a30e7d5727e0cadd5da7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5155f5b3-9cf7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674682155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682155, "uuid": "764429e3-c796-4468-aea0-5328c1934550", "comment": "Malware payload (Formbook)", "value": "70c2bfb3dd7b6467020e6ca5d7f037a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682155, "uuid": "6c2135d3-4520-443c-8ca2-8edbcc1a8da0", "comment": "Malware payload (Formbook)", "value": "ab0b1f056d4030a9988c12df83064169e07f5cd2a9e7c51833ff057d2d8eedf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682155, "uuid": "59a2b596-e00f-4bfd-b51d-40dfcc840fe4", "comment": "Malware payload (Formbook)", "value": "3fef1cb454c1760936795c94f4504bf0f9ee00ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682155, "uuid": "5d2c36a3-2f25-4f04-a66e-f974960642d8", "comment": "Malware payload (Formbook)", "value": "6bf188f8b6e59e1b60e406ccc6fbcec8574667ed45076f977bb2ef40cd4957063eebed40f7a79cbd0c0532363a078e16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682155, "uuid": "9c167f7e-966f-4e04-8de5-a755f75b38d7", "value": "T1AA74131672B08077D8F34231DA3E5B073EE5922864E7CB678391ABEDBD67592840D326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682155, "uuid": "fce2444f-8159-44cb-a34b-e4fed7f943bd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682155, "uuid": "c86b19b1-bdce-44a4-818b-f805947b86fb", "value": "6144:vYa6TI+l4BN5yJ4PE7baks7hlP/WUC7NRXTLYaJqSSFvVDzqFGcGn13:vYB4BN4+87baF7XGUERjLYaJqXQGcGnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674682155, "uuid": "bb41dc9a-8b57-48e0-acd6-643113ea5c23", "value": 348698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674682155, "uuid": "7487dcca-6784-4eea-8b29-0751285ebf30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682155, "uuid": "b40c2606-719c-49cc-a740-b83b2f02145e", "value": "70c2bfb3dd7b6467020e6ca5d7f037a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3fcd22e-9c85-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1674633465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633465, "uuid": "3ed8fc00-113d-4334-887a-2a15dee45e11", "comment": "Malware payload (Amadey)", "value": "1f8ceaa3bc0f78c30512ffbb02065808", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633465, "uuid": "ee280881-5a9c-4359-b1c7-7e1264d3bfda", "comment": "Malware payload (Amadey)", "value": "ab597e47830049e2c4ff24a3b9c806d067bbd42250949d13a4255151858ae796", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633465, "uuid": "6bc5767b-5da5-4210-96b2-aefb70abea1a", "comment": "Malware payload (Amadey)", "value": "daf5c558e8e44e5b16056f18c1b005a628a22efc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633465, "uuid": "bc887eb4-af9e-41cf-aa7c-2f719a421a42", "comment": "Malware payload (Amadey)", "value": "1312ffcce1d9ab9403aa0d71715aacfabf08a04eff44166a87b7803438c452a1400a055370981441b3c5d7d0b9001ba4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633465, "uuid": "35bcdf58-da74-45e3-99cd-a837a78e9968", "value": "T19A95E1F1682F4A2CFBD3AAF63D10678F919DE196C1086566A797C6DC08172FF1E8490C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633465, "uuid": "5401f811-be6c-4b97-a20a-e21f8f3e7584", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633465, "uuid": "f780c3eb-7cb4-4c71-b707-f930b678f6fe", "value": "49152:YeN1ldB/30XIRMJsj6/Bt5gWHTdrd1pm2LubfQFlZgLi+4tP:n1ldB/2xCAHHJrd1pCMlZgLv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674633465, "uuid": "92e34efe-881b-47e7-9091-7158ea961b18", "value": 1999360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674633465, "uuid": "254ee46c-1218-400f-ab95-9d71ebf3f0e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633465, "uuid": "289392c2-7540-4a83-8f03-034d82efdef7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3718b0-9c8f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674637667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674637667, "uuid": "4f08b4a4-814d-4505-a01b-e65e441c1d8a", "comment": "Malware payload", "value": "e093b3b3a354ba9d3c0f0905727ea08a", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674637667, "uuid": "8b8923fd-3845-4b21-a5c3-01297e47ff88", "comment": "Malware payload", "value": "ab6565a03dcf834caf1cb29d32256452f587ef9c70abbf5a2d606e31c030f1c4", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674637667, "uuid": "3fc9e642-a742-44b5-97fa-af11b1e5aff3", "comment": "Malware payload", "value": "3aff98e847b08629a86c387469941c9fdaa89369", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674637667, "uuid": "75e26fac-1f0c-4eee-8d7d-e2584f8277b0", "comment": "Malware payload", "value": "b70681debc64e79d09716843f671e22e02842e40000f6108afd9b74e8a143862e7520b659fa54c05336d346199109b62", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674637667, "uuid": "def32343-577f-407b-9fad-70213f2cc0d3", "value": "T1DA2523994E3AAA1FFDE2C972656587CFCCCE0B99634838D00EB53645DFC6B6888119C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674637667, "uuid": "40b9c742-b2e1-464e-a8aa-305fb36f159d", "value": "24576:GjeG4p7cf/QzXB+729qGP2jHUkgZSxmn0pnQ7dQJjN:19p7wYZoHUsE7UN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674637667, "uuid": "407dc0a9-bae6-4001-bc0e-da950379fdef", "value": 1034296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674637667, "uuid": "7d6a09f9-957f-4ae7-b049-c02be10b6c5c", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674637667, "uuid": "d9ce4d88-54f5-40f8-b650-89527411ed73", "value": "PURCHASE ORDER.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05f5e8c-9cc7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674661752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661752, "uuid": "c6c0e794-1e6b-4aca-912d-171151c0f059", "comment": "Malware payload", "value": "8264724cc27343b2f3968df55319f1b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661752, "uuid": "dab06dcd-83bf-4e0e-9479-ade774bb78e8", "comment": "Malware payload", "value": "ac641f86d054faebc0834445865416e71323ef06f3fc8b4b872cac5107d17fc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661752, "uuid": "77597f8f-3233-48ac-b62d-b0d3c46a7817", "comment": "Malware payload", "value": "b4d36613a10a124e86639870a0e7b08ef5020c20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661752, "uuid": "1c66e511-585d-4a39-aba3-c7d7692256ed", "comment": "Malware payload", "value": "01787d348884a5b96d966789f717f565120786004c9e189e0070e981521feac7da67d2e9e5f0604cdf9c8cbbd4401b81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661752, "uuid": "70e5094b-273b-495c-affc-d3af03b1fb7a", "value": "T1287633203DE6C436CDA66E73CD486FECE63CA60659B6D42BB73456198FBE5C2C630412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661752, "uuid": "aef1c766-52d1-45b9-af1c-183431a4cd8d", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661752, "uuid": "d5dbe87f-201d-4b0e-925c-a4de0e47b69c", "value": "196608:91Oh3tYhJDYnvE0abqDnhS95m1MwjGvSBntugo:3Oh92DcvE0JjhXMwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674661752, "uuid": "e36a7ed9-57aa-4fcb-9a5f-d34c2614cf2b", "value": 7650780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674661752, "uuid": "3c6858ce-fd2e-43b5-b556-9aee47f50d00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661752, "uuid": "5b58f8bb-3385-4b36-8b87-a051cb9fb14e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09317cdd-9cd6-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674667860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674667860, "uuid": "6ccaff13-b760-427c-8e88-a01fc18256b8", "comment": "Malware payload (njrat)", "value": "c8f134a33554b94d0866d310f2b96026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674667860, "uuid": "0e90a337-5084-400b-86c4-736da8f67cfd", "comment": "Malware payload (njrat)", "value": "ae1f83032051540d2c0a651128b3f3383738d0ca5a093def884a6763613d1da4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674667860, "uuid": "6bcb3160-6e3e-428d-89e7-ddfac5c207a0", "comment": "Malware payload (njrat)", "value": "11a38d3a66ab527c507cb04f9970132137df20b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674667860, "uuid": "8b561d95-ddde-439f-b1e8-42477d1cd140", "comment": "Malware payload (njrat)", "value": "b600060d3f25fb7b73e5d12f1199fd1150206819a7f2a458673d77b8cf97c8cec766c963ab310c1a8b0441b9744114e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674667860, "uuid": "309be675-d152-45d6-8db1-d69f0c11e3d8", "value": "T130432744BFEA4A01E2BD8F3468F655150634BA63E532EB1F48D668DB17327C58C80FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674667860, "uuid": "4cb1cf7e-e0a2-4253-b2bb-a06f8080f5fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674667860, "uuid": "87d1075e-b09b-4035-8a5e-477e41e16d08", "value": "1536:OqZMDnE4uNhty4X+SChDVwsNMDxXExI3pmoOm:zMDnlIk4XohDVwsNMDxXExI3pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674667860, "uuid": "276daff9-9d54-46e1-9305-efa7e749fd3b", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674667860, "uuid": "56395cf0-f858-4623-af94-fe8cee177d59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674667860, "uuid": "88424f0c-cd54-4aa8-be84-49bbc09aa473", "value": "c8f134a33554b94d0866d310f2b96026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f658fe1-9ceb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674677078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677078, "uuid": "9d6006c4-06fc-44c0-bffa-d815c6ea7ef5", "comment": "Malware payload (RedLineStealer)", "value": "f609a6de8f309426086804c6d7ce532d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677078, "uuid": "9d881b4b-4efc-4078-91e0-0bcb1c3582ab", "comment": "Malware payload (RedLineStealer)", "value": "ae70016857b4335b736909a8faae4675b7b8f25c0af5c4341c009957728471cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677078, "uuid": "10752d15-9a3e-42d9-b5d1-364afc742b97", "comment": "Malware payload (RedLineStealer)", "value": "875ab3f4eb301b47c83e7fb791c25521d3fb3c06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677078, "uuid": "407c63a4-60d5-4a6a-b87b-62e9f542728c", "comment": "Malware payload (RedLineStealer)", "value": "4c98f7f5583a884eddfd95c1087b593bacbb82002d2ca80fb0b92247b4e3dc6bfc0da6293bd359ec82eaa125c0182c80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677078, "uuid": "49a3acb5-6cba-4a69-a219-fda3c56fd299", "value": "T16AA523F9E3C2C8D0F87B973C64156B211607FD06A8B8085FA9EE7ADC5733342155A86B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677078, "uuid": "77c57975-a3f3-49d9-9925-b3177653da60", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677078, "uuid": "ce0d8797-9654-4234-8d28-0715769db85f", "value": "49152:ST93Y6ni1SzH/ZJd1bKvpFJznfZZqhoS9rNEPsXat3c:SadQ/ZDEFtx0hoSrupt3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674677078, "uuid": "cf223225-c689-4952-9956-c8a9a7cc5a7c", "value": 2143744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674677078, "uuid": "07d2240e-59ac-4617-b7e9-b13f5873e1d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677078, "uuid": "5eab958e-0637-4af6-b451-ee1bf0ac424a", "value": "Promotion Instruction & Personal Referral Link for YouTube partners.docx.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a10e386-9c9a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674642280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642280, "uuid": "f6a15a96-34ed-4223-9e94-9c59531163ba", "comment": "Malware payload", "value": "774dc51d4da8bbc4e682008bf4d61aa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642280, "uuid": "dd4f32df-b82e-4695-b9c9-e37ba53f6d85", "comment": "Malware payload", "value": "b03d831a555a8366ac262fa9d13fde89b675803d41c57d36f07090a0cedab154", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642280, "uuid": "ee5e75ad-db04-4a01-bd33-61b2f2d6cff1", "comment": "Malware payload", "value": "0a12ab2bed3ce4e701e534df5c24bfef8dcc653b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642280, "uuid": "fbd50633-bdfe-46f5-b81a-354ebb9a1b2f", "comment": "Malware payload", "value": "6ca8373041d28409d6935221c1c8285a5296628309ccaf176b674b0d5e3ad796ca1ef75d28a589a942d473128d21edb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642280, "uuid": "6bc94c8a-1665-4123-9ae7-f133bd5b06de", "value": "T103E4273C09B826DAC97EF2BE6B84E4D0FE93805EB2658DDF4AD60841D54317226CBD1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642280, "uuid": "8350390e-e7c7-4373-a3ea-997b627a0f43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642280, "uuid": "7f675613-28a8-46f0-9bf3-f41964e14a70", "value": "12288:UF3gflcMVpRY6HxOVU9z+EHE1tKuSoNvXOTwYM0:z6MVpcUptU9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674642280, "uuid": "d416d2c3-ba1b-4b8f-922f-8e44b358383a", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674642280, "uuid": "36ffe23f-dab0-48cb-b156-eece618d24d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642280, "uuid": "944b2338-a00d-41d9-ae25-519d2b496aed", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f701e89f-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674678997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678997, "uuid": "6512d24f-be02-4832-bda9-4e157f312620", "comment": "Malware payload", "value": "1240893be5580817ce4469177b5763f8", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678997, "uuid": "bcfaf649-18cf-4431-a775-2fc29f88434e", "comment": "Malware payload", "value": "b057853d384f7d957d979753fa09674c116d085a99be6f4923484f02d256f26a", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678997, "uuid": "ec9beffd-b436-4549-9f44-7822dc937fef", "comment": "Malware payload", "value": "973750c0ad4fdbbacc908c9e486d74a21a687cf6", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678997, "uuid": "5a9cc7b8-013c-41ed-ab1b-9b95fb0dbe09", "comment": "Malware payload", "value": "0c0f4ca7812527c4242078242b222f25045afd5b823ae1f896772ab7db0063f54ffa3abb91946e3e755b4dfe964901e0", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678997, "uuid": "3354b874-08e8-4a5a-a826-29096c90581d", "value": "T195447D966B93DD0FEB9F80304CAF7BB4AB66D8019FAF81E36101E6158D3E941F385056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678997, "uuid": "4e9f0bf0-d908-42ab-b732-2c2efe84109c", "value": "6144:xxEtjPOtioVjDGUU1qfDlavx+W2QnAeRvnuEUV8iAYdhlDi8z:0WJNlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678997, "uuid": "1f101fc6-de79-4c4c-93c3-5f42ce821361", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678997, "uuid": "7ef0b91e-e491-4eb1-b0da-dba9fad7da50", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678997, "uuid": "ec750c85-f346-47b0-8381-d7425bc90117", "value": "pembayaran.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e4af93-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674678960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678960, "uuid": "ff647af0-1ebe-4756-b2b6-f2e77babe978", "comment": "Malware payload (SnakeKeylogger)", "value": "126520f17a6f1dc318dc0a1d6a00f74e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678960, "uuid": "4e854a8b-b2cd-4d8a-8a4a-16a3e553fb1a", "comment": "Malware payload (SnakeKeylogger)", "value": "b102fd4cda1c1699749d4ad8051cda332ff5c836fd07c5a8c0e0a5f75f49d477", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678960, "uuid": "80ded3a8-368c-419c-a822-089c0653d66f", "comment": "Malware payload (SnakeKeylogger)", "value": "a6730eb44acc8bad9dac7ac66894ed9c3f98212c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678960, "uuid": "011e7467-167e-4252-b9c8-816c41d99c67", "comment": "Malware payload (SnakeKeylogger)", "value": "75b0c280d9b7752f777b2015589c7c4c62f03d722ba297a7779b6f96f539f3d4b5f7f8211e1e1ad9077c4d85fd928b3b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678960, "uuid": "09bf9ef6-a271-4860-a671-dfec2e8e628c", "value": "T18874D009BA95D997F993033888D3CA963319FC487F42860737647F0E7CB16B44B2A799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678960, "uuid": "b4d0384d-15fe-40a3-a2f1-1b956f12c728", "value": "6144:gh0k5eq1h0k5eqnh0k5eOdh0k5eqRDZ+RwPONXoRjDhIcp0fDlavx+W26nApW6rt:gykdykvykZykZP4MYRqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678960, "uuid": "f421146f-b282-45b1-af65-c5871366672a", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678960, "uuid": "70ceb6cc-35bf-4116-826f-a394b1af6a6a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678960, "uuid": "6b9f860c-876f-45d3-94d6-5d1b5b3e7a70", "value": "Customs Clearance Form.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79d9111-9ce8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674675857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675857, "uuid": "94ddddea-a444-4136-aed8-a9e92e9cc0e8", "comment": "Malware payload (GCleaner)", "value": "c9723f696eb282803fccc08e90dfd655", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675857, "uuid": "2cc9a8d6-1a85-41f2-bf1b-ff026bf7d6a5", "comment": "Malware payload (GCleaner)", "value": "b11f4d0513f8394544e1b1244b6eb46c8219034afe039fd0dc891ca4f463f9f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675857, "uuid": "a89b24f5-8fa2-4774-b84b-5e0311ef5014", "comment": "Malware payload (GCleaner)", "value": "ee6a8cf44905c5d2d9d8e7c0151320b71c082db1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675857, "uuid": "0878997b-906a-4d07-bac2-d52391343816", "comment": "Malware payload (GCleaner)", "value": "fa3b39645dd0af4626bbd9a5b6921caefaa3d61bd969be2c0f3a31181f27f22ec6da6c733616bcd1318a68ba63d3d6bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675857, "uuid": "3e8d1858-b2f3-45ce-a76e-afdf43ee2d6b", "value": "T15784CF2275D0BC60FD294635CD2ADBD4396EB8D28F3C774732E4A61F29732A0D632259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675857, "uuid": "91933c61-28a7-4835-aff1-773c4c671b57", "value": "8ec76f5c59a9f0c161f9365e55dfcda6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675857, "uuid": "96e7004e-472e-421b-b1c5-a83738c5a944", "value": "6144:xaLZ2u6/RC5nUd6WfuMdj3J9EQ9DM6nX2B/0+MOKXMhMUTW:xa4u6/RC5nVW2eH4ZWYhMUTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674675857, "uuid": "200e6cbd-588b-415d-b371-76ab753c816b", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674675857, "uuid": "7590877a-9efa-4746-ad91-8f77453b3d81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675857, "uuid": "b67a6740-a3d8-4be4-8b68-75b2559cec6f", "value": "c9723f696eb282803fccc08e90dfd655", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecbd1a8-9c9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674642691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642691, "uuid": "d6f65dc1-f5b1-45e1-8d4e-901b93b47340", "comment": "Malware payload (Smoke Loader)", "value": "5348c31a3f41c19565ce702a47278bb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642691, "uuid": "ef418294-31dd-4d06-8a9f-151f257c8c3f", "comment": "Malware payload (Smoke Loader)", "value": "b1462d461fd850e3728e9c815379f7d5fe5029902125a7adc6a22ce0c623086d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642691, "uuid": "d689f481-9550-42de-a2e6-bf2dcd83d788", "comment": "Malware payload (Smoke Loader)", "value": "f3c5ca0d4ecec18f0d5ada603c6af5b979813c57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642691, "uuid": "fbc86a45-2f35-488a-9211-f7f3a6b66857", "comment": "Malware payload (Smoke Loader)", "value": "f07811f2f7d85f58f8d0f200cda79562a04992ef79f1a9204ae550a80bc08fa1c170b822f02cc534ac9b295ed015b0bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642691, "uuid": "3ff97416-33dd-4687-8bae-b895dfbd10a9", "value": "T16C748E02E298BE91F59DCA318D1EEBEC763EBD504D156B66322C7A3F19701E0C16A31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642691, "uuid": "754b3157-0fdf-4919-8051-a71327c4a683", "value": "787cd3f7e6d0161bfca0cbd92375e751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642691, "uuid": "d277c469-4774-4b89-8ab3-6c9317aa24ad", "value": "6144:GLOleIm5qNMEipEwRlJgOjq7VWRFBMolz90/9TP7m:GqlhwScjS7VWR5lzk5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674642691, "uuid": "fb186e69-b2f5-4fcf-b66c-b01e0d21e579", "value": 350208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674642691, "uuid": "b6be0e54-4cb9-43ee-9d53-c4fb9022f11d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642691, "uuid": "7b12b48c-14ed-4abe-9d0b-8cea1e854cb7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e29f530-9d04-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674687626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674687626, "uuid": "0bdc6820-e05c-4167-8c4f-fb43af9be342", "comment": "Malware payload", "value": "5edbb2f1e4b39be22f3698a280eb3738", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674687626, "uuid": "8a2a3229-d12f-4e3e-965b-89b54a5b0822", "comment": "Malware payload", "value": "b1dd593eb93468dce705736d8851059ccaf2e55a06b988e3e88fd51e861bc6c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674687626, "uuid": "f8a888b5-2739-4bb8-8c93-8695ff9d8461", "comment": "Malware payload", "value": "d3db3099ba9e8be9d731dbf7b75a7eadd9732625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674687626, "uuid": "402e42bd-8839-4b39-a300-d3aebcbde9c7", "comment": "Malware payload", "value": "fe6914b8061463c5f42939746420830dde6dcc2f5b87c9f751d27b90fc85b05e28edd7db9b88bcc17b8bd85046f89720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674687626, "uuid": "a6ed9087-4a62-4b6d-92f0-d2a61d5ea123", "value": "T1278533040A36C57ED2B25B7A4F1287E6FF773B31B7A0A245388C6A5C0F6B194A05FB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674687626, "uuid": "d4f7892b-7d76-49be-849b-c5f36fa40002", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674687626, "uuid": "91b6262a-fb01-42d2-8efa-22b79bd8cc7b", "value": "49152:ZXA32wC8SHCewMEFZCjaVxWrrHbFdl01LCgv2MR:hS2SwCewM2Z9VxuFdl0pv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674687626, "uuid": "c57da18c-ab1a-472f-91b8-d7fcdaf565ee", "value": 1787745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674687626, "uuid": "2133bcdd-595f-4a75-89d8-501e2bc87998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674687626, "uuid": "4181be51-3f79-4e20-844d-6c2fa0a2f386", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18e1368-9c44-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1674605436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605436, "uuid": "b8c566b8-4c95-427e-941c-a4bed488ea67", "comment": "Malware payload (RecordBreaker)", "value": "dc7cc50c125291da4ac092302a963968", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605436, "uuid": "745e8e00-b2e7-417a-835d-12e42fad648e", "comment": "Malware payload (RecordBreaker)", "value": "b1f823cfd5709646a7e5b37b2363d478495d4b9491af1a25046d93ec96012498", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605436, "uuid": "5adff337-1e01-445d-8609-c1400a9321bd", "comment": "Malware payload (RecordBreaker)", "value": "a2a75e1d17b713ff4579940dae50ddb481705ade", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605436, "uuid": "33d278c8-0b09-45f9-a740-ddfe90b19977", "comment": "Malware payload (RecordBreaker)", "value": "021f800f70d7031a015d683a8f2e603624f3183186a3f305f1e7f1a28652dffcc7a9e23255b1d68ef617dae850f1d666", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605436, "uuid": "b3b35e12-e9c6-43d7-9c88-c23b4e259916", "value": "T14C649D00BA50D035F5B311F44ABA9378FA2E7EA1972454CF62E52AEE57346E0EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605436, "uuid": "e63e4351-1b65-4564-9277-ae98c7bfe785", "value": "69d81d63bee9eed1a186b597b8130200", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605436, "uuid": "556d5a1e-9817-4bb2-934b-80ceab30fc6a", "value": "6144:Ex/87TLUhkGYTpC/v/NhEYR1na3ewRiY+ZqSq2BwnO:c8bILkQ3/NhEY/ndwAZZq0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674605436, "uuid": "bd35f21e-7ba3-4070-968f-46e5cebd8513", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674605436, "uuid": "7d31675c-1f37-4228-9c38-4de2108d385f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605436, "uuid": "03ed3baa-f9d9-4de9-9ab6-0ab7d2663650", "value": "B1F823CFD5709646A7E5B37B2363D478495D4B9491AF1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569171f1-9ced-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674677869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677869, "uuid": "135a23f3-1b20-489d-a767-836c7da418cd", "comment": "Malware payload (AgentTesla)", "value": "cb917d3ef2bf335cae9b2b4bdb2b6c07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677869, "uuid": "fbe68b97-fe37-4e32-8010-422562bf0fbc", "comment": "Malware payload (AgentTesla)", "value": "b2eb6157f4c7092f16d815e898496e27da66b2a7b69639fee2eb707bd7237a62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677869, "uuid": "b41797a4-7829-48a7-a4eb-309c06f77b13", "comment": "Malware payload (AgentTesla)", "value": "a506cb8cb7aead65d2ff40edad0265b31457c5d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674677869, "uuid": "2326b155-60fc-48bb-b541-6f40d3deacd5", "comment": "Malware payload (AgentTesla)", "value": "59b860c280b1181ea16e50836ce0a5c6aab0bf6d7d223259328abedf843b64d83ff0f8b8a4b60793d0356e4ec6c0903c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677869, "uuid": "d57caa2b-c93f-40cd-860e-42f8ea043d3d", "value": "T16905383D1C7793F2D474F97293E5A4A0BA9F4092B3A7C9A9C9D61BC04F422826DCE11D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677869, "uuid": "4c1f8156-f65f-4226-aba4-cb4358b73e21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677869, "uuid": "d06d7cfe-c366-43ff-bc66-4f181d1cfe6a", "value": "24576:IT8irmdjXHNOrAe/Iu8olr6SmirnqekW0ENZzl9re8F:Wlr6SH3NlGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674677869, "uuid": "4b997f70-ffb8-49a7-995c-bf8758ec1cac", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674677869, "uuid": "776cd2db-cc69-4950-aab1-16f9264fdaea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674677869, "uuid": "4410d2a3-ad37-42da-957a-f27dfb9032bd", "value": "BOOKING_SPACE_PI#202312712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860a603e-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674678807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678807, "uuid": "a075030e-bf04-40f7-83fd-23dd63eaa05a", "comment": "Malware payload (RedLineStealer)", "value": "f1354bde910724c6efa5bdd025827bdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678807, "uuid": "5c875c01-5b5d-4379-99fd-81f411686da0", "comment": "Malware payload (RedLineStealer)", "value": "b3d5ea551a96462e07797e0653ae380a9f9da71795bf7c1ed6bcecae77110e44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678807, "uuid": "d453a941-0741-4132-b5a1-99fd6a186ef7", "comment": "Malware payload (RedLineStealer)", "value": "6dfb6f8a0b10f9efd931d72ad13cc5b6ccf30a46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678807, "uuid": "f901975b-e26c-4bf8-99d1-5c5efff73802", "comment": "Malware payload (RedLineStealer)", "value": "48fe1dc42d50cdff37a13ad113c5e55a8b4aabd65972736251c80740c3db988c7fe65c9cc122420b6b2b57120ac0e597", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678807, "uuid": "f6c7229d-ecef-4d50-b24b-ae26e554f013", "value": "T18CB54BE23E06A5CFC2E9CAB45CF1AB43C519D292400C9686E597F439FE82FF7188655C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678807, "uuid": "55df5999-d0e4-4819-a879-a2d0743b5c6c", "value": "0757a8f986ddb3ab9e2a579b3f752934", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678807, "uuid": "c66b24f0-0793-4674-b8e3-4662242c7577", "value": "24576:u7vYc1xQOyMP/W50yO5oHmlve716oZOk9CP+8CcmP0TK7xfNCAf4IZAj9tspD7li:2YkQRKZOGX3OhvuKXttad3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678807, "uuid": "c25fff38-3b00-4f84-a6b2-c4bd82bfb525", "value": 2420632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678807, "uuid": "8c988f5a-4bf9-4755-bf8c-05ecc2ac81a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678807, "uuid": "43a2e350-2c60-4ea9-93e5-4c14ec87845b", "value": "f1354bde910724c6efa5bdd025827bdb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fe1cd7-9c99-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1674641740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641740, "uuid": "fb56a98c-0417-4c4f-99db-fc723935ccca", "comment": "Malware payload (IcedID)", "value": "123880e9b951c081dff5fdd1d3cfe87c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641740, "uuid": "4eab75b2-856b-4671-ae09-1ebf900469b7", "comment": "Malware payload (IcedID)", "value": "b41f6bc6c4c05806d1b9e79dd7b361d425902a9c3a3ea92b9ded8b0b0a76f3af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641740, "uuid": "494b67b5-5817-433c-b610-1115a28b2a5e", "comment": "Malware payload (IcedID)", "value": "352f59974b8aad0639a7cf7bb4dd5ce261f171b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641740, "uuid": "0f2bb7c4-1e8c-49be-b744-7de235d11184", "comment": "Malware payload (IcedID)", "value": "ca91962f4aa0bf69603c8bcbde9e975373e49ba47a87cd2c09ee6b00a44d2b3a5821e6a8e57d5378fd354ae959ad11bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641740, "uuid": "3fcfcb33-955d-41bc-b92a-9dd4cba60524", "value": "T14D742952B2A04DB5D063D33B8A824689EF723814D72193CB525F833A2F276F5D93E365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641740, "uuid": "2ebae9d0-c231-4e19-a741-c00072e58f98", "value": "6e34f235de42d6bbfa98671aa88e0e47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641740, "uuid": "2fb0c1b0-9d1b-4153-870b-011eb7245ff0", "value": "6144:AAHUFNIhsCZaNuaG8Hya5EDZObAnvx7LzKJk3Y1e5KRXmQzFtYVS:xUFUvxaZnaD7+JZCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674641740, "uuid": "dbdcfa94-f667-40b4-8d26-59a424a6e6d3", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674641740, "uuid": "ead1a087-8054-4349-969a-b9cc30316e50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641740, "uuid": "503822d2-3da3-4fd1-8793-dd9cb98e6da4", "value": "SetupWin25-01-202303-07-46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7862dc69-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674678784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678784, "uuid": "8021e2a7-a9f8-4745-b9fe-1e93834965fb", "comment": "Malware payload", "value": "6530c8859a0ece22977a4e3bf93fbf3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678784, "uuid": "1d8897ae-d0cf-4a24-87d9-4051dc6c06d7", "comment": "Malware payload", "value": "b43b2676d2a6c988f9304b6f29b87e05a74f9b35bb0b34555f4ef134da6896c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678784, "uuid": "b221b808-4918-4d78-8484-7fc01c8045f8", "comment": "Malware payload", "value": "5e1fd9a118920c494185cc204fcfd3b177190652", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678784, "uuid": "d1c18042-b3c0-4162-bea3-38a9e8717933", "comment": "Malware payload", "value": "b04baa5f0afa679a3042929a452aad22e14cf63cd9d7906324e643dd7ce1ce878f5ce4c7801efc0ab1fc269638a2409a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678784, "uuid": "df3e3bdc-6db7-4ba7-8754-a8588bc86e7d", "value": "T14E137D32BDE0C0B2C56B28B198749E91AF6D187111B1E90B1FAE567A9F313D0937731B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678784, "uuid": "d7461844-7327-4481-acac-da92be6e04b8", "value": "768:+FBnrJFRBbBMp8mvM+Q2+5q2wnqP3vjVQlQhXxMALYE2/WAxIPnD:unr3R0U1q2SlQhXxRLLEWnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678784, "uuid": "8c703bea-0ec0-42f6-9528-92ced98a6ff0", "value": 42848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678784, "uuid": "bc71bb3b-69f8-44e6-8b5d-a40ddca6f31b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678784, "uuid": "893e620a-5679-42ce-bbd7-c08015ffa69f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb789e4-9d08-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674689480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674689480, "uuid": "a9187c69-5165-4aee-9524-35e15c8d3259", "comment": "Malware payload", "value": "ca4e83eef48d206ecbabf740deb79a74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674689480, "uuid": "0ab60663-becc-4eaa-a456-e7d035d466c3", "comment": "Malware payload", "value": "b47ec47261c0b60330bf685c0e5b3535c9d49687f202c09d8e790e62f428d474", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674689480, "uuid": "6438c779-07cb-4b6a-bc23-1db5136e3d74", "comment": "Malware payload", "value": "43c3bcfda995be0ed12c086fe933fda0d8ca54c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674689480, "uuid": "55db5506-d4a5-4c15-9adb-47cf45a5ae6f", "comment": "Malware payload", "value": "cbd7973ffeb21e46105c9e5fde3bea19eba45883733e4686a24fe2c4e092c389bddfe7b34d931f7d99e44934dbe6b6ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674689480, "uuid": "068730f0-3bf1-4659-85bf-64c097e89189", "value": "T13F8533492296D032F2C39E352D2B5442767BFE1736B47614302DF26F2F2B612A459FCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674689480, "uuid": "afcae9ba-126e-4f9a-a6c2-2e7ce96812c0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674689480, "uuid": "42881906-8d65-408b-8b7a-96801b112ab4", "value": "49152:Zos1Xy0Enp/6mqFxy0tNpnkv/30wtpvzYlQgTLCgv2MR:+sIFsmqzzZO/E2YtXv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674689480, "uuid": "26229b45-f059-481e-86d7-a5ac35ea1cb4", "value": 1805677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674689480, "uuid": "32c2ac47-ba49-479a-a89d-01a2e56b88ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674689480, "uuid": "5ee44ed4-2903-465b-af1d-0d8f8a692b99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a629c5-9ce4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674674238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674674238, "uuid": "b1250211-365d-4a3d-a332-c6a08f5babbc", "comment": "Malware payload (GCleaner)", "value": "65f6fd585b7883e6ff52873ec18c3fab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674674238, "uuid": "b7a8f51b-9c33-4fe0-8946-b93674f7968e", "comment": "Malware payload (GCleaner)", "value": "b4bce280ade5a3a225d1f3b5fc95871f5e816b69c2ec7231112dfb50e4c79c64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674674238, "uuid": "3219c642-6a4b-4fbd-8f11-4e3c2bfe7ab2", "comment": "Malware payload (GCleaner)", "value": "c45ed9e3f03d3f80c6a9c381bb29c52ff9624f29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674674238, "uuid": "4cc9f0d6-7799-4869-99fb-9a3167029506", "comment": "Malware payload (GCleaner)", "value": "1db3e47895b8b17b14ff50f92634569c24cfe21dc96b563b4f4c1b7f24e10e72efb205f28e263c3836d4c57de1d6866f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674674238, "uuid": "dd559e19-09f7-4e46-a299-0e73d2b6b545", "value": "T10B853363E2128437F7EBA3BD6D3AA4126577BE720478510913575B2F8F2B1099B0836B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674674238, "uuid": "a22d7357-4040-4ce3-a7a5-11eb3bb737e7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674674238, "uuid": "e7dfc83a-e6a2-4112-95ee-f3b0c897b9d1", "value": "24576:Z3zISiCyfFphvshjs0NoJKDviV1Qkkz27jwUKeHiR7ZOeGQscOHT87Z+PvLC15wt:Z5f6KrWJz1fkkNKeQ9sNW+nLCgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674674238, "uuid": "7eabd865-ea22-4bf3-849a-fc51867327d9", "value": 1819998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674674238, "uuid": "7a5c52cc-0f7e-4bce-85cc-d24bb0038fdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674674238, "uuid": "edfe08a0-ca74-4672-90e5-e0d0b3a5ff8c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32971c8b-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674678667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678667, "uuid": "8e786ecb-4041-48ab-b0e1-cc913fc9de09", "comment": "Malware payload (SnakeKeylogger)", "value": "1291626bc1a52f6913048b6bae46ea32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678667, "uuid": "a66d20c1-27e4-4fec-9315-32c0f58cd380", "comment": "Malware payload (SnakeKeylogger)", "value": "b5ed033b1ab59838dd5f9abdad008e1fadda3a2fad7220308cf123390c4d882a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678667, "uuid": "df4b0aed-489c-46a4-9bf7-4978bc88554a", "comment": "Malware payload (SnakeKeylogger)", "value": "bdbc938c60af4e16b17accfadf54b31b85bf3ab0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678667, "uuid": "f3e5c666-2966-4bf8-97cc-a9deab44f449", "comment": "Malware payload (SnakeKeylogger)", "value": "734f8d20c5af9ebfdfa0dc1f5a664ffaa7d0cc4034122d94c075ab7e912475f819de0f32b61784be3dcca61856f34dea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678667, "uuid": "c3c92143-e53f-4d1f-9c40-ab8275fffce4", "value": "T137E1E801B39C4233DEB38F769CE343414B79F35168539B5E74D4A11BED162854A63BB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678667, "uuid": "44b9d741-dc2e-4cff-8d14-7cc94b991524", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678667, "uuid": "f9f7983c-253e-4ea1-be70-2b8dc924ab4e", "value": "96:CiIpKgeeUOobOyO4yfF9eLo/4jtUW5RL07kLLkDkPftlYRzNt:j8w/O4yXeLogjtX5ykLLkYPf0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678667, "uuid": "13eb99b1-1889-4197-8c3f-ab4623a106e9", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678667, "uuid": "4a8fbfa7-4a98-48d2-9192-9f28615eda38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678667, "uuid": "71e0f233-cc33-4fdd-bc58-1a6bbdbeb4a3", "value": "Xgfawytdsuh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0dd54ed-9c56-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674613166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674613166, "uuid": "008fbbd0-de8f-40d8-a723-4a9262934661", "comment": "Malware payload", "value": "1deffe22302258516e26271b28acde00", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674613166, "uuid": "fdbec806-4b43-4e36-a958-9e4c3e5a8c8a", "comment": "Malware payload", "value": "b6766bb42674ed2e9a3b8a897961cb51a60d1de567a6160d2f217ac6f0c72303", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674613166, "uuid": "ba7c981a-2203-47ba-b484-e991560f7da9", "comment": "Malware payload", "value": "f55292780465e39b32bff6421438db38f315d581", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674613166, "uuid": "90b4da4c-89de-43fa-940b-399bf6fc8eba", "comment": "Malware payload", "value": "41ec3d68a83c429f09001cc584c329c9d7ca48d74b10aeffbec51b7cca7a1e88049b3f10398929ad78ae904144097ec8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674613166, "uuid": "c1aa5fd9-c4a4-47be-bb71-f66565a32304", "value": "T174273367181A9CDAD5316039183F63896875CA2E3EE377612044AFB3D1F35A58EC9ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674613166, "uuid": "95e1b18f-010b-4a84-87a6-685587687441", "value": "393216:BlP6sJA35z7A79L+DGl1mbgafiubcpZ3b1T9i/zVN2I+TX3N8KpPbNiRSKcsdJt:HdJA35z7c5fjmbBffc/3Hi/zVN2Ikneb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674613166, "uuid": "afcc0257-2efb-46f4-bb2e-798ad16a91ac", "value": 21502758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674613166, "uuid": "0cb87838-900e-4fb3-a548-37221c7b19a6", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674613166, "uuid": "9bc0e63a-bbf6-4fdc-8d63-eaf0ad1a5382", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3fb60c-9c8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1674636026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674636026, "uuid": "b74d88ed-5582-48d2-a2fd-3659c4f00e2a", "comment": "Malware payload (TeamBot)", "value": "b5c3c3d5eb5e6b5415ac4d87e3c46850", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674636026, "uuid": "aea68cec-8e90-4599-ad5c-d223afcc9862", "comment": "Malware payload (TeamBot)", "value": "b7948c22484bddce96a2713da0a6bda18cfd0487db9239ed0fd1790552d5e6b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674636026, "uuid": "f8726143-635f-4e6e-b2ab-c01b072d7fdb", "comment": "Malware payload (TeamBot)", "value": "9aa4014de1b622844ddfa4c7ddb17ae384289cd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674636026, "uuid": "faa93c48-b4cc-4c8f-ba26-77549bf4e303", "comment": "Malware payload (TeamBot)", "value": "6ef7b8c1b954802f4142b550fb869d9366ba966b7273b07ccd2b50905541ee04636b3b720fd0a4e37cefc528c4ad8343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674636026, "uuid": "501c365d-144b-49fb-80b9-2adbf3cf048c", "value": "T10B14D03276B3C0B3C55A04711824DBD53E7BB53046B5884B7BA80ABD5E707E1A76B38E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674636026, "uuid": "31d77390-9322-4586-b7ad-db1904d6bb87", "value": "a73658074f4769fd7f1d57304e5f6853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674636026, "uuid": "9392e32e-1a72-4ec9-b4bd-a698083295ef", "value": "3072:OBN4X3HL6thikLX8OKWnG5/9sSR3STCDrKQqSrwizN5UE3Z9ziBG7aZ:imG7LX9pno9sSxOCDlrwiz75p9oG7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674636026, "uuid": "cee2306c-4c08-44f4-8906-507e35bf088d", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674636026, "uuid": "cb502840-137f-4e35-b38f-b4315e518465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674636026, "uuid": "f26c9df5-bd46-455d-9f02-6cc3f28b27b1", "value": "b5c3c3d5eb5e6b5415ac4d87e3c46850.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db18a62b-9c6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1674623545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623545, "uuid": "59ac1869-60a4-4dcd-8b0f-a950398ca45a", "comment": "Malware payload (RemcosRAT)", "value": "aee247abe5bd24a1404a00267af8a72c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623545, "uuid": "d1f04db1-6991-4d60-b497-1fce7233e38c", "comment": "Malware payload (RemcosRAT)", "value": "b7973289619d7af3daab900a2e80847c378db7caee70e90ec8390b1c26ff419f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623545, "uuid": "ccc2dfcd-77cf-4612-842b-c3cc8906e30b", "comment": "Malware payload (RemcosRAT)", "value": "1fbaabea53aabba07736ec969b78e28c62ae7bda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674623545, "uuid": "80e549d9-519b-4da4-b5f5-7d37827bf829", "comment": "Malware payload (RemcosRAT)", "value": "1a661b1fd925df2c5aac3155b0e394db866c58c23c4b29d15f44bb5bfbcf1a61bc4c0467677160c0fab81af0d89a5cb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623545, "uuid": "d3bcc3c0-d7a9-4291-97ff-38fe99592dca", "value": "T14D554A281D364BFDDAB0FA34E7D951A0B69F1D92236788D986D13FC42B32542BDCA01D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623545, "uuid": "06ad120c-9f2d-4585-83fe-b82edc28d3f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623545, "uuid": "1269f6b6-5220-4992-bc55-d28fca533278", "value": "24576:+T8irmdjXHNOrAe/Iure8dolr6vuxCd7X5gQd7sorpI8m9ok9NfcRokA:BHlr6viCd7X5nIxikX0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674623545, "uuid": "f347edc7-730a-41fa-9a19-4016f2221559", "value": 1329152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674623545, "uuid": "9ab426b1-9fae-42d5-abec-530e295d5ade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674623545, "uuid": "159f87f6-b238-489b-b1d0-a51a4b7af4f6", "value": "judicial.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f44a71-9cf6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674681993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674681993, "uuid": "92626501-3f8b-4aa5-9ed3-f1ba9242ce7c", "comment": "Malware payload (Smoke Loader)", "value": "1e03c572695e0dbaba687f79a9bf26cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674681993, "uuid": "9907992e-08d2-4958-b7c5-b087c29bd0a3", "comment": "Malware payload (Smoke Loader)", "value": "b8c165cc7a236768a6beb059eef8e846637c0f98c6105482b584013c2ce8bed8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674681993, "uuid": "b4dd857f-cc0c-4242-a690-038adc25f31f", "comment": "Malware payload (Smoke Loader)", "value": "24d21ac269324c6d1c4634c524b238704b6aa8e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674681993, "uuid": "1768d0ba-f9c6-43c0-9f54-6cb263d8d333", "comment": "Malware payload (Smoke Loader)", "value": "1c8e1cdd09b42b6b02054caecc0e1263df03f17543ab7a8092c253de51053350634f81115cce3841439c4466204dcda9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674681993, "uuid": "6406668d-9036-4306-9f4f-7aaf5c015ec4", "value": "T15364AF1E75D0B860E92A0636CD1ADBD4396DF8D38F3C726732D4A71F29722E0C96621D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674681993, "uuid": "b2eba82a-5a60-4b35-ae2b-adb635032ddb", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674681993, "uuid": "702ba441-0818-4875-bb0e-4b637653521e", "value": "6144:e9LX307csWqKyrFnwldg0+MOKXtZRIw+29UT:e9b+cs1hwlKW2w7UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674681993, "uuid": "eeca3daf-b0bc-4196-92e0-a862cb82ad7a", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674681993, "uuid": "1b16a4cc-2eab-44ca-84c8-1421677de454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674681993, "uuid": "62b965af-78b9-4af8-a30c-8982df8d0619", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c206ec5-9cac-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1674650068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650068, "uuid": "90dc38f0-da21-4813-bef9-59f383ada10f", "comment": "Malware payload (RecordBreaker)", "value": "1b685264d0178ac916a97fda308efc85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650068, "uuid": "ae91f806-bf78-47ae-93c2-be8537040cd4", "comment": "Malware payload (RecordBreaker)", "value": "b8f64bb8924cca22ffa96adc085843a6ed21f4f79ad7f78bffdde29d64416ee5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650068, "uuid": "1f44c30a-546e-4794-8e32-a65a5db346ef", "comment": "Malware payload (RecordBreaker)", "value": "0e11ce949b3b5b4191a95baa46587412850d5502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674650068, "uuid": "53eba7c2-1d06-4bf4-a92a-648946647282", "comment": "Malware payload (RecordBreaker)", "value": "211df01f6d015fee23376992e7d1ae3eacf22daef92a7b960866ad53e07201cb82566eff111d694018cad815260724c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650068, "uuid": "9e1c519e-fa1a-404a-abdb-9e60a48cb4e9", "value": "T114748E11E298BA90F59DCA318D1EEBDD363EB8504D14E726322D7A3F19711E0CB6A31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650068, "uuid": "23718a37-b354-4dfa-b2f8-b0afd659e843", "value": "787cd3f7e6d0161bfca0cbd92375e751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650068, "uuid": "2a5533e3-70da-4b03-9580-c92601cfbc27", "value": "6144:YLBDeS+WCdAUYI4dsE8UgOjq7VWRFBMolz90u5m:YVDt+3iUYRT8P7VWR5lzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674650068, "uuid": "d6e66f82-9203-4475-9609-2eb622a217cf", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674650068, "uuid": "e37dfc05-c06d-4dc5-80fe-c3c6e8389bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674650068, "uuid": "2cf25eec-0a45-450b-a188-9f2df75bf24d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a5a1bd-9c88-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674634647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674634647, "uuid": "61bda725-7eda-4fa8-8592-a45eb121c629", "comment": "Malware payload (Smoke Loader)", "value": "0a8fb652fdb28ffc6125128535146d37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674634647, "uuid": "8a0fd27a-2fbf-4aa7-8922-669a929a712e", "comment": "Malware payload (Smoke Loader)", "value": "b9a00dc1a3f5f51e5148529812b51e672a8e672562d9961cd724ad18ec428a1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674634647, "uuid": "02fcd831-4dc0-4142-8203-db3ca37d9055", "comment": "Malware payload (Smoke Loader)", "value": "aa161d9c4cbca35254a5e2f6d0c49c961ae2ceb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674634647, "uuid": "2f2870b2-d3d2-4e73-a780-61ca8da11dfb", "comment": "Malware payload (Smoke Loader)", "value": "3ed779079e9b7ed1666ed3b3943c2195a3d1935d36fa7f8ade39ef2db494562a50a8d36c6e10904a8f0e5dc945bd6fab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674634647, "uuid": "cd44cd69-46f7-4442-ba02-f1c1c7d17fab", "value": "T141747D12E2D8BE91F59DCA398D1EEBEC763EB8504D146326322C7A3F19701E1C16A71D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674634647, "uuid": "14642584-c036-4d22-a65b-ae7996d2db6e", "value": "861af707b319724b1132a7a971c54bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674634647, "uuid": "e693244f-a470-4cb1-b6ec-32c199992a63", "value": "6144:/gLzVgyW06UbLDM+7H4bS06RRXeDjq7VWRFBMolz90nUj:YPjFZLDMf9Aj7VWR5lzrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674634647, "uuid": "62a9d35a-4935-4e2f-a5c0-1e102d1653af", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674634647, "uuid": "0f293400-1b0e-47ec-9922-8a6f86f9a1c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674634647, "uuid": "ff571587-bf96-4f8a-9901-153f44ae3f35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af12c03-9c49-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674607439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607439, "uuid": "ccfdccd7-35d7-431e-a8e9-b639c474983e", "comment": "Malware payload (Mirai)", "value": "81534e09273705a53162b5776478c95f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607439, "uuid": "a382eec5-be3e-402f-8c16-6991eac6c3a8", "comment": "Malware payload (Mirai)", "value": "bab4e728f51573615117e47dbad7c53ac1ab028003def60561f28e835c2639a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607439, "uuid": "76bb0b68-b48e-46f9-a740-51dfb16a2131", "comment": "Malware payload (Mirai)", "value": "9b9e40670e4bedce501b467c485002aa20c7aff9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607439, "uuid": "077d784a-ed9a-45a3-946d-32fd48a0c5b1", "comment": "Malware payload (Mirai)", "value": "d9669b4d09f638ed09ac98112f507dfd0ad509d736c55e905165851b60ea45c480a8e82db17be6a7ed3976df42d01c79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607439, "uuid": "a5daeefc-11ea-4e46-98c0-8b2f1a21dd79", "value": "T11D333B2177351E1BF0D4F8FA26B70315B1B6169E19B4CA1A3DA20E8EFF11910B6136F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607439, "uuid": "8e3632b1-6c35-43b5-8afa-ee0915faaf0f", "value": "768:MGxoGeb0xnIq9aVyjWF6oMcbGUmCp/3mWhO+zsviEx2:MGx7w0xnISaVyjWF6oMcbGENmgWJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674607439, "uuid": "11f75e0c-e459-40d7-b48c-95ffa8709365", "value": 52208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674607439, "uuid": "4929421d-e343-4761-af14-ed6fd23ebadc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607439, "uuid": "717432a9-48e6-4f10-8e9a-ae05e5993f20", "value": "81534e09273705a53162b5776478c95f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cc92e8-9cb3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674652906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674652906, "uuid": "16ab0d67-f4d0-4257-8639-265349f6564b", "comment": "Malware payload (Smoke Loader)", "value": "1747aa1778d75546f7ae8f450bade3e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674652906, "uuid": "a33fd48c-c754-4f17-b8b2-5b58c2ce2d43", "comment": "Malware payload (Smoke Loader)", "value": "bb1bc810b47215c3546465fb6d1dbaf4df1f701568ccd5c84fe85ce2eb067f4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674652906, "uuid": "79cb3b14-0944-4f7d-b351-ae629e89d68c", "comment": "Malware payload (Smoke Loader)", "value": "55f5d90cb0ebff9bf2d07303aa1795b91c75ce12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674652906, "uuid": "ca977671-6e93-4f98-b537-69be62c4b841", "comment": "Malware payload (Smoke Loader)", "value": "fd5113977c72e103bcd3230789d8fde892eb9faf3e75b2516411949087563dc99bf1f4c788b5386ff9242aac1754e137", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674652906, "uuid": "99fc45c5-adb1-479e-942c-53e1314db7a1", "value": "T129748D12A2D8BAD1F59DDA318D1EABEC767DB850CE146326322C7A3F19701E0C56E31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674652906, "uuid": "722feeb0-c313-420f-9f35-0160de48c768", "value": "787cd3f7e6d0161bfca0cbd92375e751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674652906, "uuid": "9afd8992-14cb-43d7-9957-278c8888cbc6", "value": "6144:pLNhegC5iHr0PHuw3+Ojq7VWRFBMolz903h:pRhxC5/POwY7VWR5lzOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674652906, "uuid": "5f4430a0-fe59-40a5-bef2-d8fe6a06beb8", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674652906, "uuid": "af397b0c-d795-40dc-a3f2-3228659cb505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674652906, "uuid": "3f9c8dd6-a195-4b34-bbcf-8cdb8fdd2533", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0972f57c-9c9b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674642521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642521, "uuid": "b2cf362b-5b54-472c-aadd-9386e1d1d079", "comment": "Malware payload", "value": "525c930b348f58ecdaf03b08c1a91495", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642521, "uuid": "808a073c-0dfa-4f51-b1a3-66cf44a4158c", "comment": "Malware payload", "value": "bb393daf400b3417fdd00e65698a3fdb977cd41cc1df894b630b271ddb4769df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642521, "uuid": "44075cf0-e129-45a3-9b14-5d1357b4ff9e", "comment": "Malware payload", "value": "5f08e2d33fc791929e29ad5b93a319453c3583a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642521, "uuid": "96551a9c-6a63-4617-b7b6-f2c6df9d7aa4", "comment": "Malware payload", "value": "49028e8dddee5c7f097bf42e5942688c7154881cf5f6af9ac988ef99561a9f9e6a80e8225ac29db78a1c409112d98914", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642521, "uuid": "04e0f87a-4fb5-4326-b114-e5db442951bf", "value": "T1FD823A26769C1220C1D7CB7EE9FBEB4002E4D2919547F99EB024238D1A033FAC5E5AC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642521, "uuid": "5683bf15-8490-4c9d-878c-5d88714c72ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642521, "uuid": "f3a3b0e9-993e-4fba-ae0d-85066e328b9f", "value": "384:gdO0vPqnnphy83JqGq3HLBhoksn1VRi2J2kcQ5Yi:gdnPqnnph53J3q3rBJsnMkcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674642521, "uuid": "f8066bd3-a3a0-462f-8da1-624a48015405", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674642521, "uuid": "91241326-aad4-43fb-b286-7686759e91b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642521, "uuid": "27482802-7aa6-40fe-bb8c-30edfca581bd", "value": "VSL Q88.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743165ed-9cee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674678348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678348, "uuid": "11ba2f1a-55da-4a26-9838-c8b1dcf64fa5", "comment": "Malware payload (AgentTesla)", "value": "ba6aecd5182863bfe23398bf3262b6bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678348, "uuid": "9d372d7a-4637-47fb-b0e9-209dde2c909b", "comment": "Malware payload (AgentTesla)", "value": "bb8ac8fda2ab4830b6e0b4b16a2e3907863ac50cf6380f97de977b23c27cc736", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678348, "uuid": "87800756-47b6-46e0-ae41-70a4bf1daa2b", "comment": "Malware payload (AgentTesla)", "value": "342d1380b00eaf40acf38b5f2705d31ab3f9c5a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678348, "uuid": "251825ec-a594-4a54-8d64-79a2932535e4", "comment": "Malware payload (AgentTesla)", "value": "063178671c81187bc4552958c6ca9796a752fe21ad477c9b817ba9658c78ed39930684f7a77d259b829024d433bdf594", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678348, "uuid": "ff1bb9e5-408a-4214-a9cf-bb7555cb2869", "value": "T1F4F4BFBC7740FC8FC4278FBB84042D00AA61F4725B57E387A05B11999A1EBDE8E556E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678348, "uuid": "049dd4c0-165e-4dad-95fb-b29818f59381", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678348, "uuid": "50189b6f-2a6e-4908-8569-bbb79b93025f", "value": "12288:YIXfvHzKiac67RgACjs4KizyIfQchaMUKwICPJQyJpFHyox/OfSi7NtzUIG5E18z:Z3HzKiEdgArBAyaaMNeyydJO1NtH8Po", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678348, "uuid": "8f0e3013-0775-438c-9e8e-152c2a0ee61b", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678348, "uuid": "f14d7cc7-276a-4a3a-b954-790b8cd0e866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678348, "uuid": "330ebe8e-e75f-4eec-ad24-661215c88b09", "value": "dhlshipment369876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0071e130-9caa-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674648948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648948, "uuid": "2758f2a1-3b80-4ae9-8aa1-cf98e4769adf", "comment": "Malware payload (GCleaner)", "value": "53940ebe4a6ebd79156169cfc241984c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648948, "uuid": "082e2ed2-4f09-415f-8fad-665ca1fdc018", "comment": "Malware payload (GCleaner)", "value": "bd4a9c7ce9fae85f0f48c4c52c13379f780ea7ee22775f67ac7bfadfbc0698f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648948, "uuid": "48229935-deb2-4380-88fa-3162137c6b05", "comment": "Malware payload (GCleaner)", "value": "82d127854d18c5995fd38ce2a1e7048a9e79fde7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648948, "uuid": "ec3583ee-55a0-48c6-9b83-ca43bf04e4b3", "comment": "Malware payload (GCleaner)", "value": "85f362a5f715dff90b792efdd8a44d2299affd569a634dfb287d486439217517208b3af632fb169d4ede85ee600d609b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648948, "uuid": "1ada3b7d-6658-4230-afeb-482cc292a380", "value": "T1D085335D6462D135E043A4705A6CC060E9BABA76623874DA36CC8F2F6F37690ED0B3D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648948, "uuid": "e4c81269-3dff-4863-8625-e3ebd11ad546", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648948, "uuid": "518b12d4-cf8e-4bf9-83fe-59a8f868fa57", "value": "49152:ZXRg/VI+eRocPPkRHP55i14dnu+y4DVA9LCgv2MR:1R8VI+eRocK55iWdnujEgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674648948, "uuid": "9598fc16-16b4-47ef-a281-74dba16af773", "value": 1777467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674648948, "uuid": "3b1c8691-3935-489e-8924-1d06be965e72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648948, "uuid": "abca1521-6c69-47bb-9362-181663ab124d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b33a51-9ca9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674648814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648814, "uuid": "5abdb867-7c2c-40ff-a7b4-eac8251582e4", "comment": "Malware payload (Smoke Loader)", "value": "0f6ce51511464b3d354f78fd2063be3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648814, "uuid": "9ed9618a-6496-43db-9e1a-cfa50adae9c9", "comment": "Malware payload (Smoke Loader)", "value": "bf001ca410062028a0f4d8703fcef2818c67c664587b92f354c249c754bee736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648814, "uuid": "ac54c3f1-b7f3-43bc-9100-a96d647be019", "comment": "Malware payload (Smoke Loader)", "value": "825867d5b9b792c420d8c76a0c69ffc37510f832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674648814, "uuid": "56d58ea3-5058-4878-adee-7977dfdf4a1b", "comment": "Malware payload (Smoke Loader)", "value": "d108d243a990875a1852f9e7ea52ffc1c3b1afa8c40ca4c83c0df1da4694105e36b76ea076ebef057cd7b11606222dc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648814, "uuid": "9bd821e7-7ae2-4c0d-9a88-6c09573773ed", "value": "T1CC748E02E2D8BED1F599CA718D1EA7EC763DB9504D146326322DFA3F29702E0C56A31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648814, "uuid": "97752f49-12d2-48b4-a644-083db72836a5", "value": "787cd3f7e6d0161bfca0cbd92375e751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648814, "uuid": "6887a348-43d2-476e-88ca-4d8522d7d269", "value": "6144:MLAnewFrh3RAnRHOogOjq7VWRFBMolz90aDyC+:McnB9Anl/y7VWR5lzRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674648814, "uuid": "174eef86-c0b3-4ecd-9bf1-ce911f3bcd62", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674648814, "uuid": "38f4cedf-d518-417d-8aa1-b6573186e256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674648814, "uuid": "53fab00f-39cf-49d7-8445-998eb77a2d95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc5a467-9ce9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674676378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676378, "uuid": "89f73b1b-5270-45ff-8e2c-b63ae3ff54d2", "comment": "Malware payload (Formbook)", "value": "575d12643bc59f40cd51ef0a80c4b77d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676378, "uuid": "3096457b-eeac-4322-acfe-1a20797d13a9", "comment": "Malware payload (Formbook)", "value": "bf143e643c42cd50ed2f712b9d1ee7996a27097ec9ffcbd52d914d643ac5151d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676378, "uuid": "2c3bef7a-af9c-421e-ac2c-841987453eb6", "comment": "Malware payload (Formbook)", "value": "75cec79442c394d6b5cea5ce3153c90be35a074f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676378, "uuid": "292d8dc0-f09f-4f58-af6f-6154462d9d48", "comment": "Malware payload (Formbook)", "value": "46d59cb5efa6a0ff7256687aa2212f8ce6d7a9754557f8b30ffd32880ab29bfe7582ed651fd27d5acfc412d37574827e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676378, "uuid": "a6ff77e9-e01a-4a98-abb1-f854f1e488a4", "value": "T1160529026D7C80B7E19E5B3B18DE935D0C91AD1835F5680EFAD639C9CA3F352A9342D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676378, "uuid": "d650c0b9-49a7-4de3-9b00-b8011e47a71e", "value": "a14c6d7f522c5488b8050d0299c83002", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676378, "uuid": "d20bafc5-ba3a-4e38-a0e6-6a1c1783553b", "value": "12288:2uMSVWMUTNrWzFIHxykHFxtnAh4m7ONhk+4i0Wt649b0VcGPE3vVJS:2LPprjxyUDnzhj+c/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674676378, "uuid": "7b5e3b52-8bec-4234-85de-c6042e9f13f7", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674676378, "uuid": "e758b8b8-2eda-4a36-b7a2-921835a85c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676378, "uuid": "18c6bbd0-4ad9-4631-aaf7-ae2001404aa0", "value": "Purchase Order list attached.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434ecd82-9c8d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674636605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674636605, "uuid": "bd9141a9-9871-4cad-bd46-e03fcbdf48ce", "comment": "Malware payload", "value": "3fd36473a356b2574dee24283f6d3bf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674636605, "uuid": "3d1ac0b4-4d5f-4e79-bc57-f849d6bf28ff", "comment": "Malware payload", "value": "bf36f4fdd2382cc5869fd3833c42a73ab638ae73457a268713099888a7de6b00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674636605, "uuid": "1f9839eb-fae1-465b-beb1-cc67b6829663", "comment": "Malware payload", "value": "711acfd53e4d3f48896565bc4d3428fc761304cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674636605, "uuid": "a021786d-608e-426c-be3a-d0f67e149e56", "comment": "Malware payload", "value": "0da68dd0ee5253f7c58b4bb7760c5749e8c9446a016e4a6e8f27cd2632077bfe888ed4444935c39003d25b0cab02e325", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674636605, "uuid": "38d9f428-0121-460b-97ab-9438ab8de1e1", "value": "T15CF27C32FAE184B2C69B45B488B4D992BF1E251122F0D9436F6C1A7A5F317D2837731B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674636605, "uuid": "1ed7d375-bcb3-4972-bc1f-fc654dbc5d02", "value": "768:xhrMgpxtC4QjYVMHSe2wnqP3vj+cN6gSfN4ZuQxkbLTGdj:vJpxtC4Ulz2+w6JN4ZuQ2Ladj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674636605, "uuid": "225823e0-3259-493e-aa66-de0d17a09a6c", "value": 34864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674636605, "uuid": "bff76f9c-ae69-4f49-be49-53acd1b81eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674636605, "uuid": "349bab3a-125b-4fbc-ba94-042946144e99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141ad8a2-9c80-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1674630942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630942, "uuid": "5a4aba1d-0de8-4b7c-a30c-4fc47d6785c3", "comment": "Malware payload (AuroraStealer)", "value": "661267bd0d0f014628a2e0716cd03a5c", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630942, "uuid": "dc59b5df-759a-4597-8275-bc9538649daa", "comment": "Malware payload (AuroraStealer)", "value": "bf46caa96824ab3a6ce2d736c48778936324fbc6a097866a24d2925d9e7cd56e", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630942, "uuid": "8a103275-89ff-4e7d-8f1f-5b0217f3e08d", "comment": "Malware payload (AuroraStealer)", "value": "908aee7753a2a8d3ecffc570c4ed3422740a4f68", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630942, "uuid": "7325398e-9085-4f0f-a3b0-1af5daa40646", "comment": "Malware payload (AuroraStealer)", "value": "c75ab5d6b4e6fb4eaabc524b6fc6984220616afd6fe64e839d8127d4c891f70ea4b65cf0f8fd348bf6b3cf42c1790363", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630942, "uuid": "6717bf6d-442f-44bb-8eec-38275df62e23", "value": "T18736097B709D0E12D75817D5DE63A9BB5EB8F4731389ECE8725ED080EC9A8189C23742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630942, "uuid": "e1953e13-4721-4aa0-98eb-9677d2029055", "value": "98304:BEjFd/umi9lCdhyZ4tlAhfDEDJDzE6kWrer8cAO:BEBlumiAyclQQFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674630942, "uuid": "bdc1af93-481b-41eb-acb1-49b19d5f9324", "value": 4985738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674630942, "uuid": "436a25ac-a067-42d7-a8dc-9460205b387a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630942, "uuid": "d36eb2e6-cb63-484b-b06e-2f3ecdb9644d", "value": "install_win64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921ef43a-9ccb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674663366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674663366, "uuid": "9b6eb08e-5c9e-48e8-87d9-4e43f750509b", "comment": "Malware payload (GCleaner)", "value": "a5ee27ff8cf3da71c7b4ac5f404f8f37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674663366, "uuid": "70a450ff-dfb1-4edd-9bfd-70bb0b48ade6", "comment": "Malware payload (GCleaner)", "value": "bf97e200f55d36ff758b7be3291d9940a92de762104f666c66593d16635217e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674663366, "uuid": "7989b92b-e95c-4dc0-b438-27c7668494d9", "comment": "Malware payload (GCleaner)", "value": "ad5d8f310988bdc53536a5fa623edc58990e49ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674663366, "uuid": "4b67ee31-0109-42b1-9c57-234160af7bc2", "comment": "Malware payload (GCleaner)", "value": "7a5ff1ff67269ede1d955f7db1153aab8508f36748445bf3582b46a0cf18c06dfe82772c18088e7ffd45d9905446a443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674663366, "uuid": "c98504f6-5802-4cba-8cd7-be41971e12db", "value": "T16A85332690548276E1D1953B2C77461AAFA3B9302834756638AC3BEE4F2FBF1247F351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674663366, "uuid": "77d810bb-8da5-4eb4-b022-b1437c26e3ed", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674663366, "uuid": "5958d768-4b04-4873-b177-a355637c51fa", "value": "49152:ZKtIevTAX445DDmZdRPaXSm+5+64ro4oLCgv2MR:G1e16tPab564ro4gv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674663366, "uuid": "78eda008-e7c3-47c7-ad94-ec9cdeedcde3", "value": 1798928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674663366, "uuid": "d0233011-1d0e-433b-b9e6-993a49d38795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674663366, "uuid": "2b268e41-5e04-4c81-bfbe-cce6422e95e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d7f244-9caa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674649249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649249, "uuid": "976defc6-118d-4215-bb38-83bc30e90d8c", "comment": "Malware payload (RedLineStealer)", "value": "4eabeaec81d686af107f7b1ad4e4573a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649249, "uuid": "bc4f88af-8329-4f4f-940d-6795c354065f", "comment": "Malware payload (RedLineStealer)", "value": "bfc40f821bc86faf61aa929f3bad576c873bdf751172a4963bce0405ddff55cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649249, "uuid": "8aa4cf39-4998-4bd5-bcc5-857936138530", "comment": "Malware payload (RedLineStealer)", "value": "cc05ce25fc12f65b04478d294e52a357f8dde657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649249, "uuid": "9ec903bf-f414-41a7-82bc-19a67ddbf60c", "comment": "Malware payload (RedLineStealer)", "value": "2972b0218a4c75ce2242ff25e2c51592ff149a790138fcc7607924c6409d76126b1ad2bd8b41f32d152f59df7d523bb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649249, "uuid": "63675d7d-d2a1-4c65-8d97-038e3543624d", "value": "T1CFA4BF02F298BAD1F49ECA318D1EE7EC763EB851CD156626322DB63F25701E1C16A31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649249, "uuid": "6507972b-63ad-4ff5-8853-3a1caa5962a9", "value": "787cd3f7e6d0161bfca0cbd92375e751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649249, "uuid": "0477ce5c-86fd-4d68-9722-b384a3ba724b", "value": "6144:6LWRewb8LSux1NrTNCclFzJTlp7PJyJ2RVBziCNVNXBSjq7VWRFBMolz90PM:6aR5mdCcl9BlNsAHeIR7VWR5lzqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674649249, "uuid": "a5e808f5-a786-467c-86eb-d8211d290c6c", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674649249, "uuid": "90b54d1f-a3a1-4c96-b13d-5ffaabe516ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649249, "uuid": "b157ab31-bb4e-45b5-a04e-b00783272b52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3da331d-9cee-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1674678535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678535, "uuid": "a887cb48-8cfc-43e7-b0ee-ae4281810b28", "comment": "Malware payload (SystemBC)", "value": "d49997877451b110adc8e09d9c04c2b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678535, "uuid": "83214571-2c30-4dc8-8a58-10c226d0c021", "comment": "Malware payload (SystemBC)", "value": "bff34ec881bbe9726f025fcf4585150e98178bd2ecdbc7fc29939dbf554ab708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678535, "uuid": "0838f0bc-9001-4eb5-9a68-0e5bb9bb2660", "comment": "Malware payload (SystemBC)", "value": "602504addbd4df06c2ae5467a037edbf4fc41c16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678535, "uuid": "6d9b9452-14b8-4816-881f-35df929c9344", "comment": "Malware payload (SystemBC)", "value": "3290bd67bc3c53a7e5036d4bbecb2fddb8b20e103c0b3febc000163ae167fb8f4a36d91d89704455d20a00b7368fcf96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678535, "uuid": "98cad0eb-8935-4edb-aefe-ac85eec9cca6", "value": "T1618512D6BB51E339C39426F458E8D2C803369F7D44A1C18B33A5658B7E7DF8D912B288", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678535, "uuid": "1048d1eb-f121-46dc-9f05-75ca8775772d", "value": "46f2e276c634d5362ea91b37e3398f9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678535, "uuid": "ca7722e3-92b5-491c-8551-25507df318a6", "value": "49152:Zk7edbYPPeMgp1wQ4H4/Kof7Of6Dmq9zbrQn:Z/dMPPEYQlNqfVUQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678535, "uuid": "c5fcedb6-5932-45bc-a309-4b917d48bd05", "value": 1766032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678535, "uuid": "52133424-48ba-44a2-bf2a-a1635f722a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678535, "uuid": "f89ec451-1250-4509-9fb4-f3566dd7b0b2", "value": "d49997877451b110adc8e09d9c04c2b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae2aadd-9ca6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674647301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647301, "uuid": "f9b38b84-483c-4344-8cb0-5b72db0553e2", "comment": "Malware payload (Formbook)", "value": "1955205499dfe38428db18133d0c6281", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647301, "uuid": "d7690ffc-6f9a-4991-a082-33055cee6a45", "comment": "Malware payload (Formbook)", "value": "c104d364eec79cad7a9c9040ff30d46e6b2bf694b3c8f80130bb599345fc3d76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647301, "uuid": "24e566ad-ba25-44fe-9164-be8c6b1b5918", "comment": "Malware payload (Formbook)", "value": "293c44a29a18f99a06fa38ec8d746d1ff19778b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647301, "uuid": "be576c71-be9b-4b1a-a830-3d1878c98201", "comment": "Malware payload (Formbook)", "value": "bd9b6705591f3d1d1b9f9be66af14329e07afc11ea6ea1d3cd6ea210c74694f0fddaf99d7f1c5afa6ac9b188ad21f001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647301, "uuid": "aab83f9b-e5c2-4fc4-ab63-a90422cbce9e", "value": "T1D815BE49A6244783F0985FF8C67D7E0A07701C3E76D2E3F4BDE576D7A9A2B920422067", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647301, "uuid": "b94d747b-4a10-41b9-89f3-5b2229528806", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647301, "uuid": "23355509-c44f-4194-9636-1726b7f935ac", "value": "12288:7t4ucOMtEwcU3gZ+GQzjkATGdsp2EHiTZikOFBUif634eG8BSGlhWBr:ZTcO6AAgZbQzlGs2qiOFBUHo8B5Ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674647301, "uuid": "8ce8d057-3dd1-498f-a1d1-2f0062340f37", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674647301, "uuid": "1a54f236-fc03-40ab-892f-6bb1696e698c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647301, "uuid": "78266453-d168-4403-a5eb-44aa5830caa7", "value": "Confirm!!.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20107056-9cd1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1674665751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665751, "uuid": "8fd7048c-9c92-4a9b-9451-9d898ef80cfd", "comment": "Malware payload (Vjw0rm)", "value": "cbb9e8783d23b22f610462c202688dd2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665751, "uuid": "080f9920-04a0-438a-88be-493c18dd679e", "comment": "Malware payload (Vjw0rm)", "value": "c1b90fc87c2bc154d8157e388186d82e7b0e03a918b07b5f70d2a5bedcd5901c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665751, "uuid": "e7807985-0d80-4888-a22b-bb805f51f864", "comment": "Malware payload (Vjw0rm)", "value": "8f76df9b5b311c145c56a2c759c519955dfc430f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674665751, "uuid": "018603ad-16e6-4c28-8c18-edf97a5d28be", "comment": "Malware payload (Vjw0rm)", "value": "8af2c8a243d36fe186cd6ab17e646696acab0302d19c726be436e5a158f31b8589f1f6de9dfb1ac2155732fa752cef6f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665751, "uuid": "7683a008-8de6-4276-9e59-0da51a66dd0f", "value": "T18445B6D0FA0D60595EE1005810395E8A4D7DC6EBC2B8DFF8F616B914DA2940AF3ED7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665751, "uuid": "d26d8b22-adac-4bf4-a453-82595603e650", "value": "6144:eQfPBx5q0sQ1o7rsbHC01mDBpNW2mTMSbpuV8jmrPJ729wORKlhxqxTOTMOpQvcg:eQ3B7qgpkrP4YtTMSlmUFclgZ/tDwLsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674665751, "uuid": "53d4dadd-2629-4376-8569-787b7f831b11", "value": 1242558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674665751, "uuid": "315a767e-bbed-4620-bcaf-4adde4235237", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674665751, "uuid": "583a5d68-f4e8-4df5-95b9-3535936561d8", "value": "Solicitation#E62-357.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4fefa8-9ca1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674645374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674645374, "uuid": "cb496696-9b77-4a2c-ab82-c083557fdf95", "comment": "Malware payload (GCleaner)", "value": "d9c18bdb07613e206c131ff06dc40038", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674645374, "uuid": "c44b008c-419f-48cc-8ddf-b22e52571628", "comment": "Malware payload (GCleaner)", "value": "c1e8c6cdf523141ca1c0b147104873a16befbdadde0f94d299c20417882695ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674645374, "uuid": "55574c84-ae53-4bd1-a8dd-c032d14c3d16", "comment": "Malware payload (GCleaner)", "value": "f16c63d36f8ea2bd34d1af3c1abd4085faed6953", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674645374, "uuid": "faa45e6f-965f-4bbf-9ff1-ab18f950269f", "comment": "Malware payload (GCleaner)", "value": "b4546d16de500d5059605531e4c75dec9ebc149e1e3c1e4b9a411ca84aee966c448d1e3f48ec260b32c6d3441ddf26eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674645374, "uuid": "ed35d300-68ee-4b96-9d8c-31fb80dbfe53", "value": "T1C685335110298D35EEB286706C29C547FA73FE2322B091A573DD1B7E2A276B060193BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674645374, "uuid": "e40f56ce-9c30-412d-b16b-bcd586ae689c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674645374, "uuid": "51740c79-b08e-43f6-a809-8ee87e5055a3", "value": "49152:Ze5ZB6AcQgnrLQUkMiRpOUlOepkax+vx/9em6LCgv2MR:k5zcPnxk3OUhihvqv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674645374, "uuid": "b1bd59b0-0b30-4ac8-825f-c979a6bd036d", "value": 1762756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674645374, "uuid": "fba7ae4b-4465-4308-8ad8-15c515776444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674645374, "uuid": "74414e56-7765-42c0-94d7-5fb541846423", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4bb624-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674678820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678820, "uuid": "1df7ca42-f0b0-4f3c-babb-d7baee215508", "comment": "Malware payload", "value": "e43bd6491d398710f23436f2cd3bd073", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678820, "uuid": "da642b67-7a58-4518-b6a4-414b0149f3df", "comment": "Malware payload", "value": "c1ff73655fd3aed2950b87f057461081a68682ed5e09a55eb7cb17d4a43c84e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678820, "uuid": "6a792480-9f63-4557-8cdf-b91ae0a9d86c", "comment": "Malware payload", "value": "bb50f048ec01fd4706f9f672321004dbd99ab2cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678820, "uuid": "a19e5569-75b6-4239-a2f0-f13bf1bb5d86", "comment": "Malware payload", "value": "5b00e20e22a754cec5bb8d4185a8e934293a59c663319724f2fe0a072e4442b0effe5ff2b59d8ee2f9c2f52d4ef82c67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678820, "uuid": "979515f8-38c2-46e8-b843-95764e121414", "value": "T15895337492C47841FDCAC5B09EA9841A83F57B9E58806BB671F4E2288BB5453F33C3D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678820, "uuid": "ec5d7c49-fd6e-4e99-8576-dc92ecc24e24", "value": "5e5ac8ab7be27ac2d1c548e5589378b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678820, "uuid": "801bb42c-d16c-43df-ab9b-961029d401b8", "value": "49152:A0cQMhIqbNjHIS+wyeD22O/hW9g0ffRSBp9iimpLfGxoM3T2:CQMiqbBo5eWUg0ffR6UpL9MS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678820, "uuid": "56525559-9cff-444f-afed-954611ef09d7", "value": 1997440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678820, "uuid": "f6774664-52f5-4c62-9da8-de8ec57456bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678820, "uuid": "6639c6e7-6d3e-4fb9-b1d0-5177383cc0cb", "value": "e43bd6491d398710f23436f2cd3bd073.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c02a6c-9c45-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674605786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605786, "uuid": "22979403-d4c6-4c4f-8e93-7d8425166c9f", "comment": "Malware payload (Smoke Loader)", "value": "f160eab39b57c01d466882419c67776a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605786, "uuid": "c0eced34-4957-498e-b311-4dc3e5ab3ff6", "comment": "Malware payload (Smoke Loader)", "value": "c20ea4447eb6cf8bc12337930a62402b36f3de51b3347be21568055c89a11454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605786, "uuid": "e5c181f1-9129-413e-88cc-32eb6497c376", "comment": "Malware payload (Smoke Loader)", "value": "d7397c96efd9223762f3ad6249610277616b1380", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674605786, "uuid": "ac67fd98-d90d-4d50-95de-84c85a3c0867", "comment": "Malware payload (Smoke Loader)", "value": "029375666d57540c15037c7c99ad871523e0c713f6ada39bfbfa993cd49c360d69035899861366f017005208fed82996", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605786, "uuid": "ca94103a-a51b-4855-93cc-df653d5e35ac", "value": "T1E814E11279A0C073C45641745874DBE17A3AF57206E9D88B7BD80E7E5F302E1BB3A39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605786, "uuid": "8944b295-ce30-43ac-8ecb-929411e55f1a", "value": "5eb8e9ebd49d9ccce156e2e9eb6d0902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605786, "uuid": "23e66ab9-f7c4-4d0f-b2ad-dff971af128d", "value": "3072:wLBN2XhpzDDELqarlT5GdxrwNp2JXcBOdljuLhjLBa1A:w17LfrluQ0x7Fu9jNa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674605786, "uuid": "d7c9462f-4a35-48fb-9ac7-07e59769b2ef", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674605786, "uuid": "b2f6574f-b942-4946-a60c-c98972f911c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674605786, "uuid": "b60ee466-704b-4bb9-9a77-5f6b08873fcb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a7a0e2-9cdc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674670564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670564, "uuid": "72d4e610-b8b2-48d1-8f55-589cdb7bb780", "comment": "Malware payload (AgentTesla)", "value": "5825ef7d17c64fa0f221e00ed5f95dd4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670564, "uuid": "943c95d2-32e0-49e2-88a8-04b87dc01f14", "comment": "Malware payload (AgentTesla)", "value": "c262660b55454315e324a8ea112d2973f1676c614c20eaa479b78864dab7aff0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670564, "uuid": "9ddc7ea6-d7b4-47e8-bf6a-bc82cd60c310", "comment": "Malware payload (AgentTesla)", "value": "91be600a45c6b343c736d7b989c582084a56f860", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670564, "uuid": "7552fe14-a23c-4736-b89b-832494984946", "comment": "Malware payload (AgentTesla)", "value": "93da93f7801d68d85b7b735f6f89bacd556a966347ad1089a7a2dc14424d5460ad0384438beac08db00d8fe4695d1c17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670564, "uuid": "961d40b2-b32e-4239-bd76-24efb245a57a", "value": "T179249E2930DD044864F2B9531FDFF9AA8B77A3E112320E2611DD875B96CE856EE063F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670564, "uuid": "a47e7c96-da95-41bb-aa49-ad13a091cf9a", "value": "96:JEjs1VkB3w2JJJJJYGJJJJJlJJJJJwQJJJJJYJJJJJUBs1NJJJJJjJJJJJjJJJJM:JEAVkB3w3Cq1jlfh8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674670564, "uuid": "ba179bb4-b572-48f5-bfb0-fee173f8789e", "value": 230112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674670564, "uuid": "62aacc2d-1c04-4706-a0a2-15d4a5608728", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670564, "uuid": "d6e6c958-46ee-4fa8-99ef-7f28b13abada", "value": "Factura comercial-20232501.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78946051-9c98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674641419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641419, "uuid": "780180c3-5db3-4715-88ee-75f78ea9c8b1", "comment": "Malware payload (Formbook)", "value": "c59007226b76f19d81731c274478a91f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641419, "uuid": "8269cbc8-c6a1-4136-aa6a-dad6644ef512", "comment": "Malware payload (Formbook)", "value": "c2d1359274d63fa192cfa5e08e73328b47170d2be743dee89bae0555eef65ace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641419, "uuid": "df948c4e-6e20-4df1-b443-19693e35e533", "comment": "Malware payload (Formbook)", "value": "226308c36c0a4f7b63a46e470f0d79c217c03a07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641419, "uuid": "901f7b53-d628-4b35-87e2-9485694f61b6", "comment": "Malware payload (Formbook)", "value": "d090d6c9710d73d87242879c5337b8693a8b860957b322af37160ef58fdfba1b777149de1acfbd47c14faaec0cd74452", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641419, "uuid": "7baed001-5352-457f-80d7-4d8e63f104ec", "value": "T13AE412365758DE3BC9BC10F83012654102FFE2137206EF856CF9A1F5A4D3BE29B6265A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641419, "uuid": "09e83019-ec9c-4e94-ba6f-19594e7d6acc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641419, "uuid": "a1b54ea4-2742-43ab-95d7-c5a5f37fe5ab", "value": "12288:20Q4KjkKYrubiXG+IF8zIqW5temxhjejvnapEOfr52oj1fpiC0mn/Yic4:oolr6Ue87W5tem2jAlr5lVwic4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674641419, "uuid": "b1804319-608c-4391-b955-1a27b2b3b083", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674641419, "uuid": "0f005618-9190-4b83-84a6-710e205e6f00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641419, "uuid": "eb5e346b-7a27-4685-a335-82dc299323a0", "value": "Payment advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93245cb-9cb5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1674654063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674654063, "uuid": "c4dd4747-0ab7-46e5-b729-7cf9536d9576", "comment": "Malware payload (AuroraStealer)", "value": "252fdb6dfb35b74ef1863132f8d9be7e", "object_relation": "md5", "Tag": [ { "name": "45-15-156-206", "colour": "#5801AD", "exportable": true, "hide_tag": false }, { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeImpulseGame", "colour": "#AFCDE4", "exportable": true, "hide_tag": false }, { "name": "StellarImpact", "colour": "#54447E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674654063, "uuid": "7fdd7212-5dab-4dbd-85e5-35c795e2a6be", "comment": "Malware payload (AuroraStealer)", "value": "c37b82f04b41b6172687f81f5e9c4067fc47a7fe571e2c447b2aa09319b24a1b", "object_relation": "sha256", "Tag": [ { "name": "45-15-156-206", "colour": "#5801AD", "exportable": true, "hide_tag": false }, { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeImpulseGame", "colour": "#AFCDE4", "exportable": true, "hide_tag": false }, { "name": "StellarImpact", "colour": "#54447E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674654063, "uuid": "03e5f8d6-7d19-470a-877b-88f452a4f946", "comment": "Malware payload (AuroraStealer)", "value": "ed4af7944996302aae66cada45b405fe6a93dc9a", "object_relation": "sha1", "Tag": [ { "name": "45-15-156-206", "colour": "#5801AD", "exportable": true, "hide_tag": false }, { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeImpulseGame", "colour": "#AFCDE4", "exportable": true, "hide_tag": false }, { "name": "StellarImpact", "colour": "#54447E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674654063, "uuid": "02f6ca82-8685-47df-acb8-451c23c3ecd5", "comment": "Malware payload (AuroraStealer)", "value": "ba111c96121b46926b877f4d05b92ab176c625fd5085b2ec2bcd3e91f78b141175db9c54bf33d3a1a2c0bb29fe7b6ee8", "object_relation": "sha3-384", "Tag": [ { "name": "45-15-156-206", "colour": "#5801AD", "exportable": true, "hide_tag": false }, { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeImpulseGame", "colour": "#AFCDE4", "exportable": true, "hide_tag": false }, { "name": "StellarImpact", "colour": "#54447E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674654063, "uuid": "f8d03044-8cf9-4243-b223-086422c42b62", "value": "T1AB07008C329036EFC867C532DAA92C65FB50F4B7832B8307951B01BA9E5D997DF540E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674654063, "uuid": "f903b4dd-6d8c-4754-bee9-ff6f950b58ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674654063, "uuid": "de239544-5250-42ec-b605-4004d191c367", "value": "98304:crtfNK6qX+OKGx8ScqoCj8BI6WY+l6hTCWxk/p6c:crEX738Sc1Cj654whFap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674654063, "uuid": "3b58fff9-6c8d-49f5-b04d-d5bf89c9908d", "value": 18376192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674654063, "uuid": "00efaed8-5783-42af-b285-165f72390d60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674654063, "uuid": "b79ad10b-89ed-44fc-81a6-58381876beb4", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3b3fd1-9c69-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674621076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674621076, "uuid": "b295141d-3195-4593-92f4-f4b68938178c", "comment": "Malware payload (GCleaner)", "value": "e19d2d9c997ffb544012a67f3e8a3590", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674621076, "uuid": "ea38094e-ceca-47c7-b572-cec21cad0860", "comment": "Malware payload (GCleaner)", "value": "c3af387f2d137918acd6a12892166c4ea2427d8747815fb6bc6b7b672b04e624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674621076, "uuid": "9fc2ee76-deda-4e21-b6f4-4340aee3498d", "comment": "Malware payload (GCleaner)", "value": "b8374ac4f0cb2c25e4d67c0843a9179d0aad86c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674621076, "uuid": "1c7bf46c-61d3-49c7-a28d-96ec822e0292", "comment": "Malware payload (GCleaner)", "value": "483f4ff3bf4a44710dc013995d188a3a815cc0cd576930f1e166386c907138d152d5423835e7237f159f18f7b1425089", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674621076, "uuid": "642f8a8a-86e6-4820-8237-bc119a4c7704", "value": "T12885330E54E7C139D5A382384D3D0267AE87B7135D38A736776F360B29EB3A58079227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674621076, "uuid": "7ca34fac-2498-4715-9b5e-fa3819c4ee83", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674621076, "uuid": "3b11822c-ca2f-4e81-b5e9-296fa8b26556", "value": "49152:ZLQX03fFXOon5bajOr1l7h/t2lGLCgv2MR:1J3te8eKBlF/tTv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674621076, "uuid": "5db9d2a2-d572-4265-a2f1-a57992ee0a61", "value": 1798328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674621076, "uuid": "54f26fe5-7674-4fce-acbe-e0825082dae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674621076, "uuid": "e17b945e-e318-4f75-a38f-5c22fcf69905", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d478cd0-9ceb-11ed-88f6-42010a9c006e", "comment": "Malware payload (MarsStealer)", "timestamp": 1674676940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676940, "uuid": "b47993e1-aced-4660-85f9-fc308b9560c1", "comment": "Malware payload (MarsStealer)", "value": "ae46e36ff036a92805515b93445f7415", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676940, "uuid": "f948626a-a186-4f5f-b450-5696efd99937", "comment": "Malware payload (MarsStealer)", "value": "c3e28416d68e5250a174a6379735a876637da5a303820036220a4c32039d2c59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676940, "uuid": "eec9871d-aca2-4858-9848-5a0356652bc3", "comment": "Malware payload (MarsStealer)", "value": "62834c7a206704b57c24c117207e86022fbe21a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676940, "uuid": "a33ef3da-a914-4111-880f-568bfeadb6b6", "comment": "Malware payload (MarsStealer)", "value": "db5abc7c351472b932fa460d99c03c8e9e388435a497b356c97e0f8b481d706a9f02074c36e38aa025d05497ee370847", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676940, "uuid": "f0c2ad2f-7c59-41eb-bc63-20e1b09bd975", "value": "T10E44C040B8D38472DD7225365435B7918B2EF8F06F61E9AB6B6806FD0EF01C146789FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676940, "uuid": "ef2529fd-3afb-4ab1-977d-b1cdc6ee1365", "value": "a0abb8d442f8e320226e5f4826a7a7d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676940, "uuid": "ada0a5ee-a6be-4de1-b6b8-d7e8511d4e5a", "value": "6144:viJ/qA4w/y9wth/Fyp6jchSGuA+lMD6RlBPnG:KJ/TB/Up6ghP3+tvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674676940, "uuid": "e106d96e-36f1-4b4f-b464-173965ed6d2f", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674676940, "uuid": "379d2e3a-7031-4083-b33e-6cedb593f7f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676940, "uuid": "98e9c902-56e1-4b01-8c7a-7909ca0dde01", "value": "updcenter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83de1237-9cf7-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1674682240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682240, "uuid": "20f4a689-cfbe-4257-94d2-9332730a15c6", "comment": "Malware payload (NanoCore)", "value": "6757e0d714b91f3bb8c93b3da87773bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682240, "uuid": "c5936d06-0ea3-4777-b0af-5c30709ee4e6", "comment": "Malware payload (NanoCore)", "value": "c60ca254cda5e786866913ff68cfe9a24c6b019902639c77e75a8428b0580b1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682240, "uuid": "4da3c43b-7729-49fe-8044-33bb8078ea9e", "comment": "Malware payload (NanoCore)", "value": "52f94b62c3036e975929b9a23be7392a1a7ffa51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682240, "uuid": "73d4645f-a53d-4a33-a56c-34b156784efe", "comment": "Malware payload (NanoCore)", "value": "851a868a7d7abcdce26f20a2a2f51dfe3f2a2c8bc7c6597fdec822497579a1943991bd0a790794651a384fa2054b147a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682240, "uuid": "3d3012c2-c913-4eea-b37c-7dcbd05d648e", "value": "T1E805BE0079F390E3F8D7487A513966CC9E2035166753D23766F87BA062036BBBAC6772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682240, "uuid": "f458c12e-f65f-4668-8e63-612efac3b32f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682240, "uuid": "f3c07efe-4371-4198-acfa-c9d47e54b098", "value": "24576:5pZlh1cconBuOhjSXsjTNE5wrqhTPVcl7uicMRZBLeb15YtVXGqdr2a:yjTNywrCPVcFvcMRZBUCJrZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674682240, "uuid": "9d5f557c-4a51-4860-aad0-b663d994f597", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674682240, "uuid": "cadbe2d6-cd7b-4e57-8bfc-187e959fab31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682240, "uuid": "3ead0fef-13d6-4107-b3fe-0c9564c17ce8", "value": "6757e0d714b91f3bb8c93b3da87773bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164ba625-9c95-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674639965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639965, "uuid": "882af77e-58c7-4924-9fc5-e2a32b3d6865", "comment": "Malware payload", "value": "666b53e3beccde8815cd091e63c23d78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639965, "uuid": "2866219f-707b-4bc2-8101-51cda426a98b", "comment": "Malware payload", "value": "c6e286c0747ddf5ca037f1bc37b87b040a87b5a30912b94604e53f1bb33493dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639965, "uuid": "2267122c-5f9e-4bdc-b538-607d80a45a4f", "comment": "Malware payload", "value": "6d0031bf572e194368c5d497e5a4e5c50469cbb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639965, "uuid": "8330b775-5d3c-4758-8d7f-a15046d5e52a", "comment": "Malware payload", "value": "70d4b0d2bacd520ef521895ed55c6f91f7de933816081d4ade87a073df86c0370d3685df4e7e3cc3668822a45638d4ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639965, "uuid": "5dc29d1c-8eaf-4881-ad76-3d21481a55ee", "value": "T15C449D12E2A4BF61F9DDCA328D4EBBE87A3DA5004E156716227C7A3F19741B1C16E30D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639965, "uuid": "3b5f7bb1-31b0-414e-bdfc-2ac88fbf3f06", "value": "861af707b319724b1132a7a971c54bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639965, "uuid": "f3451012-eafe-498a-afc3-16690c0e3bdb", "value": "6144:C9YLM8gPcKQiDKXQmSrweFS0bO+n1QybGDjq7VWRFBMolz/:wY4rhQKo2Q3O77VWR5lz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674639965, "uuid": "4e84cec2-8008-4018-9ffa-fca43fa46b45", "value": 255208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674639965, "uuid": "9523dfc2-e898-4985-9ff8-3a61cb0bd55f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639965, "uuid": "efc6577a-f2ae-4831-bfca-3355d3dd070e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c201b78d-9cc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674661728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661728, "uuid": "23cda675-eede-4580-aef6-1579af796a2e", "comment": "Malware payload (Smoke Loader)", "value": "4d719d38719abe262b054e26681f24e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661728, "uuid": "c7ce9e94-1a0d-41a1-899e-011dab5f19ea", "comment": "Malware payload (Smoke Loader)", "value": "c713e47d65d203ba8202f465048c79be0b9ac60526391ec6fb15c9bd50e27739", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661728, "uuid": "628cdc6d-f2be-4ea8-b873-5f088818ae1b", "comment": "Malware payload (Smoke Loader)", "value": "de14c06abd0f041fe90f0ff99c234c553119e022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661728, "uuid": "0ab5b124-938d-442b-8bd0-eabbe1f088ae", "comment": "Malware payload (Smoke Loader)", "value": "a8cbb797779a8245d5d8c9f04c7e8012b20ef25df75ccb343fd290180d24b189e23eb0baad789ce423d73c93ca55ada4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661728, "uuid": "221249f2-432b-4d34-bb0d-879d19ad13fc", "value": "T17E649D12F694B8E1F55ECA318D1EDBDC363EB9504D356F6A326C7A2F29702E0817A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661728, "uuid": "69395a17-085c-494a-ad5f-0a86750bcc19", "value": "8f16ef841269728457dd532b4a807550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661728, "uuid": "a574aa17-b99a-4823-94f3-3da4af6ca9fb", "value": "6144:3xLOUezL4tYpe1O9xgGq0VvRFBMolz20OaHy:haVzLZpC/0VvR5lzYaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674661728, "uuid": "dac852b7-b2f9-4bbe-94f1-2d806dda443b", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674661728, "uuid": "0b90d798-b248-430f-98e3-bf3712d89f78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661728, "uuid": "42d59da0-4d7d-426d-a01c-0db7dc023c08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3567fe8e-9c86-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674633575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633575, "uuid": "21230b43-a359-4b26-bc45-fbdb5acc7714", "comment": "Malware payload (AgentTesla)", "value": "25a194979b7a1c0b1f0c367d71aa2eb0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633575, "uuid": "92f64619-6551-4fab-889a-0f18eff43af9", "comment": "Malware payload (AgentTesla)", "value": "c7859e38dac67d93a0be63264364683ce6fd6b22f9145fdf7f45294458cae5a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633575, "uuid": "d3bed1ee-a12d-4494-9b09-756ac4dd6b58", "comment": "Malware payload (AgentTesla)", "value": "281b9fae658ea6c29b4b75a635f03be80c412ed5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633575, "uuid": "1f4a7e65-2c15-491e-8bbf-552fb858e56f", "comment": "Malware payload (AgentTesla)", "value": "f9aecd0c5910576140eea44b37fb364e5ad80544ee2ae1387ff37f630468f71531a9dd1d3e26e00fa696377e5e383342", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633575, "uuid": "d81f70aa-f3c1-4812-94f0-c65df84feb47", "value": "T1529423407A71C42BFE121E3D2DB653B02BC9D94114A8DB5B17A04EFA7D3A3518E2AF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633575, "uuid": "7bc802e2-e45b-4a7d-a8b1-ee35673bcca4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633575, "uuid": "e7c3c235-1c71-4ac1-bc2b-2b1a18272f98", "value": "12288:vY4rBIDQeHEurQugZ+BprU3uT4DrKbBSlF3HL:vY4aDQdur/583KbBSlF3HL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674633575, "uuid": "61626a1c-5766-40b7-969b-7b24f9a1aec0", "value": 411925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674633575, "uuid": "8d2514ee-7f53-4a0f-9a64-ff22202d6062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633575, "uuid": "447787c2-3dc9-4c35-9968-71af2365953c", "value": "new order 00029485886459966 dated 25012023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268d12df-9cd8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674668769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668769, "uuid": "76dbab2c-2b51-40a4-a652-537d228b4f50", "comment": "Malware payload (GCleaner)", "value": "5c300bbcc61337f140c9223ba8dbf731", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668769, "uuid": "86e4bd68-7c81-4165-af55-1a9fe6d12d2e", "comment": "Malware payload (GCleaner)", "value": "c78eaf8f772a4700fc34f5a41a7a856d9ec18e1cbc8933d496040dc38783d0e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668769, "uuid": "9e26be6f-39d6-404c-8d83-f71d2b83628a", "comment": "Malware payload (GCleaner)", "value": "094baf487291060f5f7725c93616a025c9cf88f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668769, "uuid": "22ddc14c-af4c-4daa-8f52-c8e7a8a84316", "comment": "Malware payload (GCleaner)", "value": "7f3c1498845b4abdba8a7047d67d664d0965983b897a4d3851680441ca016e7815eeafdd0a7d64bb11fba59941600506", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668769, "uuid": "15ad996f-df53-499e-80a3-afa154c4fe1f", "value": "T196853332B9828931E1C2E7B90C25DB95B475BC7A0064A4A8724E9907F737FC0F5BDB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668769, "uuid": "58d195e3-c238-498e-a65a-ada0a32e99d9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668769, "uuid": "522dda5b-25e8-4133-8180-a567748e5862", "value": "49152:ZUCk+SUmb2KYIkRilRWBTTUcUMPCDOzMiort52b/r56fFLCgv2MR:KVUVIHgRoDMnzoB5azG5v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668769, "uuid": "2c7a5edd-3ff6-47a5-abeb-8c0874a27b41", "value": 1811284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668769, "uuid": "5866cf72-62f5-4f35-adb7-bf03b0af775e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668769, "uuid": "0865c466-0389-4730-8b6d-f110b7e4b64f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34f49e1-9cdb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674670374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670374, "uuid": "1b7adbd4-35da-43a0-94fb-98faea0419e9", "comment": "Malware payload (RedLineStealer)", "value": "0bf4e02198bafa59899fb82195cfc35b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670374, "uuid": "47e0edad-b08b-4f6a-af49-d5b93cf82551", "comment": "Malware payload (RedLineStealer)", "value": "c86b784d438620a113187eca70fb2ee3e89c6fdfc436ad801997eeb67be95959", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670374, "uuid": "d2a70350-982a-45a9-b4f2-cef6f7838154", "comment": "Malware payload (RedLineStealer)", "value": "6cd0f3949ce49a7831dd43f709a0cff97aea2003", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670374, "uuid": "b0c9fe92-dd0c-41a7-b31e-ae2bad6f065d", "comment": "Malware payload (RedLineStealer)", "value": "d6a0507ed3e2995d1256543d2dcb6343345fd7a7127f299b4823e4c1f5f95e072ed0d26b046acea0fb33a241d7e3ee94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670374, "uuid": "9f220b15-3bf1-4543-a4e3-1ec3a0afa597", "value": "T1FBB5018677549053EC674A708E63C3D98769FC90BA34318B3365F39F1B3ADE26A90B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670374, "uuid": "c5d1c3e9-240d-433f-b48d-4a9734a192a9", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670374, "uuid": "aff0ad67-c0a9-4635-8805-e40bfefbd0ae", "value": "49152:cpm0lyDeb6XyJ6bXdZ2/q89S5ycxwZW5zpiwN:cpmbcIdZh5ycc8zpiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674670374, "uuid": "23a588d3-3447-49f4-a94e-b685b36f2a24", "value": 2446336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674670374, "uuid": "f38b983a-5f78-474f-a042-472e58dc333d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670374, "uuid": "9636084e-bbfd-4f78-8cd3-9156fa0b1ce2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf71a4d-9cc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674661800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661800, "uuid": "f99f53fc-f942-4c9e-a55e-81b2872107fb", "comment": "Malware payload (GCleaner)", "value": "011ac634029778c508607533853e4c9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661800, "uuid": "479e25b5-c1bd-4fda-aed4-0858caf7f390", "comment": "Malware payload (GCleaner)", "value": "c895cad9c6627e4cb28faf14fd0d2e1d3d032739fb301a2ce13f80ba73222edb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661800, "uuid": "5f1c5c68-decd-4433-995d-32867ebaeafe", "comment": "Malware payload (GCleaner)", "value": "a89bc6b3660b82f09cb49270cceabf7b2d778967", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674661800, "uuid": "8e2dd144-ada6-468e-86e3-a657ed46a65a", "comment": "Malware payload (GCleaner)", "value": "74d1ea1b90ebf6d6250d8dfbc38fbe2d5b0b9ce91f9ee0f5ecef0ae2ed0982f0ada54c48a896cfa3a59e4572ffc5e8d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661800, "uuid": "23d97315-9763-46ff-9964-7c807f6192d1", "value": "T1CA941207B295C47AE031DAB02FA2C1715A3B7C2A0AB9192535CD5ECFBF770C5610ABE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661800, "uuid": "f1e68468-beff-4865-b751-0b3f2bbb65bf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661800, "uuid": "e3a2e68e-907c-48a3-95ae-32f3175b659e", "value": "6144:S/QiQXC7bm+ksmpk3U9j0ImcooXQQd+zJjMIBDzOJOJzjUP75mUY9/wv2Xa0RQW:aQi37i6m6UR0InXjIJjfDFJzjJ7hR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674661800, "uuid": "5fa0b0fd-985c-4e6a-9bb2-0e24d521258b", "value": 418371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674661800, "uuid": "8ffbdd5b-efb9-4411-b1b1-3b96c3c5651e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674661800, "uuid": "e1903e66-eaae-4f4c-9879-8df345d24399", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2464f15e-9cc2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674659316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659316, "uuid": "e2206d0c-32fa-49fa-b4ac-b5ff7be9d019", "comment": "Malware payload (RedLineStealer)", "value": "ac03f8d0dcb3ad6ab888782e0a1634ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659316, "uuid": "790598c1-6841-4fa1-9fef-f76d9a3d6443", "comment": "Malware payload (RedLineStealer)", "value": "c8b10c12cb16cb14125bb2f9e3d1e96012743a1e77dd038851e2d949ab0d0c94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659316, "uuid": "21ff6416-b52f-4976-a3d3-5626a30a12e9", "comment": "Malware payload (RedLineStealer)", "value": "d788e015a72169f24d39491eaaf95050dfaa2da3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659316, "uuid": "c23477d4-475d-43e7-a82e-58eb03f89f7c", "comment": "Malware payload (RedLineStealer)", "value": "2dcf68d955f04b0c8e15982d8f2fcd2a96f463586e892b526d0248d4cb61fcc41c5755396b34cfdd32d8ec0a23eae1a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659316, "uuid": "918ae2de-c69c-4f7c-a4ab-f81346597991", "value": "T1A53551DAB7627764C094BF728206011C21A417A3AD23E10968FCDEDD0FB67E96E1EF45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659316, "uuid": "0f7fbb96-3308-4a47-912a-ad0426a8745e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659316, "uuid": "6a90b51c-3993-4a81-8186-a32a6fa5a838", "value": "6144:AU79B31HTZO1IxfuslzYx6fy07x/3J1QJc6T2vrkYAWAoOhClJ8KF1Druxs1IP:379rFTlz8My07l3E0TAWAzglf951", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674659316, "uuid": "10a640b4-a756-4ced-a4f1-5654a788edfe", "value": 1058464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674659316, "uuid": "ec114182-1c20-4e58-81fd-228f6c3ea7a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659316, "uuid": "98a7b0ab-9e74-4c2b-8273-a42067555d05", "value": "MyDocumentsGulinzky- Document.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac98886b-9c71-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674624755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674624755, "uuid": "8cd6a7e8-8f5a-48c0-ab1c-97fe77f6e973", "comment": "Malware payload (GCleaner)", "value": "b9d8f3db315ee0ec9cb121015628e7f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674624755, "uuid": "b452d448-665e-4f40-b83c-ca401c9afb2f", "comment": "Malware payload (GCleaner)", "value": "c8e68829d61373241c04f6459dc316b66f7ed13d9a39736af6d7f107a23ae022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674624755, "uuid": "481a44bb-0d70-4e05-b39d-0604bade1a1e", "comment": "Malware payload (GCleaner)", "value": "5b2f972f83a9d6a18a791b3c45d4478ec4ff33c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674624755, "uuid": "9b22b848-663f-482f-9256-97104f55db0e", "comment": "Malware payload (GCleaner)", "value": "63a92daa67bc2fb19fc865139e98d6f45ebe05c027e22d5e2cdd6fe116563d5cf687b1eb8dff2c6307fd4262e7d8068a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674624755, "uuid": "55d63c37-a86d-42a5-9e3e-9047cf49bfbb", "value": "T12B85330795BFC53EC512C6348D35C8826476B94D19BC6360BE8F72AB1EF279468203BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674624755, "uuid": "c368be0a-a7da-4a0f-b8cd-6c10b35ae650", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674624755, "uuid": "2725eea1-c2af-4dc1-afda-27e66a39eda2", "value": "49152:ZMn0kk+SXBhjdYBx/ucHtWqQJALMDTjzZ1lLCgv2MR:20kk+mBQBhuctQOETXZ1Zv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674624755, "uuid": "b7aa727b-4871-40eb-890d-fbab2c6d739c", "value": 1808858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674624755, "uuid": "dd8c623c-715a-4171-99ce-f6ce615fbe81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674624755, "uuid": "d7964b28-04f7-48af-81c5-24f05eff6b73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afd6d45-9cdb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1674670199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670199, "uuid": "1792321b-9c2d-456e-8750-6f8bc6cd7f43", "comment": "Malware payload (AveMariaRAT)", "value": "f1d631209c008e7bee8fc91f5d755495", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670199, "uuid": "28350133-bed2-406b-88c7-7d685845a65d", "comment": "Malware payload (AveMariaRAT)", "value": "c941f8b9955922cec6b9d049df25679b1c12f384c79fc2cacc5950218ace1965", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670199, "uuid": "67801ea0-cbe1-4914-bd28-8890376003f0", "comment": "Malware payload (AveMariaRAT)", "value": "7bc7d6ff56e745a80bd8af4d83a977c88bbb2b83", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670199, "uuid": "91272df4-bfe4-4e20-8820-1af40852acb9", "comment": "Malware payload (AveMariaRAT)", "value": "843225479b1c81f6f093606021f38d75cd2c2655daaed40936d3bb739b53c328aa7c94c73cf743a160670cd9ad369fe1", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670199, "uuid": "840e8423-ac7b-49b3-8e6e-08719e97020c", "value": "T1B6E4CEB72BE62FA3E1244BB5D2A7544823F0C9070111F7D37DEA11F88AD5FCA5B22586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670199, "uuid": "4c15f80d-655f-473a-94d2-7fb6a30efe5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670199, "uuid": "f8a2f2d4-e8e4-471f-9eb0-d12a764536c7", "value": "12288:O0TacS4nMlcQ2mnVJ7+iULr7YL9n+F5IBRKYWTHe1:Op4qcQxzqBgLrRu+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674670199, "uuid": "94a84266-abc3-4c63-a4af-3e2f6e405b84", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674670199, "uuid": "857bbb5d-c388-4d75-bd74-a4925359fc02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670199, "uuid": "983b31d6-409c-47ba-8577-4edf91e19ed1", "value": "c941f8b9955922cec6b9d049df25679b1c12f384c79fc2cacc5950218ace1965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ed9393-9cb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1674651561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651561, "uuid": "f549a587-09c0-42b3-9e74-e02e27220164", "comment": "Malware payload (NanoCore)", "value": "a2f1a93f12a307c40184377bf785e1bb", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651561, "uuid": "78243e65-da27-42dd-a40c-ff391a96a8e7", "comment": "Malware payload (NanoCore)", "value": "c9e24511c4ad318a7856b982a580202f81827100f9bc11c3112deb4409b6e2d9", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651561, "uuid": "ccd64bc6-713e-412b-a250-c2f501f3d583", "comment": "Malware payload (NanoCore)", "value": "0babde8d92931e2e30a6a1342b7203ae5c33c1e4", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651561, "uuid": "df6d9794-c086-4c32-a08d-0f12432ebc7c", "comment": "Malware payload (NanoCore)", "value": "6234be6171ace1dd14221b2941a0f98ca66a574e7f58363da937d5082c2345f48f5c90756f6abe7309f937ae35388979", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651561, "uuid": "fae49152-f30a-450a-a750-153202918842", "value": "T100F4232133D81691F66E03F19527D28243F27A52A135E35E5DD0B2DF2E3A7D04A60FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651561, "uuid": "3d85d9dc-b484-433b-ad7f-7c8b35bd856a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651561, "uuid": "5bd5d661-aa18-4711-a709-4dc3337dbf1f", "value": "12288:uK+MtEwcU3gZ+GQzjkATGdsnCLqqGTcaMAZ4Hj+gAgan+niKeBeHWzLHLtGEkgTa:un6AAgZbQzlGDqVzKjnHW+nfegHyntGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674651561, "uuid": "ab3f2fce-544d-4376-ae76-269f64fafa22", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674651561, "uuid": "3be4a5bc-e87b-457c-a466-71e9c3304a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651561, "uuid": "6ff3c800-b412-4ce0-b9fe-38210642e05f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fd6d3b-9c92-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1674638861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638861, "uuid": "2b2d46fb-6ff1-49af-915c-da822011edc4", "comment": "Malware payload (AsyncRAT)", "value": "5ae3dd349f2353e1693d6390f054366f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638861, "uuid": "97831369-22e2-43d1-a668-dfa81d6a83e5", "comment": "Malware payload (AsyncRAT)", "value": "ca4033db02bded2739ca4e31c72910e4c5995f9437cda0c4767a8113166d84b6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638861, "uuid": "549886f5-4c46-4206-b5fb-911cf85bc3cc", "comment": "Malware payload (AsyncRAT)", "value": "d9d22d2a7428d76cfd16ee01db9f8fb183012a14", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638861, "uuid": "d73082a4-265b-42f8-8fe9-6a232bf5b303", "comment": "Malware payload (AsyncRAT)", "value": "89bf9c3738a8b735d3ce1e3c99cf3d2522c54a7a317bda30fae1440b5de53e7c61a2531b9f5c3c11484a971aaa6f8241", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638861, "uuid": "ebe408f1-14fe-42af-8c65-a392dfc6c25b", "value": "T12BC5F1710787FFE6E3BB1E7890042D408C6524539F78D6A8BDCC25AF61E5634EA98B70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638861, "uuid": "ed15f299-ba9b-44ac-a670-8163fce21f1e", "value": "49152:rJXCD8nskw910xxQIcZ42V4XLjZcd5IzgK/sdZvaKBaJh:8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674638861, "uuid": "92b5f919-55d7-4fed-8947-027fd2946a6b", "value": 2717184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674638861, "uuid": "b9aaf79f-c4b7-4b4e-a32d-950b86651004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638861, "uuid": "cac68736-cbbe-4a27-a397-73b14e10cb17", "value": "5ae3dd349f2353e1693d6390f054366f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de51c6ee-9cbc-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674657051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674657051, "uuid": "36ddd1d1-dd5c-4bc2-ab8c-b680ee61e271", "comment": "Malware payload (GCleaner)", "value": "e340f1b29c325e47f1ef11c8e96bb2f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674657051, "uuid": "059dc312-ebbe-4552-97d4-a136ca17ded2", "comment": "Malware payload (GCleaner)", "value": "caf5ce983cd987fd9ec8dfb87551fea85ef6a13ebce20c7be19919c6b978004c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674657051, "uuid": "87c99b28-dc3c-4ca4-bed2-9c876677c722", "comment": "Malware payload (GCleaner)", "value": "500aca6aa1c40e79e0b1f22ddb7540be28d7bc22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674657051, "uuid": "25ed73e3-1294-42b7-9300-6a852ade078a", "comment": "Malware payload (GCleaner)", "value": "e17acc6978aba2141d48bcff37a5d28e1c53871971da0224e962f041fdeb22692286180a1a28b9fa999a082c724309de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674657051, "uuid": "f5429791-2827-4937-83ef-03b14b8d95c8", "value": "T1018533056D20C674E243DA7C561AFC70FA2366395AF5A01E382F2BCF07756A1C63A71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674657051, "uuid": "15ae4649-a842-405c-a6f9-e7cf99ab7a52", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674657051, "uuid": "ff0e1475-d54b-441e-b857-8abc1324075f", "value": "49152:ZDgqphqQlKqXQgycF/2Wwqq0LEHPLCgv2MR:K6qQlhfycFtq0sv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674657051, "uuid": "842717cd-b8b7-4047-905e-cc6fa7ce7fd6", "value": 1806516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674657051, "uuid": "c1897702-e6d7-4acf-b7a9-dcf579d2bf57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674657051, "uuid": "75ee4f8c-0c46-4fa6-9f6d-41840c1a8ae9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1891179c-9c78-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674627514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674627514, "uuid": "a97b7c93-e208-493b-96d4-312c49718dfe", "comment": "Malware payload (SnakeKeylogger)", "value": "52844e514a02ff16f33f91a9b6250aa4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674627514, "uuid": "4dae2a8e-f590-4a38-b263-c98446531c47", "comment": "Malware payload (SnakeKeylogger)", "value": "cb252bdd63776400aa0f5b41de8ea075a2acb0ef25bcbcc430adb2d356b9e751", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674627514, "uuid": "a630a7a6-8d08-4585-a4ed-7c88ffbc55e5", "comment": "Malware payload (SnakeKeylogger)", "value": "ec84db42ba80d22f5cf9980ae1d6945e8f14a1ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674627514, "uuid": "2c20af02-5900-45cb-9b4f-fa9aa0599752", "comment": "Malware payload (SnakeKeylogger)", "value": "5f142a5c45949aa2d50458d7bb4cb1777eafd975fa226f9f1bd2abff3cb601f970fc5be7646eb12e36ce4be05f22157d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674627514, "uuid": "ca99557f-f1da-430e-8382-137b17ef0dd7", "value": "T185E4BEBC7790FC8FC0678F7B85542D00AA60A4B35B47F383605B15A99A1EBDD8E146E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674627514, "uuid": "360a6b87-a5a1-4674-8c56-b1b5a72751f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674627514, "uuid": "3794717c-0ea6-49eb-b1d4-95483655134c", "value": "12288:RVaMFMZDC8CTDFjLMT/g1aWdYbjr2GVPXX/X80:RVapZDSjLMT/g1aWW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674627514, "uuid": "4e158366-7440-404b-bb62-2975fd1ca435", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674627514, "uuid": "ea0aa99c-8ed5-4135-ad08-a2c0681be25b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674627514, "uuid": "c7ba7299-c5ac-44dc-bf36-fc9fe60d17e8", "value": "52844e514a02ff16f33f91a9b6250aa4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e24e2b2-9c9d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674643549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674643549, "uuid": "fcda9143-9f23-4dc0-9c99-d42e442c4f44", "comment": "Malware payload (GCleaner)", "value": "dc5a1fc5015c1d6f7559751fcc51da0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674643549, "uuid": "ce7cbcce-9fd2-4682-b303-1a7c91c1462a", "comment": "Malware payload (GCleaner)", "value": "cb857dfdd1d7bbec2b68b6e1a5317d8f12169acba56f281caf6f06d7ae6506d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674643549, "uuid": "db4b1c3d-f0a5-4b1b-ab84-b8f05e21d28f", "comment": "Malware payload (GCleaner)", "value": "4d1e641f1857df03c1debb14e818ae2a5a329f8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674643549, "uuid": "7503547d-9ffb-4677-86aa-65dd8c4469a6", "comment": "Malware payload (GCleaner)", "value": "6d7e0650293f78a29de3deeb62edf09d4981fda871bd8b8531bdae7b9c0741e5207341a3beff57098ee830b70566d983", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674643549, "uuid": "0071bf38-ad19-4fcb-852d-6fe40b99b333", "value": "T11C85331F62B2C03DD363AF7DBDB8421121663A7578B4012670BE322E6E237D5D42AF56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674643549, "uuid": "b28a20b7-ba46-41a3-95f4-c0fb308f5d79", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674643549, "uuid": "19ce000c-3921-49f9-90b9-b70ff1e8e58c", "value": "24576:Z3QqaseyLaCmqJxoqtAQTazKxa7SOf7LnL42WCe6Cyrd+rOv7XNnbciEeLC15wvV:Zdr13e7ZDs2K6CyGOvpblEeLCgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674643549, "uuid": "652ee766-abde-4aff-b89e-f82bf3913b28", "value": 1811882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674643549, "uuid": "f941b10d-8d7d-4713-99c8-3c1c0d78f03e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674643549, "uuid": "b4cec167-41a8-4a0b-ba80-db04a7ffdae7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf5f663-9c75-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674626503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674626503, "uuid": "90507b92-badf-4f06-a277-376e7e3ca4b9", "comment": "Malware payload (GCleaner)", "value": "4749ccd0eed1a5ea0cd0b7eef3c09385", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674626503, "uuid": "3f3f5c1b-001c-4492-888d-bb50492deaec", "comment": "Malware payload (GCleaner)", "value": "ccabd50da10b24eac865a4ed0894fdbc576fc4da07ef51fc4bb74aa8298e3c7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674626503, "uuid": "334dda60-e636-4437-a20f-9c430dd80a51", "comment": "Malware payload (GCleaner)", "value": "48fe0235597e5e437d76bde17be6ab13b5ec8daa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674626503, "uuid": "cc7dcf44-5025-4c3d-8a3f-b82f3a8e0d46", "comment": "Malware payload (GCleaner)", "value": "89cbc1fc0963b89b99d8dda6e725fb797110677d6047846609db693521c915e9a5718940bc19abfc18d15a9932641386", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674626503, "uuid": "67f427e4-e918-49b2-a6e4-5637c9209566", "value": "T124853311952BECB5E16AE834262AD3E3B563B90732759694300E421D3F7BB43623673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674626503, "uuid": "711c1869-6630-4ef8-a212-169e99f27d07", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674626503, "uuid": "6a33e6f7-bd17-4689-a95b-b532562e5f5a", "value": "49152:ZPmOynyJafADazGoFpbaRRZieB8YhkLCLCgv2MR:YOyyWzGVRZi5YhkLqv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674626503, "uuid": "840e351e-872e-4b8d-afcd-abbfa5c6bb10", "value": 1821392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674626503, "uuid": "dbc77c81-69e3-4548-afd7-4b285d2493d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674626503, "uuid": "45f2ce00-77f6-45b0-8464-ffbc31e3e48c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61586196-9cdc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674670585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670585, "uuid": "09bc2984-228b-4116-8b51-76c074352f4e", "comment": "Malware payload (AgentTesla)", "value": "1fae1ca2c3e10934cd8393b6e22359ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670585, "uuid": "acbd1dd1-e832-4beb-b12f-cd2b22a3a2ce", "comment": "Malware payload (AgentTesla)", "value": "cd339559da902576f362c6acd41d1e473226cc68366d2b6279ec82b35aeeb506", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670585, "uuid": "d6dcfebd-034c-408c-a1f4-06ed15ae5e88", "comment": "Malware payload (AgentTesla)", "value": "4ad8f380dd76ed46de7d3a46ef6da2b3cebc2852", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670585, "uuid": "357c0300-d76c-4044-93b5-28ffc7edaf6a", "comment": "Malware payload (AgentTesla)", "value": "4e2a13d3b4a747f32f1d8e499f1f8c1eddb999a9229e305e51b15961deb5dddecb23aa2351893b9d78033203cde063df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670585, "uuid": "dfc62db3-e41c-4997-9ec9-0bf6480b6972", "value": "T1C115DF5072B8EB42EEA58FF5101155604BB22E5BFF24F3645C82B2E71AB3B903E50E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670585, "uuid": "b75bfeab-7595-4294-ba16-3f5022b3cd6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670585, "uuid": "a229ba82-863f-4eac-bfcd-36c2b9b68e7e", "value": "12288:Syr8kyGy+ys7QzjkATGds3MtEwcU3gZ+vV/+LZ7cyDPja3qA1TXamu3Cv+Oa:B8kyGyO7QzlGI6AAgZCqZ7Vja6U93vb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674670585, "uuid": "e0b5047e-c426-490c-8088-3f888acd6d10", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674670585, "uuid": "f5faa4c4-77d9-4f40-afd8-b5812c797b33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670585, "uuid": "9738d0d0-ff93-4081-bc41-a0ee8d2d3687", "value": "BL#-826486200.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e31f7b-9cc1-11ed-88f6-42010a9c006e", "comment": "Malware payload (MarsStealer)", "timestamp": 1674659023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659023, "uuid": "d3fd6672-989e-44f8-beba-5fec9440af94", "comment": "Malware payload (MarsStealer)", "value": "7d21a8aa942d32a99c025a4c995887fe", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659023, "uuid": "3ab2807f-4a74-43fe-98a3-af05703b96b5", "comment": "Malware payload (MarsStealer)", "value": "cda7c04ea8f3553465e5e52e439575464bc58effcf5e3ec06a332ce49d8bc67b", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659023, "uuid": "95a57b9e-6fcc-4c86-8501-b51d00c733af", "comment": "Malware payload (MarsStealer)", "value": "4bd697c21fee803466cda02a020479d43551f830", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674659023, "uuid": "311a0a06-a15d-43c6-ad37-d08855f58c00", "comment": "Malware payload (MarsStealer)", "value": "884a448fc0be6797921d1161ec8e83af9f3ace2c35e65cb6e5af1309f895d8d734717c207eab51e4fe9eb912253230b5", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659023, "uuid": "5716a697-087a-438c-8abf-7186d581d440", "value": "T1CE15DEA8EE53C0C6C88423B0CCA71E583776C4EADB111756ABBC5179DCC33186EAE5D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659023, "uuid": "15763ff3-8a11-42c3-8396-6dbd59bce440", "value": "6144:Izbz5shAjPj+ll+LZL1TfNsDQuQCeYG2dYo:I1UArEwLjZsUuDG2io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674659023, "uuid": "9fe680c9-aae1-44b7-96af-9373cb831bb1", "value": 902867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674659023, "uuid": "4aea7b59-67a9-444b-81cb-2ed3afad2b73", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674659023, "uuid": "909e65db-3ccd-4fce-aa1c-32d04eaf01a3", "value": "7d21a8aa942d32a99c025a4c995887fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5444d8ab-9cf7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674682160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682160, "uuid": "d0e5bcfb-3133-40ea-8668-4197f4dcba9b", "comment": "Malware payload", "value": "68a8c395545720b73fa41b82bbd42e1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682160, "uuid": "d5edcb63-560b-4992-af27-df9ddb3680cc", "comment": "Malware payload", "value": "ce93917c271af51a27103f649134b19d04d5f42969459a0130d500f13cb1c98c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682160, "uuid": "a8d2d1bd-1c2c-4d61-8f9f-db1047137c72", "comment": "Malware payload", "value": "2b120f71d67d3548c5333f1c024066ff9b67dab3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682160, "uuid": "5e0926c2-6a81-4ecf-82e3-a780721ad337", "comment": "Malware payload", "value": "7958014c63a8ad4c044bcc8a1e3be749bef3e3aa8d9810ab81625b443cedc839e54d7a4fea3b6e603eaea51bba393cfe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682160, "uuid": "c9119033-e2b7-4291-9465-699199ad3c36", "value": "T1E384BE2275D0A850ED294636CD2AEBD4396EF9D28F3C734732D8A61F2D732A0D532616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682160, "uuid": "39b3a14f-01a3-4d3a-879f-387fa54f2169", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682160, "uuid": "f054f91b-0fe0-4f87-b1e2-c4be093a5c11", "value": "6144:vnL1x6ymZkJVd6Nyc4u8kDNM5ztbiouT8AFT0+MOKXcWOUT:vnXBmZQVu8kDiDLA1WwUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674682160, "uuid": "389e1ccb-223e-4ad9-801a-f7e71aaf5f07", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674682160, "uuid": "fc0c8cf4-74b5-4f32-bbd2-14d3b50d19ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682160, "uuid": "46e06e12-fef5-434a-aee0-2b38a6800898", "value": "68a8c395545720b73fa41b82bbd42e1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490a48cd-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1674678705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678705, "uuid": "e85be738-03a4-4720-a870-4576f7e8870e", "comment": "Malware payload (PureCrypter)", "value": "4385abb8f1ffbb6ad3953295892730b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678705, "uuid": "86ab9aa5-2a4b-41e6-ab2d-62872cb28292", "comment": "Malware payload (PureCrypter)", "value": "cf496576e970c84e62e2e66d2c7d27339914d32087e9877aa4fe2cd2bf21255e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678705, "uuid": "84159120-79ed-45ce-8c90-85c96b65cc17", "comment": "Malware payload (PureCrypter)", "value": "34c74d4ee9850a36e746747022756834fdaa518a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678705, "uuid": "0bcda2e5-0127-4eaf-8afc-bb2ea2c29145", "comment": "Malware payload (PureCrypter)", "value": "7871369ea3ade5eedae76aba4cf9562f8b71487688879ef87ab62fcdda7a07890780e9e862b80e1ad34117060bc8a17e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678705, "uuid": "383ffbb1-2f71-4c3d-b089-dfe8f791f1f1", "value": "T1F22533941298A3FCC286407A78E3EFEB7756ADF74590CC2A3587D001EEC8D54A153DAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678705, "uuid": "bf1e6701-46a9-45b1-9aff-6ed5ea2560cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678705, "uuid": "294892e1-6bd7-47c9-9944-a94b383dc387", "value": "24576:ik+b1V8TTyGainaKNH+TH3tPIhcvz+HQei8RtDUr:qfK2inbp+BPG4KweLjDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678705, "uuid": "75e6d0fe-6941-4d9a-94fd-76f9979e9b89", "value": 1042944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678705, "uuid": "c0e9e526-9824-4d5a-87a2-a24e783a048d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678705, "uuid": "e3ad2804-7a0c-48aa-a4fc-9cd30aecbdac", "value": "4385abb8f1ffbb6ad3953295892730b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b384457-9c92-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674638846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638846, "uuid": "e91f07a7-585a-4573-88d6-7978f53fec4a", "comment": "Malware payload (Mirai)", "value": "a2dd50c74de76565008eb0d51203be18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638846, "uuid": "7e1aff7a-c119-489d-9c69-528aadf583c7", "comment": "Malware payload (Mirai)", "value": "cf9a4f92707d1f5cb736515405f87fbc655585bfd4d6f77fa5c1997c8f4d13a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638846, "uuid": "5896fea7-0c91-49f6-9ae7-9bfba61158a6", "comment": "Malware payload (Mirai)", "value": "8c8a7c2ae46846c0fa3041f4a4f39d18cdcf60a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638846, "uuid": "236b3aea-9c92-4fb4-8a86-6f46a05c6515", "comment": "Malware payload (Mirai)", "value": "d87fb1da49d0e95e6b8b6f3ffcc1c5e9ca17037414d8babe6a85ccdde2b2503a8d9b3d9ce3473e60a621ac7e161be7fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638846, "uuid": "7963a50e-0a82-4c9f-b370-12d5028f2280", "value": "T14783A4197F614FFBECABCC3749E91701298C651A21A87BB6B934D818F24B24F15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638846, "uuid": "f1d1dff9-31d8-4296-b2d7-93ac1d9f50b2", "value": "1536:gCH4wXmwLsNxPY4eEEueMh/uW1NKdIXYAZs2yAF85h33Rn:HH4wXmw4NC4eEBPYAiRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674638846, "uuid": "93588e56-5f1d-4004-9c1b-5ec2a2610da5", "value": 88296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674638846, "uuid": "1bbc4783-e246-4658-96d3-8bd2ffd8ffd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638846, "uuid": "be73d05e-3a9d-45e6-9093-2ab1e58c67d1", "value": "a2dd50c74de76565008eb0d51203be18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa62b06a-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674679003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679003, "uuid": "2eabcf41-bf55-4188-b9ee-f194a857d98e", "comment": "Malware payload (Formbook)", "value": "58a93d1d064b9e8265ea798531adb0bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679003, "uuid": "51afa8e2-85fb-4e34-bc93-7948d4886a10", "comment": "Malware payload (Formbook)", "value": "d036c4b1a4ff6265030084d453558c56f6a2d19b5a6af25943c47bc96895891c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679003, "uuid": "11e299f8-aa37-4e31-9cd4-bdf9a17d9faa", "comment": "Malware payload (Formbook)", "value": "d5e30f238fabd304d30ba2c726c71fb47765b494", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674679003, "uuid": "a1d45c46-4662-4bc0-9dcf-1fb98f6af158", "comment": "Malware payload (Formbook)", "value": "b03f91480a434f97cacda7976bf3dd5076a8c6dfc9b7b514723a586b13fd98db353d87a9c2cdb64d8b1efcec1aa086ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679003, "uuid": "f577611a-69f5-4253-a11f-1d26f25c7974", "value": "T11A742205B0B0D553D8930931EE7161B3BEB5E2062570920F13D4DA4DB6FA666AE0FBF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679003, "uuid": "c4a861f3-4644-4446-9246-8261f32807f2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679003, "uuid": "53679022-de1e-4076-a22a-8b72b13073ac", "value": "6144:PYa69K+mD7y0q2hhBCH4m6Qx8qQ5+/ucZiE2TZPwc7j0W6KmZE0HOkv/kBa:PYnUD71qc+6Q+qQuu/Tn396KmLDv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674679003, "uuid": "5012b7a6-bd86-4104-8916-444a8f116611", "value": 338902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674679003, "uuid": "c4fa146f-5f99-4cd3-b3af-84ca2bed3561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674679003, "uuid": "c45773c1-1843-4080-90ff-98756bc345ba", "value": "58a93d1d064b9e8265ea798531adb0bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0273187b-9cbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674656253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656253, "uuid": "9939dd79-7b4a-43e7-b667-0d63762ac1ad", "comment": "Malware payload (AgentTesla)", "value": "6c66d094ee537c6d1fc6f21c55dc38cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656253, "uuid": "c257ace4-bdae-4a69-9187-ac2c3ce42f95", "comment": "Malware payload (AgentTesla)", "value": "d07bee87efa9d63c230f1e4bb93dfcdec198e4ba69ca66e290d1e7bbc6f26078", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656253, "uuid": "4d670974-1508-4145-9660-2674d6d9f969", "comment": "Malware payload (AgentTesla)", "value": "f327867ebf343e7344d7c783acfbbf8d55a8bd83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656253, "uuid": "e72412e7-1ebc-41bf-bca4-5e1b88d56605", "comment": "Malware payload (AgentTesla)", "value": "e6b53944f6630f3745189d7014a3973c276139648840b37eac3fe744d948056de454ceb9b9d0191f435168755d13fa73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656253, "uuid": "3fd597a6-f58c-4c95-838b-1f709cde4bed", "value": "T10784221D6A9894B2D8130F766F3E1BB0DBF95403497223171BA4B79EF871260BD0E726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656253, "uuid": "139c942d-82cd-4bf4-8175-5209af388b41", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656253, "uuid": "ce607d65-f645-45e7-acf7-3518cbf2969d", "value": "6144:vYa6jf5vAYuDKa4Big8iXx2hwmBhB/f8LN1FTeuFGI7ayXZS/Oa2uD+8Mqux4NGt:vYZqdDvKiNhwmBhVfIbNGI+yXZS8uS19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674656253, "uuid": "09d525e3-5b18-4bd5-8a33-5ad14328bf72", "value": 379566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674656253, "uuid": "0e05fd57-1a7d-444e-bb64-86621629d6a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656253, "uuid": "7a869477-0073-44f5-8a41-ca4f6b1bcdde", "value": "Sales Contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47148060-9c6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674622867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622867, "uuid": "0b9dc5f4-5ff2-434e-bed6-f536ea793ecf", "comment": "Malware payload (GCleaner)", "value": "1b4063aa8e8fe02023a56cf72e633184", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622867, "uuid": "31030541-d990-47c4-a23f-8fc7a718b2dc", "comment": "Malware payload (GCleaner)", "value": "d07ed7ebf3e0363c9d674c03625db70a5dc3c33a643952e05f793f9329c7ecdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622867, "uuid": "07ba94d2-42a1-4c37-add0-5bd08f6495b7", "comment": "Malware payload (GCleaner)", "value": "8eee996cc5f0b171a7484194dd9b40db003fc11f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622867, "uuid": "bfe3d569-6ba6-4621-85c3-b2f22ecd7dd5", "comment": "Malware payload (GCleaner)", "value": "04552a52070b05fec1f593a8bf168bbf893db300eac75fe9f1982ab18cc106896e7ed5eb6f1e0098a2a2304d17682ce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622867, "uuid": "ae0a80d4-0666-412a-babe-b5ea8f24df76", "value": "T101853301D1484E76E332BB7068395136AFBF37141A717B8A300ED79B1B167A4A51FBB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622867, "uuid": "15900c97-862b-40e6-b72f-960439d1c47e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622867, "uuid": "06a748b4-e8aa-4832-80e7-be8f5f0eef8e", "value": "24576:Z3FLHHHrGR0Yv/PsUZbrcahvWFZqQkXS6sXJ8sWj4vrIUSUmm/LC15wvnPdszWnR:Z1HHq7zrcalWFGXnsCI8s/LCgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674622867, "uuid": "0022da3f-3a5d-48c4-8d50-e2816d64bab6", "value": 1782387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674622867, "uuid": "099664d6-fe4c-4340-b368-c58aabe772f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622867, "uuid": "ce12b945-6eff-4c59-ae84-9f59055acb87", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24090a8a-9cc1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674658886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674658886, "uuid": "38441b3e-2d97-4850-93b8-d8ef38b47a74", "comment": "Malware payload (GCleaner)", "value": "15cd8425010e6b8635f7c6ce610911c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674658886, "uuid": "6ae50a4d-73de-441d-b7f0-98ada15f0f1e", "comment": "Malware payload (GCleaner)", "value": "d0ceb2d3b14f15ded3b2fc1de357dd16c2e41e71700be5b73bef125393c4637c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674658886, "uuid": "af370e9e-d168-4bd6-8a67-dbe57864cb96", "comment": "Malware payload (GCleaner)", "value": "4147fcbf0131f4bba0a93467e079e5c70d433d68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674658886, "uuid": "d4fa13dc-2a65-4aa7-a7ce-ef2ecc3c87ea", "comment": "Malware payload (GCleaner)", "value": "ecce974e6183be81d08377b13386af160db3f2e5758a60ccdd081bf7d31a05455aa89a4970d7081078f840e0ad942369", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674658886, "uuid": "392b212b-5845-4893-b580-5361193d5bcc", "value": "T1A0853307A5A41876F277D93FDA2DC4B24838EC1824731D4A708C864F6E77BC13B49B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674658886, "uuid": "31f6cfe4-06a0-4d4e-bf2e-5727278583dd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674658886, "uuid": "fda7ab8e-ba20-462f-b425-042c7d34dab1", "value": "49152:Z2aYsqkJjJUyl51tcXQn9xMrLnLCgv2MR:waYsVUq1L9GrLzv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674658886, "uuid": "07216547-f5ab-4cf0-bb68-049c6c43c4ee", "value": 1774541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674658886, "uuid": "eb57c127-19e6-4c05-b03e-5a33db60c24f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674658886, "uuid": "9dd348b2-05b2-4f8e-80b3-37ef6c1b7d71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179d9806-9c5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1674615916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674615916, "uuid": "68d46c2e-452f-47d6-8fbc-8543b2b2f3b8", "comment": "Malware payload (RecordBreaker)", "value": "a7fe555cab8c285ce26bcb87be3f70d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674615916, "uuid": "82928fe7-1945-40cb-bfe0-760a39dc09de", "comment": "Malware payload (RecordBreaker)", "value": "d0d1673ef55b3de70e6f2264ee1c655e3d31966105a462663b4024a5511c7e90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674615916, "uuid": "f041b209-298a-493b-9fa6-e29984d9c9d0", "comment": "Malware payload (RecordBreaker)", "value": "3e82beac1875e3c121c8782c50ec3b5d214d56a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674615916, "uuid": "11414070-3e70-491f-bbe9-d17f60bb7bbf", "comment": "Malware payload (RecordBreaker)", "value": "f0d277b50227e499489ca3001f5827e65e152c53503c4788101e4e9f69eaa36beaa7bcb5bf44f7425c71b3e29f706e85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674615916, "uuid": "dd84d7ce-5e0d-488c-8c00-d8416e84f865", "value": "T11614E1327961C032C4A2A6791920FBD07F3AF97247D5C88777580ABE5F313E1566A3CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674615916, "uuid": "92d475c2-95bc-473b-aa10-47d0c5b271e5", "value": "5eb8e9ebd49d9ccce156e2e9eb6d0902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674615916, "uuid": "12e97860-da4d-4657-bc8e-af4a7d2d0f0f", "value": "3072:DLBN2GhB4iLXW0c5r5NN5DLb1B6kBR+pD/4WHaNONXTldWVItZ+:D1/LG0c5nN5DLptv+pzTXTls4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674615916, "uuid": "2660e481-1b5b-43db-ae76-acaf62ac8854", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674615916, "uuid": "c4d6d7fe-9305-4ed6-8688-a5399662318a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674615916, "uuid": "8eb9a41a-0e8d-44b9-b213-647c4e1e0e27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311078c0-9cd6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674667927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674667927, "uuid": "73cf45bc-bde6-42ba-ad4c-4ca70e508493", "comment": "Malware payload (Smoke Loader)", "value": "088d1ed54451c8104487db1892eb6749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674667927, "uuid": "8b24c464-8056-4fa1-b51a-0d3818ed91df", "comment": "Malware payload (Smoke Loader)", "value": "d263f40820fd79cd9844d220b5ff7faff789182f5e008b9cc45b298242d0b27d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674667927, "uuid": "9af6de92-3fce-4987-aced-7a8f19ce5270", "comment": "Malware payload (Smoke Loader)", "value": "c031c7074711ed8991f046b18c30132600a1d6c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674667927, "uuid": "ac4fdd54-fbe9-484f-9cb3-dc7d1d3c63dd", "comment": "Malware payload (Smoke Loader)", "value": "a98c6c14923d1f5da6dfd1129b4ab4884cbf3ca9043f9888f6b1b00db58242264fcca10675e4506884b8a320945a225e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674667927, "uuid": "0c3b5232-b910-4185-ae54-1ca660c41185", "value": "T15764BF2276D0B8E0F91A4A368D2EDBD4392DF8D28F3C375732D46A1F19732A1C766215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674667927, "uuid": "1b087735-49e4-465c-99e1-520a63e7e56d", "value": "8ec76f5c59a9f0c161f9365e55dfcda6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674667927, "uuid": "6866cedd-2f22-4a0c-839e-435892196fd4", "value": "6144:vH9LgwHuqQ7xf4rt1CM60+MOKXrqOKXUTU:vd9Hs7xf4sW/aUTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674667927, "uuid": "96148f68-5e97-4970-a7c6-7091058a4d25", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674667927, "uuid": "3a79c54d-acf7-4705-b652-7897e487926e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674667927, "uuid": "c658acc0-9494-4fd4-a406-c5f579ad77e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9b152d-9c67-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1674620355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674620355, "uuid": "a78b91c9-0337-4237-aa8a-374446364e0e", "comment": "Malware payload (ArkeiStealer)", "value": "fcbb2f1cb46482ba6e8293de1468ceb4", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674620355, "uuid": "25accc7d-cfaf-4651-875d-58b3f4426a91", "comment": "Malware payload (ArkeiStealer)", "value": "d2a0139f6206d6e6ad37a16d9fa10b8c5e45beac40ca45cc5217028a532981ab", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674620355, "uuid": "4ea2307c-beb8-4fd9-8f5f-164243e0d67b", "comment": "Malware payload (ArkeiStealer)", "value": "3f536b62d1319ebe6a3dedc919bc0790d217c844", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674620355, "uuid": "5bbfb359-33b1-47cd-b338-1e9dfafc3694", "comment": "Malware payload (ArkeiStealer)", "value": "5832dd23b21e7c8184c779ece1bc9fbe2452758a4b00655a948b3e383fe9114b913b6e9e2ffda4f2575281f2f2aa12a9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674620355, "uuid": "8c72a38b-d68b-4cf4-b2b0-dba62ddc7a52", "value": "T1C514D0227DA3C032CC9154754824E7816B7DF93267A9C8C777980B6F9F30AE15B3A396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674620355, "uuid": "06537692-7013-4913-b434-ee67134a626c", "value": "5eb8e9ebd49d9ccce156e2e9eb6d0902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674620355, "uuid": "6d3f7749-eebe-472e-a4bf-50cb977951c7", "value": "3072:DLBN2ARaDLCFBHU58/zYPleR9Cfnfnk6OxEo6cEWkWN+3:D18LMBH9z2eRcfnk6BbV9Ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674620355, "uuid": "569be8d5-4469-4391-9589-cd1fc25edfc4", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674620355, "uuid": "3f0d8023-6b54-4bec-a288-1a7da2081b0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674620355, "uuid": "ab378ea0-ef8d-4452-84e9-5ae08e70fa5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4d75c4-9c84-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674633028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633028, "uuid": "edc8ae4d-7cea-4f29-9621-7bc97179bc4c", "comment": "Malware payload (RedLineStealer)", "value": "357f0a1f86107cc6672d518f590a785c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633028, "uuid": "603934f7-b145-4e91-8238-035f3b51d5d3", "comment": "Malware payload (RedLineStealer)", "value": "d35a0b59e360c8ee6bccb1c07fd29592c4b2ec9a1a1aadbe2a3f91655eba5316", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633028, "uuid": "6523777d-eb8f-4876-ab32-6bfd38388a5d", "comment": "Malware payload (RedLineStealer)", "value": "1349dfac486bbbad0fd7db75e19a61a0b6298c63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633028, "uuid": "2273fd1b-0a6c-4157-9473-f796d18d165a", "comment": "Malware payload (RedLineStealer)", "value": "21ed574d7d76c255eaab9ababe805930480642075fd238fe27d132a3e1fb020490d838ff17f5be670041cd7b605bfac5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633028, "uuid": "3b685528-d04c-48ba-bd7c-e9115ba773ab", "value": "T11B14E0217990C033C4B745382961EAE5BE7BF97302A98C4B7B5817BE5F702D0663A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633028, "uuid": "b8944a63-f758-4331-a1fd-e8c00d0b1f11", "value": "0b7efb36250d99ac9280e9ab606e8d70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633028, "uuid": "47bc61c4-36de-4f06-a860-ca1250e9566a", "value": "3072:RBN2FlncVL3qPUPfe5xzOoMbnsDXzyvc2mm0gZF6kegtq:30eL3iUPf6QsDDyvc5m0gZF6kegk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674633028, "uuid": "d73e3099-a1c9-4619-8941-9bee058e2a15", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674633028, "uuid": "51d7e137-006e-4bc6-ae21-878dabd44876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633028, "uuid": "05680ffd-5aba-44c6-98de-6a5be93b74ae", "value": "357f0a1f86107cc6672d518f590a785c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb6c796-9cb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674651712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651712, "uuid": "58825d52-6778-461f-b5ec-7acd52fb9ed6", "comment": "Malware payload (GCleaner)", "value": "f51ecac6e4843ad4fb402abcd7353470", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651712, "uuid": "694d838c-3795-4682-8fa7-5dcf42db1b87", "comment": "Malware payload (GCleaner)", "value": "d52ac86218cd05163a998ed5dc3b4c68b15a4b14948f58d694d9969e57e38c29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651712, "uuid": "b0bf2a24-d5b4-4a34-8705-f3610606e765", "comment": "Malware payload (GCleaner)", "value": "0e295972eb196ee582b83beaadd708c532119414", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651712, "uuid": "7bc356d8-9c20-44f5-bf85-5a37f280bfc6", "comment": "Malware payload (GCleaner)", "value": "f84e4c4ec9c75a31063f53f8d73a1fa0f7333a39c553f3e971e7971de0fa0590faf7b113b284a0a38029f193d5170971", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651712, "uuid": "43a4d61d-8929-4a56-b903-af05728791e4", "value": "T16F8533955615C07AE063FB349CA90867A9B6FA3031BC2515B1AC2F97FDEB8D0DD06323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651712, "uuid": "ca1931bd-ccb7-419d-8537-36e946f524f3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651712, "uuid": "0f3024b2-92f5-48f0-bcd7-654063d12547", "value": "49152:Z6lrDG1mMn8zdllbgX89AgJOaqOvRxXkc9baCLCgv2MR:QlrDG1P8aSAgPqOv4c9bbv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674651712, "uuid": "6fd08bb3-42be-4180-a881-f1a1bc853143", "value": 1800097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674651712, "uuid": "5a269ca5-ec17-4dcb-8bd3-5ab756e18e75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651712, "uuid": "7e9eeab1-80e2-4fbf-986e-45f2ba8f5344", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a8dad5-9cf8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674682449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682449, "uuid": "96785936-e6c5-4ed1-994c-4b75227736c9", "comment": "Malware payload", "value": "9276173ed9e197228b1737145e3a5127", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682449, "uuid": "f317c31e-ae17-43d4-bbf8-561ddab1b3e6", "comment": "Malware payload", "value": "d553aec029b51ff35735dc7728b744466cc58177e8e2f44d39e131ad0b30489f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682449, "uuid": "b09ea16c-ea94-4a1d-906b-cf201bc68072", "comment": "Malware payload", "value": "253f9b233923f8cb243870b23dcf2d688bc594f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682449, "uuid": "1894a74f-4d99-47a1-b695-ce402ce5c8fe", "comment": "Malware payload", "value": "543260af29a8af1e13cab07e5a2ef006984d75f3514a1368a97e49524a29498100caaf5533a5883107b7edd316b94be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682449, "uuid": "7a058304-9585-40b1-acc7-1b014fd248c6", "value": "T19964AF2276D0B8A0F91E8636CD2ADBD4393EF8D28F3C735732E4661F19732A0D566215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682449, "uuid": "2b32e8eb-34b8-478b-8b83-d32f90508ac8", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682449, "uuid": "e11d1132-f2e2-4685-903e-67cce7f018a9", "value": "3072:iheX0JL32ndU78vfLRuL3BgYPjK4Tkd3P9F2J0YuAIoNg0+L4Oi/XcLYZ+pUT:JOL3qU78ML+YPI9u09AIEg0+MOKXGUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674682449, "uuid": "be3ab631-5351-49ae-a986-4cb92e2b62c1", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674682449, "uuid": "6f9887b2-a835-4716-9b47-6968f79e78a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682449, "uuid": "98d522bd-592a-4cba-8c2d-98f8aa8ba115", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b5b050-9c78-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1674627640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674627640, "uuid": "1c975f35-5500-425b-a1c7-fcc1d6fb3ac0", "comment": "Malware payload (Stop)", "value": "fe687ae6481826a3aaf50c87cf7a735c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674627640, "uuid": "2f879fac-5aa5-460e-87dd-bcf6f31a8aba", "comment": "Malware payload (Stop)", "value": "d5ba7a1b36fd9bfddc5f9ac2299f23632e21933f052b4b99fd4d7ce127212c30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674627640, "uuid": "e00918c8-e834-438a-8c23-2db9f9585c2b", "comment": "Malware payload (Stop)", "value": "49339a5bb61539f36cfc4940258a99a30bdfbcad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674627640, "uuid": "37c5ae55-fbd8-4d39-a56d-36d8a185f3d7", "comment": "Malware payload (Stop)", "value": "d3e047e693a259c3fa6f5d9b14f7c0a3f3d93d60652c649929ea71211b34f88cd26eee8d897b3e41dca2390bf8168ff8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674627640, "uuid": "4c368aff-4fbb-4348-a78f-4c7974368262", "value": "T152F412F161A0E47EC152D334481197E1865AAD260A72A6F73B14271F1E722C1ABFE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674627640, "uuid": "503df214-ee0f-4d55-af91-08955b978c53", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674627640, "uuid": "dd1cdda0-1d1e-4cd3-9b34-63e6d43b0cc2", "value": "12288:f87wuX6/+IZiv1oXKhIk45y/rMkAXM5xhhLqhHNNk+aT4E0uWPA4lcXoK:EHLIZGaKM5yKXgLiNu+2F0uL2c4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674627640, "uuid": "bf7ca8b2-ec03-4964-918a-4aabefca60c6", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674627640, "uuid": "638d47f3-c551-4443-b169-512744eb03b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674627640, "uuid": "fef7af97-1728-4848-bf0f-1354dd862033", "value": "D5BA7A1B36FD9BFDDC5F9AC2299F23632E21933F052B4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0922e846-9cd8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674668719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668719, "uuid": "64024390-18e5-4717-962b-b6fb59bad033", "comment": "Malware payload (RedLineStealer)", "value": "9c83827f217c34b764ff9d6899ccc78e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668719, "uuid": "e1bc280f-476f-44d1-94d1-756ddb03c46d", "comment": "Malware payload (RedLineStealer)", "value": "d5d8deb0a6da4352ded02c6a51c10efae2b030518247713ecb28274123b76fb8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668719, "uuid": "ca7ab8b8-8288-4c6f-8d00-d9a8ed9530d8", "comment": "Malware payload (RedLineStealer)", "value": "adce7ca8c1860e513fb70bcc384237dae4bc9d26", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668719, "uuid": "9ac5c45e-ed3e-4db7-961e-376c46622cc9", "comment": "Malware payload (RedLineStealer)", "value": "51fe2cfdd53c35fe9553717bf0e090a6f1a3e26be5590c2ad9a9d66f6432c9aa767d9d66293393033ea48e836feeb36a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668719, "uuid": "08d5517e-a3a6-4891-be20-f46de794fc62", "value": "T16393F12FE677B8788ADCE548F212C82D77BF9D22816103ED49431AC98A53F7CAF60551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668719, "uuid": "e9014a70-ee61-4bef-b736-f164ce46f93d", "value": "1536:InQJ5JEXld1MZIwZunelIIYFOvevv3mbxS9Q0dCvp+v+BIJjqST:IQJbEXz7eBFevvQxSSU+7ST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668719, "uuid": "5709020d-3fbf-4977-aaae-f1ad797f978b", "value": 89541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668719, "uuid": "80cc2564-e0b7-4ada-87ac-cec044f2df78", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668719, "uuid": "c887ba48-5c91-420d-8f0d-fa83919c03be", "value": "3cff9952-9eab-45a5-bdc8-671fd9a6c226.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8df7a29-9cd6-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674668155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668155, "uuid": "f89262eb-0e5e-4fd7-ad3e-3c8f1f6aaff9", "comment": "Malware payload (GCleaner)", "value": "18838b8f87d45acfe880ebaaa7a47417", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668155, "uuid": "cb164975-d036-4a88-a6e6-a4914fe569ae", "comment": "Malware payload (GCleaner)", "value": "d7a93a4b3e833c1e29a849d81a268acea5c24758671a7279deea89272a5786eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668155, "uuid": "f171a240-8a12-4a17-a777-b50360dfdf24", "comment": "Malware payload (GCleaner)", "value": "d597d617000c3f12c5adf42ec867db5d55d2e10d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668155, "uuid": "1391eea2-79ae-47f1-8bb6-6f17c1ead9bc", "comment": "Malware payload (GCleaner)", "value": "832917a3a70cc08602f360b5b1533bcad9489d22533023d7088130c791f044e37f9d887a6acaf3214046cb72298eff28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668155, "uuid": "1742ebd6-771f-426e-a612-26929b4a0ad3", "value": "T1D184BE22B590AC60FD290635CD2ADBD4396EF8D38F3C764B72E4661F2D332A0D536256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668155, "uuid": "1128cc77-19a7-4498-9e72-74996c3a83e9", "value": "8ec76f5c59a9f0c161f9365e55dfcda6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668155, "uuid": "68882c9c-04c2-41d9-8b14-999f5f20ec2f", "value": "6144:7LLLlPoIb+dSOzHMWshs+QCnaT0+MOKX2htUTU:7fNopdSOlW6UTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668155, "uuid": "33818a4d-e6d9-4c7b-b7f1-8ca4d925b216", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668155, "uuid": "11f7be57-7fb4-48bb-8a58-448ab413b5a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668155, "uuid": "66bc7976-20d8-4df3-b220-52f7e572cc66", "value": "18838b8f87d45acfe880ebaaa7a47417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069106fe-9c52-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1674611162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674611162, "uuid": "2cc705c3-9bbc-4a2a-b0bf-4603ebfefd80", "comment": "Malware payload (ArkeiStealer)", "value": "b90cee008b0cffdd8ef9a65f87fd4f2c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674611162, "uuid": "98ac0365-f477-4f88-ae74-5fc198831d5d", "comment": "Malware payload (ArkeiStealer)", "value": "d934e6dcda76c64e563cbba679f8e25646d5850ab72c15cc5d2ea4259ce2f382", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674611162, "uuid": "67597655-98c4-437f-bdbd-3fcd5aff59eb", "comment": "Malware payload (ArkeiStealer)", "value": "7cbf4383d746d05998471149bc6e652fcf5e89a1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674611162, "uuid": "cb851dbc-4d3e-40da-ac7c-95b68cb94c8c", "comment": "Malware payload (ArkeiStealer)", "value": "e60c18fedbd5b4801c39f768308b66f7937c0169dedca699165bdd4b36a6911e4379f0f013aa1499201754a391059372", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674611162, "uuid": "ac300470-4415-4ec5-af8a-db31f584eda5", "value": "T1C014E12175A0D032C4E745381864DE817F3AB97206B68C8BFB580E7E5F706D12AFA3D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674611162, "uuid": "ede595f0-6c98-4d1c-adc2-54ed26726cad", "value": "5eb8e9ebd49d9ccce156e2e9eb6d0902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674611162, "uuid": "c71f8ab7-a28e-47be-9b28-b92e68631972", "value": "3072:GLBN24fPRLX9kPY95jZkhmdwVAhg0M5uM65tM7:G1BLNkPYdk8dZvav6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674611162, "uuid": "06cd1982-018a-4ea0-a13a-1d19307ef08e", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674611162, "uuid": "d5f11fb5-be1a-4216-a979-097c7b61060d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674611162, "uuid": "c330f56a-1a87-41bc-a538-c4df9497d031", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b76e06-9cc4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674660288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674660288, "uuid": "d026c0fe-b3a6-4ef9-a58e-c8f76d6e7378", "comment": "Malware payload (Smoke Loader)", "value": "0a6c5a1589ce307de6910aa8ae5504ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674660288, "uuid": "3fa77b65-c223-424d-b731-1f5990d2bdf9", "comment": "Malware payload (Smoke Loader)", "value": "d95d8f734f2459ca045b7ba1de3af1603a31b06c2dde127f837e383f4a1425fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674660288, "uuid": "73c594ac-76d3-45b0-b102-754188a1a067", "comment": "Malware payload (Smoke Loader)", "value": "7e1168be4c273e7802eb560183c3dcae68d92356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674660288, "uuid": "61af4e1d-5d57-4f6c-a3c2-ae11599084f8", "comment": "Malware payload (Smoke Loader)", "value": "0bf716dfdbf6218ffd92824b0f3173232ef65d61bcb6892968c4bbec1ff39abc81e88ae363a8af1ee545c84a9c2d3796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674660288, "uuid": "c4b55cf0-f926-4cd9-8e3b-55859ef956b0", "value": "T14D86E1F0575DA590E5BC6C70C8D96E768313B736BC26EC33186479C06A9210AFDEB48E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674660288, "uuid": "dab87bd8-be3f-4a55-9edc-13de2c62f059", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674660288, "uuid": "5ab747a1-1f99-41f2-bc92-a7467e6ba64f", "value": "98304:Y5I5x3omArylYOI5CAaT+dPas2Yv0zcBWc1fldTRwaykXf1D:15xqyoaT+dPB2mwq7T5bXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674660288, "uuid": "b239951e-195b-43fc-8f06-ab407b6cd68d", "value": 8018800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674660288, "uuid": "53174ca9-0eb0-4910-8ab5-d637425b86d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674660288, "uuid": "95065e0f-5374-44b9-be41-e1af30b052f6", "value": "Setup_soft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b526f7f6-9cf6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674681893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674681893, "uuid": "c0c0a234-58c8-4ab4-8535-945f32b861b9", "comment": "Malware payload", "value": "566f7c74757de4be806d5408e501d288", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674681893, "uuid": "b8e4f212-1a66-402d-9682-f01fe9e9840b", "comment": "Malware payload", "value": "d9867c52268745b7a2fb54685b616d96a59eba3e1851912444696af65ba5451f", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674681893, "uuid": "a3ad431a-fc07-4708-a450-fc695e8aeb29", "comment": "Malware payload", "value": "21ad6bb3f75871a447da2fef5a533380d29ff239", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674681893, "uuid": "5c01ca2a-d8d9-430c-8dc8-2188d4258b9e", "comment": "Malware payload", "value": "bd793be0a310f207ca7df4701c6b687b50d1f8fec1f0b16850a0dd88facab7b4cac071c954c5d51a81b17dbf9457be41", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674681893, "uuid": "1115bc7a-2b10-49a7-95ff-3090f59a01d9", "value": "T1D3517424FA0BE2885BB16377DE5AD565FF0A001B6E93144431DCD2C90F3190EEA7DE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674681893, "uuid": "ccc0695d-a5f4-4281-99b3-0236459318e3", "value": "48:zUuDQjvUKmc4TQ7QZE96pAUKQyWKLrj6l1CelkEJmZsSpjBPCyxLSmNCDiKrsqlU:zOhrf8ypvK0elkEYZBpjBzZNCDiYsqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674681893, "uuid": "32be59dc-c36f-48f1-b1f8-80bdee088a02", "value": 3101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674681893, "uuid": "099fd81e-2fdf-4871-8c77-2dc80c08f511", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674681893, "uuid": "436383a5-f5ea-4bcd-9c8d-508d713901d5", "value": "Xu5cTKg8.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54fedcab-9cb7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674654673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674654673, "uuid": "c4141eb4-ecbb-4328-a1a5-dd4a1f832975", "comment": "Malware payload (Smoke Loader)", "value": "c90a40e062dda697a139bd6f7b3fc716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674654673, "uuid": "7dae0eb2-0d0f-412a-a5cf-8a0239257a6c", "comment": "Malware payload (Smoke Loader)", "value": "d9f293abaf9f703a4519eecb422834b69935f37e63990f619c54eeb1fd473b6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674654673, "uuid": "e4bfeb71-1ecf-476e-a030-e5f04a8993b9", "comment": "Malware payload (Smoke Loader)", "value": "70b4d84086c7ffa4d824801a0787c25b591ae779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674654673, "uuid": "b293d97c-a679-4949-bfb0-aada03e43172", "comment": "Malware payload (Smoke Loader)", "value": "c4163382502b466ee8bd7e494a6d31b261286f7821ca12f1b18fcbad1156238d4a9ddf6d06b2ba7c7a282e2f082f4087", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674654673, "uuid": "3cb81fdc-4cc4-4076-84fb-06ba512ce03a", "value": "T1B4649E11F2A4B8E1F71ECA318D16DBDC763EF9989F185236326D7A1F29702E0C56A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674654673, "uuid": "e867a722-9d52-4a3e-ab11-bf1ba5edb855", "value": "8f16ef841269728457dd532b4a807550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674654673, "uuid": "8673ac2c-90de-420b-8ea5-379689cb03e4", "value": "6144:S2LNlYuj024YEOWr9R36Gq0VvRFBMolz206IsB:3pGuj024Nr9NU0VvR5lzwIsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674654673, "uuid": "1d1619cc-ea03-40e8-8197-f591e0507ea1", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674654673, "uuid": "e42892b3-7d3f-4cb0-8122-623218d1c783", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674654673, "uuid": "cd9997f3-bede-4212-96bf-c0e7851c725a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abac213b-9cbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674656537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656537, "uuid": "655c481a-9a62-4bb7-a89d-00c559112012", "comment": "Malware payload (AgentTesla)", "value": "f1564a750ad7dd880a1b899d80d2dc35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656537, "uuid": "6a81aa9b-2ae0-432a-89f2-075cb486aca7", "comment": "Malware payload (AgentTesla)", "value": "db371d7f8c4a094062fbf4a9b34dab690af4f21dc8a2405e53c7abc5e401badf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656537, "uuid": "2d743041-9ad9-4485-b2d8-f137ab8ae14e", "comment": "Malware payload (AgentTesla)", "value": "31526b578f010e83dcf3e1423497fe57ee166dfd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656537, "uuid": "d6e9816b-9c6d-4c00-a716-87a9e5798db6", "comment": "Malware payload (AgentTesla)", "value": "14ab7e770423a8ce1a29564752607fa6b2c4657e97458b1586e7bebc2a44ae1bc2689ce7ee3546b726b401222380c118", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656537, "uuid": "58928b3a-98af-4b37-a43a-83619c99792a", "value": "T17A43F11FF42D1E557DD6B0EE28CC4FC158DD0AB921E29ED4D344217B80CFA6A0BA81E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656537, "uuid": "ef828208-ec70-4246-9b51-60756c492cb5", "value": "1536:ffk/srAxR6WQihbLJx48VM1/FMYQlRXGqKtz9EUJ:wsrAxAWQihbFx4f1uYAGqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674656537, "uuid": "7393a168-7b74-4f35-ad0b-ced43ec5796d", "value": 59405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674656537, "uuid": "a006efc1-870c-4051-bcab-a1f5549e3cb7", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656537, "uuid": "18ba904d-e17c-4c7f-ac5f-d5d9d279ebd6", "value": "1ef41988-1b8f-4b43-9e16-222ad539efd7.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c07478d-9c95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674640109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640109, "uuid": "7a3d7a6f-fafb-4146-ab38-af5dbc0ce5b5", "comment": "Malware payload (Formbook)", "value": "2a7e5440b5fb19ba09cfcce1afe85e0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640109, "uuid": "0928ca43-8eca-4787-84cc-195088134873", "comment": "Malware payload (Formbook)", "value": "dc0f8440e9ae92761e5e833b22c2448fb0f2900f9a184e823b299c74db5c1085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640109, "uuid": "6401cab8-d867-4063-8922-b107f6cc7f37", "comment": "Malware payload (Formbook)", "value": "122b7e5c3496c9e7ff528ae800526876c090050d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674640109, "uuid": "c8fc2c62-1b87-4492-9c1e-00c04765aff4", "comment": "Malware payload (Formbook)", "value": "10a6df4b2c5e34e6a5867454c33a75f17915fa0a5126b138f6cf896c52f43d26d5cd0b85a35a726d4758c8d013446dce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640109, "uuid": "0e2f2458-5f7d-4fc2-a6f5-8c5c2b3ecff1", "value": "T156F4E040AA784B57F4FD8FFC427D66861FB0286B63E3E3B50ED122E614537428641AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640109, "uuid": "4607521e-2619-4951-a42b-54a4cb86822e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640109, "uuid": "6340ac5d-1e53-4cba-9160-cf854a78e5cf", "value": "12288:Ut4gOMtEwcU3gZ+GQzjkATGdszyZtHZlCmWhrjKYQDJxuv64GEabMhwHJ7GPzlfK:uRO6AAgZbQzlGIyZFggDJKES2J7GPzly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674640109, "uuid": "d755faa0-2d98-41c5-a427-b55c8c3fd0a0", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674640109, "uuid": "19f2a56e-2fb1-4e9d-b1fb-63e907fc6f3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674640109, "uuid": "7dd63ceb-1fe7-4e3d-a67d-d9510f2da99c", "value": "DSX_AIR_.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3757bfa9-9ca0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674644745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674644745, "uuid": "04d26c80-19aa-4a53-a2e1-2ba58c3747cf", "comment": "Malware payload (RedLineStealer)", "value": "b613c33ea1ca7d21c3114f5013964dbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674644745, "uuid": "19e0ed6a-3c02-48ce-bb88-938782eb8d16", "comment": "Malware payload (RedLineStealer)", "value": "dcf4a9e709b5f1dd912e2455dfeb7267548c5f0597b92d2fd67b8d7cba097377", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674644745, "uuid": "387c4b42-2901-406c-acbb-ab17fb3761c6", "comment": "Malware payload (RedLineStealer)", "value": "c54011895b450afdd90216f845afb28fd86dbb7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674644745, "uuid": "73f3ef7d-8014-4369-b83e-2d4ce124e115", "comment": "Malware payload (RedLineStealer)", "value": "1f90bc359644334d14c1ea8a3fcfcdac46e4bf1b1cfc990e1a3bf7b3c77918bda3755befbadab24210f04ab3bbe15f15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674644745, "uuid": "1ea21076-549a-4149-b5ca-ef10efc8de45", "value": "T1A4B509F13E07638BC44E4878949ACF03D71862A5849DE99DDCE93438EED28505F8ED9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674644745, "uuid": "b5a95a4d-dd02-45d7-8a08-5c9b53ade8d5", "value": "0757a8f986ddb3ab9e2a579b3f752934", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674644745, "uuid": "c46478b3-d333-4944-9100-adba94ad27c9", "value": "24576:KTXEPcN5JzQAMsJKStXO7sLeNVrMrtxZC1c6sDkFWE+QQdOvV/J0lDAdsBlwOxXD:gVVO7keNWuahOORJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674644745, "uuid": "3e259038-16fc-45f0-8c38-a66036e2dd16", "value": 2309016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674644745, "uuid": "95f02294-b98f-44a8-91ab-83b17222fcb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674644745, "uuid": "f2c0ca9b-bf29-4141-8158-566d51a7a560", "value": "b613c33ea1ca7d21c3114f5013964dbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67fc364-9cbc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674657038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674657038, "uuid": "c3069bf5-e2c1-411d-8131-72036af416be", "comment": "Malware payload", "value": "ceba74be4e4ba642243da4d46cb86e71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674657038, "uuid": "6b82a132-877a-469b-a7ca-bf018b7afd8f", "comment": "Malware payload", "value": "ddc1c7e7121e391e79469de093c830163f27aed010d8fec02efc4c2dab990d86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674657038, "uuid": "e1a49094-5a5c-4cb8-8f37-a1feecc14365", "comment": "Malware payload", "value": "0553b4e844d31a23acc8145a220e12b2e3644157", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674657038, "uuid": "d1e1bc37-476e-4d84-9320-9869ee8816de", "comment": "Malware payload", "value": "aee0fb4f73631c6e729a71aa10f2cd4b92dc7a155ed19e9187d9971a992d7e8569bc99578fd75ff8c18d10f37e7fb879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674657038, "uuid": "2e6b0f08-1fcd-4597-b995-d4a2c9009c9b", "value": "T1A6E5A45369DFCD95CDC667B45D8312356734BE318A2F1E2AE608C23DEB1F6C4A91AB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674657038, "uuid": "a1c8cb31-afbb-48f1-bee6-acd56c55d8f1", "value": "55434999759dc441540a18ca96a7f43b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674657038, "uuid": "2e907959-4cd5-4097-8d31-d0b7fbedb3f6", "value": "49152:bH/av7zZrBdDE1uD0bZYdE8zlz5hyMXq8PlYD0:bHQZrBdMYNzlz5hyMXq8PlYD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674657038, "uuid": "7b6ca35b-ca41-46c7-b584-9c7299c8abde", "value": 3275699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674657038, "uuid": "a5ed6ae5-dd6f-4beb-a17c-80146f36f255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674657038, "uuid": "f7ff04b2-9198-4a4c-86c9-3db9ab8b96cb", "value": "weird_thing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89955cb3-9c74-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1674625985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674625985, "uuid": "34c3afa3-0930-4df9-ad46-9c639fe946ed", "comment": "Malware payload (DarkCloud)", "value": "669fc139021c834b6baa8d31279118e3", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674625985, "uuid": "6f7908e3-c227-4fad-a1f8-53188a1a8477", "comment": "Malware payload (DarkCloud)", "value": "ddfc0507ced17d04d1c63ad261716af41bb49b0699ad2b59ed4699fc689503ed", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674625985, "uuid": "d8a0f894-8fd1-4b79-8b2f-9e90cf8d0095", "comment": "Malware payload (DarkCloud)", "value": "2d807594e145365fb0dec633ec2a82e0e2ab501f", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674625985, "uuid": "06d1568b-07d4-491b-99ac-697f25edf9b0", "comment": "Malware payload (DarkCloud)", "value": "157aebc8f9ef6fafdbd5503100512e48d2b9f25ea8c8cd21eef840597469f361bfda6ff018c262df7b33b2c851e405be", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674625985, "uuid": "9ab9990c-4d14-4734-b1b5-599424a84115", "value": "T1E8158B415A7B83E2E4F94E78123CA5142B711CD187ACA13E7DC67DBA8CE674F4099B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674625985, "uuid": "a13e6118-75e2-4dea-8a14-e74416f32869", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674625985, "uuid": "d8463554-f6b3-444c-91ce-1f63eb605233", "value": "12288:bkJmTlinu0b5sMGEGEN5c2dA9uMX1vqsF/Rkl1oTO7F+YEhLKUb:SmTli3NGEGEXnAbX1qsF/RrcF+dLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674625985, "uuid": "ab524cd9-44d7-4fdd-b332-c0197879db40", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674625985, "uuid": "d7c15a72-4506-4756-8cf1-c5fffd723813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674625985, "uuid": "28679379-8a37-4f37-8044-ac40ae40cb2a", "value": "Order 1007165.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e119492e-9c66-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674620119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674620119, "uuid": "c8c2c170-a0e9-48b3-b185-548fbe2d3ad6", "comment": "Malware payload (RedLineStealer)", "value": "f2aa0a939eb31b64e7f57c97dce7298a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674620119, "uuid": "12928126-c57e-4ce5-b002-ff27295fab13", "comment": "Malware payload (RedLineStealer)", "value": "e026bc9a0b7ac31a86cdbbd88e2b2be5236ba81b469723007c8b3c1d9461198f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674620119, "uuid": "56670ac4-f0f4-47a5-9e3f-471bd2a156f0", "comment": "Malware payload (RedLineStealer)", "value": "c0eefb77a322c4fcdd066779e45af74d5470eebf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674620119, "uuid": "651efc20-bb1f-48ee-8018-6aa532ca9ed5", "comment": "Malware payload (RedLineStealer)", "value": "0804d0277c2fe0f9f040a92cce00282ea65e7244b4b09b1d9bb3241bd85c0e43b3a4a65cdf81bf3d60fd5635d9d7d6ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674620119, "uuid": "ccfc294e-8cde-4fd2-8a18-da5822cabf5a", "value": "T1B6C533547E23CA73F1826632CC73610B2D7B9028267B4BC73F69ABC1792ED45B056786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674620119, "uuid": "c8b70bba-c47f-494c-a1ee-97379cdf8eed", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674620119, "uuid": "82c10bce-2276-45d9-9cc0-59435686dbf3", "value": "49152:Eg/2ozbzXnm3jHSdJWSa+J9dmcQC+/qq+7aqf9fvgS+7HYv1/omI:Jl/3C0Wf+JqcQ7yB7aqZgS+Lyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674620119, "uuid": "2f3ba419-b7c5-4cdc-acca-6ee7629cd1d8", "value": 2678520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674620119, "uuid": "7d1a761a-6ded-4ac7-ae14-29b8b031de40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674620119, "uuid": "7b9fdded-19db-4fea-a5ae-24dbeb4fe5b3", "value": "HEUR-Trojan.Win32.Crypt.gen-e026bc9a0b7ac31a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14300c5c-9c94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674639532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639532, "uuid": "7955cd24-a963-4acb-a087-d5c29eedd556", "comment": "Malware payload (Smoke Loader)", "value": "87a0c1c312f80b7750ebee3ac4c0670c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639532, "uuid": "4e159dfb-8365-4a10-93ce-9fc482e27547", "comment": "Malware payload (Smoke Loader)", "value": "e0ddfb5a3473969006cc485d8040b5321bc3769e7a5f5dfd7a8a9e5fe1227ac6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639532, "uuid": "e424ba64-e8e3-455c-8d17-31663a4c24e4", "comment": "Malware payload (Smoke Loader)", "value": "a0738269e1b869c914767811145149b63db3ae61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674639532, "uuid": "be411fc5-9f1f-410a-864e-831ae9fca4e9", "comment": "Malware payload (Smoke Loader)", "value": "0395adf38c99beeeddb3ccdb7abd170593356492f34572174a5ce1b4f8b1fdb2ca79825c239626a6e688fac6ca1b6b49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639532, "uuid": "49a14c86-52ae-4dd3-94ed-c4862c26fee2", "value": "T18C748E52E298BE99F699CA318D1EABDC357EB8405D146727322C7A3F25701E0C1AF31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639532, "uuid": "7fc84f0d-9e0b-4ecd-9ddb-b41657cc441a", "value": "861af707b319724b1132a7a971c54bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639532, "uuid": "35dddfc5-50d6-47ed-ae61-49256c5c4727", "value": "6144:C9YLM8gPcKQiDKXQmSrweFS0bO+n1QybGDjq7VWRFBMolz90BB:wY4rhQKo2Q3O77VWR5lzKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674639532, "uuid": "bd8e5aa8-a7c1-42ca-8e2c-c6740205473b", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674639532, "uuid": "ee0b9b84-1810-42dd-b08c-a3877befe84f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674639532, "uuid": "70635635-49a5-44ac-836a-dcbd19f1be8f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b0e93e-9caa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674649205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649205, "uuid": "cd47444b-0ee2-4b2e-aa77-240b799d067b", "comment": "Malware payload (Smoke Loader)", "value": "29c7751e69c9f7e6fe5e73de9bca578d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649205, "uuid": "217015a6-0bb1-4582-8e67-2fcd89369925", "comment": "Malware payload (Smoke Loader)", "value": "e0e3705c5fcef8f160ebe209e6f5e2e872f6168b80634ba50cf0bd940f130267", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649205, "uuid": "5167566e-252f-4070-a43e-99a6daefccd7", "comment": "Malware payload (Smoke Loader)", "value": "ac2a9d23a0d98317d18addf5dee4d9d69795264b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649205, "uuid": "f3609834-a261-420d-9db7-c28cde345609", "comment": "Malware payload (Smoke Loader)", "value": "864c2ac9d7dfee0aed908752ec9588b875f7b334635537ba9b12714f06e37a33670bc1ab6898e4520eb6bbb267e83735", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649205, "uuid": "00af234a-0207-4450-910d-d87e9cf3efb8", "value": "T1C1747D12E298BE91F99DCA318D1EEBEC763EB8504D146766322C7A3F16701E0C16B71D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649205, "uuid": "e609077a-a8ee-4945-a28c-599e41e59c92", "value": "787cd3f7e6d0161bfca0cbd92375e751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649205, "uuid": "291892ea-a9db-411c-91a6-756924067c4d", "value": "6144:ZLCpgewqbe1XZ1al8DsuOjq7VWRFBMolz90ZWqFsfm:Z2GBt1p1nD7VWR5lz0Wysu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674649205, "uuid": "9ed359b2-8443-49a0-b210-0d6fed72c513", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674649205, "uuid": "fdb943cf-d371-42ab-812d-0b1ac22a2b57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649205, "uuid": "f9673112-74f3-4092-bd4b-adba87ed18b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac603411-9cbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1674656538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656538, "uuid": "9496694e-f432-491b-bf24-7aaea3df42f6", "comment": "Malware payload (ModiLoader)", "value": "df0784389866a3111114b9222a140e7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656538, "uuid": "e85bb361-f819-4228-9da3-cd118edf833f", "comment": "Malware payload (ModiLoader)", "value": "e11e4728a96017107ba948c2b4653b96a2a633587aa1bd55b3d94c1d613b4ca4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656538, "uuid": "9c25f696-3547-465d-af89-01177ce5ac09", "comment": "Malware payload (ModiLoader)", "value": "0732f4e42b5c879199e82d3097d369c281b69ae9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656538, "uuid": "2944ebcd-731c-4471-8feb-85554759b190", "comment": "Malware payload (ModiLoader)", "value": "72756bfe142a7f87dd5b84a4fbc32a3c5823a4bbb1d1e3058c4b2ee170aa9a0fa990752ffd812f9f98c0561d30ca9cce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656538, "uuid": "1d1e6a00-c5a9-49fc-bcd9-acd9734ffee2", "value": "T1ABE47C62B7B0D836E0292DB5CD8B96F97D1FBD602A1475463EF03E0C6F3A2803959197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656538, "uuid": "0742abda-dff7-4084-8f41-0d7f4af9229e", "value": "5a1d07c71453f2216356e11a25273b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656538, "uuid": "4e20d1bd-784b-4468-83d4-114abbd93828", "value": "12288:Z1HbJXPhvoavMSPJ7Q7/S7sW/vCFovXe8QSfPt3C:3lXZAavMo7Q74sECFoGBe1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674656538, "uuid": "dbdcf412-c536-4cb1-9aa8-deb4b3e7b776", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674656538, "uuid": "05182d63-ac0c-447b-ae05-f17609dcd80b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656538, "uuid": "ded4e065-f440-4525-a1a3-e7b154ea131b", "value": "order confirmation is attached.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f68bb04-9cd8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1674668730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668730, "uuid": "9993af49-591c-43d3-b96f-aade57e08141", "comment": "Malware payload (AsyncRAT)", "value": "0e4ef106554d5dd1581e52bbb8e03cfe", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668730, "uuid": "e57e3f74-6612-49ce-8ca2-cb0f1c32cfbc", "comment": "Malware payload (AsyncRAT)", "value": "e180cd1b7fcf1674287a2aa516901ab1491aaaf7d9beb067b8109e742d89a50b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668730, "uuid": "38d7410d-5aab-45b4-843b-525ca041c2e0", "comment": "Malware payload (AsyncRAT)", "value": "3561feccbf4da841b4d981992e7af59d47ebb640", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668730, "uuid": "62e4b41b-ee64-4347-8fbe-a1c792a9b45d", "comment": "Malware payload (AsyncRAT)", "value": "da18189355771898206169ab5ff8cb277086f74d6b963ef66011b722e11c31129cd8ad5d271c4d1ce08b182d4f7b8961", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668730, "uuid": "1eda18f6-8f2b-48fa-9229-e4190c7bc29c", "value": "T1E733D17B09A91D600068D797F3F3B46E945EDF415D7261E9B879338F2E98C62C01B48E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668730, "uuid": "e500f7da-ecce-4562-92fb-f7a092fad885", "value": "768:4q2feaZyoEAy/xAU0QVCHuNC9ZwAllbu6iaN5BevlTkxKmOuAf7yMGRHwt4Pdoo:4pfeayoEf5V0eyOfALu2vwRXzy04F5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668730, "uuid": "d6a9020e-d0c7-4e3e-91dd-1c81852b805a", "value": 50646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668730, "uuid": "b680cbda-2d88-4102-bd4f-f8506cf20de4", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668730, "uuid": "b00b13e2-98e9-45c9-862d-74a0560d5db2", "value": "e8bbfe18-3bc2-4d9a-a512-07486eeeff35.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d7f701-9caf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674651178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651178, "uuid": "bf3e1757-3269-4000-ae56-8ee123824445", "comment": "Malware payload", "value": "25103279d71395bd23386631920eedad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651178, "uuid": "cca3fb6d-6d5c-4ebd-9a8d-3e1b96ba8f52", "comment": "Malware payload", "value": "e1d67b3c7a3ed6ff0fcfc647cd991a5f794950bf27431436af02957608cae551", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651178, "uuid": "99f0c074-24c8-42fa-8be5-7940e11fa298", "comment": "Malware payload", "value": "b427103321c437f870f9ef0aca20f2907013ef29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651178, "uuid": "fdf2facb-a7cd-4e80-8fe0-d45986d0f7d1", "comment": "Malware payload", "value": "ec8b405b55b3f514fcce8ffb9915439c533f0f2366a36f2a99993668ba91bfb8b6020e2d07d380cd817c930be7e69beb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651178, "uuid": "2a4e733a-8c99-40df-b9d6-a42f1f2a82ae", "value": "T170C1E901A3DC43B7DE734B32BC7363D04278F34698579B9E68C8A20B9D163C989517B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651178, "uuid": "2c06301c-4914-4ec5-8974-f20ecc731358", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651178, "uuid": "dc494f74-7839-4242-acb9-3885ed95134c", "value": "96:SXnbpKge6jUEB9WwCSbOSMPdLC2RYnSxkvQ2/zNt:ScwzB9WwCVFLC2unSiv1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674651178, "uuid": "1109f1ea-5de8-4086-a141-d7f25fa938ca", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674651178, "uuid": "8b00778a-5a98-46fc-b165-de2d19c51126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651178, "uuid": "5b415024-5c1b-4409-b819-06bed378a652", "value": "MV TS JASMINE VSL PARTICULAR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e4cbf3-9c6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1674622358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622358, "uuid": "b760c84a-5dd2-4310-b502-29b33e4334c4", "comment": "Malware payload (RustyStealer)", "value": "92d17b3bbe2e81ac751c024e4cf2e75b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622358, "uuid": "3a2d7bde-6281-43ca-8eaf-65419c6adf2d", "comment": "Malware payload (RustyStealer)", "value": "e2734c9e6a607c1e2b4e4975c39651aa47050bbd931bc752957cbba23ba344ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622358, "uuid": "1b86f4e6-dd31-4a02-b608-4c597224fd50", "comment": "Malware payload (RustyStealer)", "value": "89a6428de0666f728a611ae1ce92eeb1be8013b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674622358, "uuid": "ae791919-55c9-4eef-86d3-0dd216bdcdc2", "comment": "Malware payload (RustyStealer)", "value": "474eb0bcf804f757d34d70074097f190c1ed072b383c3e25362edb321c57917de8be6534292ec48aa954a334a7a803d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622358, "uuid": "847fa8c3-3fc2-4bdf-ac3e-1901f17f89b5", "value": "T17B7402227D50D0B3C05A46742822DAD09F76B9322AA9854B7B981AEF5F703F07377397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622358, "uuid": "035e7ad8-76be-4da0-aeb2-f096956de096", "value": "0b7efb36250d99ac9280e9ab606e8d70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622358, "uuid": "ea815ee7-8a54-4cd1-af19-5b4e93aafee7", "value": "6144:0lVLGz1nhIU2OlhaLYpE+64vmSfcnsWX3hW2lYO8WZATJk8c18WIfQ:WVU1nhbzy/qEsWnhVl8WZ0+A4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674622358, "uuid": "434e848a-1dd4-4cee-8944-82cfcd7c2cf9", "value": 345614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674622358, "uuid": "c5443c49-59d7-48f1-ba9f-76ef455625b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674622358, "uuid": "199bb1c2-8bc2-4c8d-a59a-7ff8f0c65071", "value": "92d17b3bbe2e81ac751c024e4cf2e75b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c9f565-9cbc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1674656829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656829, "uuid": "5961df0a-3c0b-4ef8-a433-790db5707a2f", "comment": "Malware payload (Amadey)", "value": "415bc4fc3537b94dbdd9f15ed8af7424", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656829, "uuid": "06249e77-841e-4215-9e9c-32e128db9b3e", "comment": "Malware payload (Amadey)", "value": "e2b6b10623d0d12dc046fa866d752a2e6141aa0837b0fa1a5fe22940ee92bb46", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656829, "uuid": "515cb508-636a-4d36-9faa-5bead7477134", "comment": "Malware payload (Amadey)", "value": "61f02437ec833960f346097738d1c4c078be75ad", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656829, "uuid": "09f697fa-cf80-4d0c-b962-c9a7aa1e9e0c", "comment": "Malware payload (Amadey)", "value": "8c4f077704b0bbd2631d4090c6a869d6a85896d3a14b71a840fbb4a338457e272a8846d0fba25f5fa0f202911672dd09", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656829, "uuid": "7aab2fd6-8d7c-4cb4-8538-903d71465e81", "value": "T11A4612BDA0AC111F2F38C9341D121A07C8979BE7BD591A12ADFF0269AD0FB4A7D5C46C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656829, "uuid": "b6d3cb5f-732f-4c06-82af-ceae9325d4f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656829, "uuid": "e93dbde7-dcc8-4e49-b3c1-9697e979432b", "value": "98304:Se6RbK3QWuD1x4Oa9Ir9VuE40OyFxACazmXtpY8D60pNrsvCHJp/RCs/lojYcpXm:Se6RbKRNWr9VFFmCTXDY071HX/ksto8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674656829, "uuid": "6032c597-ec00-457f-875c-a64fb31cb162", "value": 5653504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674656829, "uuid": "8843f6e9-de59-4b73-b339-6be043cfff35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656829, "uuid": "242f72a3-926a-434a-ab06-811609e56d4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810cf291-9ce7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1674675363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675363, "uuid": "293ec4a5-ad29-4620-8195-83a07dd94e24", "comment": "Malware payload (Guildma)", "value": "6ea5ac83289ce4dfbc9e311f7c20e5e3", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675363, "uuid": "3a4b854d-5a9e-44e2-a453-7c6bc5fc8ab6", "comment": "Malware payload (Guildma)", "value": "e2ef27f0921c1c09112e874369c8800ff103ffac932842f7317043ff59bf56b9", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675363, "uuid": "08f7007d-2e00-4297-a77d-a3eeb9da13db", "comment": "Malware payload (Guildma)", "value": "4c3047bf92ae1f3a5bcbcf55080578346655e360", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675363, "uuid": "087903fb-4d96-4610-9cff-7bf0ad2d5a36", "comment": "Malware payload (Guildma)", "value": "a7cf7d4104f34cbc0f68d860e32e9101ad78df9ba35580b744cd8a17c13efad9d435e3dc85b564e35060ae5e78729a30", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675363, "uuid": "82349aa2-38c0-44ec-863c-eef2d3a917f3", "value": "T11CE2194D80201F9BA4364B36FAFB5046F781967384A8C4E5FC6A0909DDBAB3D31D4E76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675363, "uuid": "7fa9a7fa-fd21-41c7-b790-73a7511467e0", "value": "192:IlC78qjsqdq+qdq/qCq1qJq1qEqDqNqeqDqIqdq3qeqOqlqDqJqvqDqlqUq/qbqb:I8iiNFFzyYkLfdpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674675363, "uuid": "f231c923-5eec-4689-a5bb-5071248564c6", "value": 32471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674675363, "uuid": "85488c8a-d03d-401f-a157-3b09c5eaaa03", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675363, "uuid": "eff7a9c3-32d6-4721-bde3-a991a4779fe3", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed2ba20-9c91-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674638503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638503, "uuid": "b7d9989a-db6a-456a-895e-85b43f6c2e77", "comment": "Malware payload (RedLineStealer)", "value": "03f02231590dd56432382a9d1416eb68", "object_relation": "md5", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "pw-2022", "colour": "#FF51CE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638503, "uuid": "542bad0c-9812-4fc6-bdbc-663b63dcc44c", "comment": "Malware payload (RedLineStealer)", "value": "e42c3e841ee2520f38449522ec9d65b1bea1f3b132f0a0f4a5d35e139cbfb54a", "object_relation": "sha256", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "pw-2022", "colour": "#FF51CE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638503, "uuid": "271f2e26-3676-4c88-91fc-45889fb5ecb5", "comment": "Malware payload (RedLineStealer)", "value": "7a7517d51d4933e5b05a1009d8edfb8e1eb49bc7", "object_relation": "sha1", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "pw-2022", "colour": "#FF51CE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674638503, "uuid": "a2200e26-029c-4157-878b-eb0367b2fba1", "comment": "Malware payload (RedLineStealer)", "value": "1ff2672fcb7ea7a76d684ddbb093c33d91672ca57721b9d6d6fff6b406e3a47407f5af703e95886cd545470624b06b49", "object_relation": "sha3-384", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "pw-2022", "colour": "#FF51CE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638503, "uuid": "09670758-96de-41d8-86ce-3ac4b04f4ef5", "value": "T1AA052376DDF5B66C0B11A97C660023B7DDC09180FB3CD869E80A77B0B7124F69287EA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638503, "uuid": "afabed9b-143b-472b-93e6-6bd846b8ed11", "value": "12288:UQi8/lxghkeEa99UiyV2HqcTZim0J9tt1zgX9FBEmhOZTU3fYEyrP9xyiWl+lN2q:V/lS/ETtgKcZwH3UshTUIxc0N2jw4q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674638503, "uuid": "93fc6b2c-cddc-4581-ad55-586e903b26d2", "value": 818686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674638503, "uuid": "ba35f33d-f217-405b-ab6d-13723c1e1204", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674638503, "uuid": "59be73eb-7221-488f-9383-fb58646a94d9", "value": "Installer.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88833008-9cee-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674678382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678382, "uuid": "d31a777b-1370-496e-b5d0-87f9d88b2183", "comment": "Malware payload (SnakeKeylogger)", "value": "8863a3ff2a9f73e185c47c2e1d5c219c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678382, "uuid": "a18d5c58-3719-44fa-bf0b-468a9a6c3fd5", "comment": "Malware payload (SnakeKeylogger)", "value": "e4393bcc825e851c046d310dd10515895ea041b4f94109108b35fc56a0dc51a4", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678382, "uuid": "6b4a0f4b-a9f5-48f5-962b-e2374b136f13", "comment": "Malware payload (SnakeKeylogger)", "value": "49e34e530980d15ba5c2cc0e03c5e395f8cdfaa8", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678382, "uuid": "09fd8e41-e4c5-47c8-8f3d-82b48c3c09ec", "comment": "Malware payload (SnakeKeylogger)", "value": "ac869d262ed9a8beb7fd5b555a1b5a65439bcea98aa3d35f054c092b0444ae1ea5fe4b2aa2bd0a836f979267e640110c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678382, "uuid": "d85ca0dd-5f44-45ae-ac78-ae4c78b8ff88", "value": "T19B7412441278D1A7CDE317323A378F259EEA3721486C9A4773107668BE37782EE4EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678382, "uuid": "c020d098-31cd-4726-9171-ae08d2f051ed", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678382, "uuid": "13d50bb4-ca29-4418-96e7-3917f546be03", "value": "6144:/Ya6eHPHLGS0APSlfCYk3o+NOG1x/rLtJpgV34uJLQmqC4bipZC09Cr6Zpxz4acW:/YQHPHLG5APS5CYkvPldJphm/4bip4mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678382, "uuid": "d71f7571-98ed-40d8-9683-9dd9b5a6a4be", "value": 339854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678382, "uuid": "ad12b24d-d119-4c2b-aec8-0b1c481ee6e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678382, "uuid": "9881d506-7303-4754-8250-f54cd95a09b9", "value": "DHL AWB SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f786c8-9c47-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674606754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674606754, "uuid": "7f1b7957-1c4f-4617-8399-53e87d317f39", "comment": "Malware payload (GCleaner)", "value": "90b2107dbe918824370cde70261003d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674606754, "uuid": "ae9191f9-1b13-43f4-a1ce-92b2100370af", "comment": "Malware payload (GCleaner)", "value": "e536e14a10dde11bcd4fe738803ca92e655d368f7ac6a6fbc63fa341dfc7aeba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674606754, "uuid": "f0f68858-c425-4480-9e56-f3a7f57d4ad6", "comment": "Malware payload (GCleaner)", "value": "66b88afadec77e4cb6b8a0c59aaad36fd2582d10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674606754, "uuid": "3b547c82-27d4-41d2-a1a7-3c97f35a2817", "comment": "Malware payload (GCleaner)", "value": "20e0e835299c450415ef120896507034b8453f87cdd6c1835ec6ecee4e233b9f275c6e05751e3861746a14544b77881a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674606754, "uuid": "cb884b6b-344f-4936-b59d-fa2e33de7c20", "value": "T16F853319AC68D572D221FD3A953B8310DC13F77238A9953A328EB70E9F372D65A5438C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674606754, "uuid": "9071e217-96ac-46ef-ba98-cde028896954", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674606754, "uuid": "f5f7ab20-4f4a-4f74-9e4c-38576a839495", "value": "49152:Zz/05XBzcPcreKKdHM7c1rsNWHvbQKj8ctTsMQtLCgv2MR:h/0UzKKds7c2NQjZLaxv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674606754, "uuid": "742aebdb-15c7-4929-9e5a-abd968502cb1", "value": 1792209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674606754, "uuid": "5bea5528-f87b-4bd1-93ab-73723e81b1f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674606754, "uuid": "e6527fd5-0a38-4602-acff-c69a974a4509", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf9766b-9cb5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674653745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674653745, "uuid": "9a51bf95-55a2-4f1d-a769-b370f6bb25ba", "comment": "Malware payload (AgentTesla)", "value": "0ff94eb3d55b33c90c2b701ba298d3a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674653745, "uuid": "a4dee68a-5119-4784-ae37-40647267b047", "comment": "Malware payload (AgentTesla)", "value": "e57f1d74706b7c5dd7f2191a6abe13979884a470c0789a03dcc1e82deaab68ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674653745, "uuid": "33f4c249-0e2d-4b5f-8737-b643c643ae60", "comment": "Malware payload (AgentTesla)", "value": "034b2f183aa0601aee3e566da689fb26d87a9f98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674653745, "uuid": "7260ed73-6f76-4c50-9781-08474b668a3d", "comment": "Malware payload (AgentTesla)", "value": "e6f44c5568f460148b6dae3123d8c3ee12a97f292677758a50b005ac3f5d02d69a3bcb48bb9c7e22e4f9f84d86a1c493", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674653745, "uuid": "ad4a3a49-4d90-4cfb-bbff-62ff367ae0c3", "value": "T13B13D02DCF997B2CD74B62B8451FB1A0A502DA50A1B1DF071EA9928D19CCDD40B1BCBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674653745, "uuid": "c7ecf07e-33a5-4473-85a1-a115fe6669f3", "value": "768:IsL8DvTWqt7Qv+nWD8h/BIJYfTH+niSpXfl4bW52FFiKk/f+VRH+nfiRiV:VLWvaq2v+FG1BVN4i52FFi3/2VwfaiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674653745, "uuid": "5ecdfbfe-61b4-46be-8b1c-490e889c833e", "value": 42826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674653745, "uuid": "5672d71e-7674-4c27-b724-6e76de29644f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674653745, "uuid": "36a58c7b-30c7-4eca-b79f-85a623fe7c25", "value": "201703P0Document50650.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f8c333-9d06-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674688531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674688531, "uuid": "d8070fac-2644-48a1-8111-f4563cbf3341", "comment": "Malware payload", "value": "f1c96d9105a7bd5a1e66dff20f86acf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674688531, "uuid": "5611c323-5211-4fce-aea2-aeaa2bfd9e2f", "comment": "Malware payload", "value": "e5e1b57d641fed7e86fec946a900b3dfca64a1d69910ba93f2c1b9ac413d42ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674688531, "uuid": "4aa112c6-88ef-4d07-86b1-996238776d5c", "comment": "Malware payload", "value": "0b1c64b8a6e5712e7709bde6618ca6ce13ea0a71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674688531, "uuid": "484c222f-4496-4484-adfa-a98a8999a320", "comment": "Malware payload", "value": "cd89801e84a3f698213b903dc08b464a7b4abd92ca12f496cdcdbf4893ab61eedad3479a4d5f28c1a2118b8320289879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674688531, "uuid": "c0384001-9008-46c5-a9e5-2154faab412f", "value": "T1CA64AE3275D0AA60F91A4A35CD3ADBD43D2EF8D38F3C765732F4A61F19722A0C526216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674688531, "uuid": "44cdbda2-85d8-4ef7-8072-36f74e34e2c7", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674688531, "uuid": "3e75c79a-ce15-4f3c-bee6-86a7b67331ec", "value": "6144:C5LHHY4taDH7hTsqzwEhCiHykm0+MOKXj3OKUT:C5L1mbhriiH+WXeKUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674688531, "uuid": "507a0fe5-45aa-47b3-99bd-a25652cdaf1f", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674688531, "uuid": "7aeb11c1-9871-497a-88d0-58df698a078e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674688531, "uuid": "888d0bd2-25a5-4920-a92b-606f88efdf3d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07ba2ad-9cbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674656572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656572, "uuid": "3bf3ce0c-d6ac-49b3-813e-8e24f552b873", "comment": "Malware payload (AgentTesla)", "value": "f8603fa911513044856e5a60419d0a30", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656572, "uuid": "26ed366c-2d7d-4637-88d5-60ad0f917dfb", "comment": "Malware payload (AgentTesla)", "value": "e7ed6b0609943d4c6ddb3b032194d7fece3f9b5e2335f9ee0cbf4e1ba4b01efb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656572, "uuid": "3b2b366e-8c20-4ea7-b38e-0808f26e9755", "comment": "Malware payload (AgentTesla)", "value": "c0b94285f6902b7a45b6f432aa136c9801260198", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674656572, "uuid": "efef1eec-d976-4fa8-85b6-c8165f8f0300", "comment": "Malware payload (AgentTesla)", "value": "da6d50fbb030a50c3389872164d8dc2ad4b81a712b596051ecfce9b7a6fb6f27746103e1060b28a02782fbc7f2eedeee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656572, "uuid": "4150aab8-3177-46ce-a338-e54cfd9840f4", "value": "T15915DF407278DB02EE698FF9201191504BB22E6BEF64F3645D81B2E75A73BC13E90E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656572, "uuid": "e6ebd7ea-02ce-48d8-a5ce-e26673d4e35c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656572, "uuid": "fc57fce4-1b8c-4cf2-a278-b2a7c8f91d37", "value": "24576:98kyGyO3QzlGI6AAgZfdU8wkiYxz4iFUZ0NNuZ:98kypO3jI6ATdUYDzEmNgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674656572, "uuid": "900fc200-8447-4a71-bee0-fb993a5b427f", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674656572, "uuid": "c03df30b-663b-456a-869d-4fd760bfcbaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674656572, "uuid": "6ea27755-0713-45da-bfd2-ec37d181af22", "value": "ORDER REQUIREMENTS 0210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891f4d9b-9cf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674680960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680960, "uuid": "78104a72-78d9-4570-8219-2296207244e0", "comment": "Malware payload (Smoke Loader)", "value": "520bf67b7e1cad7c1bed266603addad0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680960, "uuid": "4c7394ca-a5ee-4583-91f5-4d8b9ba28ceb", "comment": "Malware payload (Smoke Loader)", "value": "e89e13b984e1e7d9c963b27dbc3be8e74cfe43be9e0d9f68123ce189200f7151", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680960, "uuid": "897c0cb4-4289-4ad2-8e0b-9736c05f07e8", "comment": "Malware payload (Smoke Loader)", "value": "deef5285c42fd391534cfbe04ecc8369700a4746", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680960, "uuid": "136cf87c-4ccc-461a-a738-1851b0bd7b98", "comment": "Malware payload (Smoke Loader)", "value": "f9d6dd364074f2350b14e7a203b83654121e449051565cb65ee407c5bc37672df4c80a6c27ea29865d3388e7a9d2baa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680960, "uuid": "526c31b6-1583-4d30-af2a-9a0fcfd38a06", "value": "T18F64AF1271D0B8A0F9160677CD2ADBD4392EFADA8F3C735732C86A9F19723A0C566315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680960, "uuid": "62ee502b-509a-455c-9116-5fd4b954220c", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680960, "uuid": "abdfb47c-7c88-4a56-8f8f-7c5551df0d91", "value": "6144:8hLWjmbh7dzIEDywkQMQSOg0+MOKXL+iB6UT:8hio99IEDyRdWH+i4UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674680960, "uuid": "e74f91e5-9b2c-42a0-acd1-0932c2862c0c", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674680960, "uuid": "d0b8389f-298f-422d-a790-082370a7cd42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680960, "uuid": "d864551b-1175-490f-998c-298e198256ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579e6796-9cf6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674681736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674681736, "uuid": "38f30427-c823-4e0a-8f43-bbd105c94410", "comment": "Malware payload (AgentTesla)", "value": "b38af632b3713febf4ff38a5f063327b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674681736, "uuid": "b902c28c-151d-40f9-8df4-de7b8778161a", "comment": "Malware payload (AgentTesla)", "value": "e8caa6f13813f391c2834ac5b78b2750fe5a99b47975ff6e54d2f122fc5c22cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674681736, "uuid": "30e58928-c718-4ada-8f1d-bf7970699fd1", "comment": "Malware payload (AgentTesla)", "value": "87e63bba3c502c3daa028130298cd1147a851dbd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674681736, "uuid": "8d6c1803-d725-4089-98f3-277de46f849d", "comment": "Malware payload (AgentTesla)", "value": "ca87e5f68a1a9ef814e5634f461f51eaae56b5a37d7b6d215829aa5432f9b95241a466d16cf363985bce3da21a06a9d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674681736, "uuid": "01302a77-428c-4639-a203-86bccba5335f", "value": "T1F915AEE5029DC6D6E8E60E38062C791467999C97837DA17EBEC7147F80F678F40783A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674681736, "uuid": "d0dd210c-880e-4b2c-8eb4-256e1387b51f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674681736, "uuid": "370d0d92-b012-4831-8ee2-ad5dcb7d7b96", "value": "24576:B6PD5yb3ewHdqoXpDDL1NDY43f7rqBMKKlE:B6PD5yb/1LLlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674681736, "uuid": "18187049-6dbc-4eff-bd42-81b06be45177", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674681736, "uuid": "f83f2b32-25f9-4d00-bdd9-380e98c91627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674681736, "uuid": "f212cb40-ce69-4d15-95fd-f1d14c27d7d5", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7821dd61-9cf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1674680931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680931, "uuid": "b3b3ccf0-3bd8-4368-94a1-7386c59d0453", "comment": "Malware payload (ArkeiStealer)", "value": "f9c2e5090004f7443c29151429788a78", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680931, "uuid": "e3a74339-99b5-4bb7-8362-f43e4134f6c2", "comment": "Malware payload (ArkeiStealer)", "value": "e8ce6cee6554f2699605da7a59abe4ff81d96c5f2e4066e2314ddac92363fdd3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680931, "uuid": "bf61cfa5-2d20-44eb-9129-1d4bc0d867a8", "comment": "Malware payload (ArkeiStealer)", "value": "77f6bf5d39ef4025c59deb8cf419358745ef83a7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680931, "uuid": "8a17b494-6895-4260-9100-e1b632773b95", "comment": "Malware payload (ArkeiStealer)", "value": "1de9daf002a7baf74853ff8283e8353c73a977d56b663b2de8ccb3cb21ffbecb9b5eda47de612fa06f5f1fd281fc26bc", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680931, "uuid": "19ff57e4-8a97-4ea2-a6fd-3a2fc8c38aa2", "value": "T1F69591706670BF54FF6ACA30CB2351F9BA98A4930D557EAF9845CB2BF9F01C34092199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680931, "uuid": "0f058bff-47f8-459b-a52f-0a8f87a3e1ef", "value": "0c97ddc9d63b0f26cfbe7178cd8dbee0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680931, "uuid": "a5e90e8b-80cf-4f2d-ba44-82a6f0cc10cb", "value": "49152:URcCv54VSke0577PvNfkoYBNVRWn2ixGdqjOJrx:URcC+Skf7PNyNVMnDx8qgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674680931, "uuid": "7b1d78d1-0276-408b-9608-8c2ecab2bb43", "value": 1917136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674680931, "uuid": "ee1b7adf-f83f-41de-8629-65e452acd8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680931, "uuid": "efa75ffa-da51-41ac-a2a7-1e770f89605f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39711bdd-9c66-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1674619838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674619838, "uuid": "137fa240-279e-42d1-91ea-0495986d3eca", "comment": "Malware payload (Stop)", "value": "f297068017e333ac96d70756a87babf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674619838, "uuid": "10db7150-92e0-4df8-8627-7d186cae2c70", "comment": "Malware payload (Stop)", "value": "e9387d76f1601429fe70f70a48b966f2ef98c5e07a61270b98114735ca5322fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674619838, "uuid": "fc19b2cf-deb7-4746-ac83-e438cb538ae6", "comment": "Malware payload (Stop)", "value": "6dbfc207b81246788e0cab826b3dd96a31dfb276", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674619838, "uuid": "cd0cfd0b-9dd8-4119-b39f-56cf48c23b09", "comment": "Malware payload (Stop)", "value": "e8e412162fb2b93ebd9402cbe4777d1203092e64aa690b2a0a239e916673e2429a3e004e5c977b42625b48ccdf883105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674619838, "uuid": "e88e5a91-a22a-4519-bf51-cc2e12ffb642", "value": "T1B815021076D0E873F45A09304825CBA1E5BAB9B14B6869C7768D6B2F5F3B3D067B6303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674619838, "uuid": "a7dedb6d-fdc5-4433-9cfa-871777ca2366", "value": "eebfb08ed8813b2a3d6d197e243c4c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674619838, "uuid": "6397cb90-304b-4d8e-aeb8-4f34ac67a9b3", "value": "12288:QKW9g/NsW3Gyybyw0oBmDHxMP+FXhf80QP0zuHtNkSkVwk1Fn8:QBg1sWjyb2oUFhRfdU0iwSkwkXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674619838, "uuid": "1d079f2f-20a6-4be4-a321-c8330cdf9820", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674619838, "uuid": "b2689f9a-2971-43f0-8d06-302941fcb994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674619838, "uuid": "32b98d7c-7439-45a6-8d59-e6a8a8ecc938", "value": "E9387D76F1601429FE70F70A48B966F2EF98C5E07A612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ec1ee0-9caa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674649232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649232, "uuid": "ccde8d1f-3c69-4639-a762-810bb2ae4522", "comment": "Malware payload (RedLineStealer)", "value": "c300fc7fa0b5d0aebf55c1a9d2826094", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649232, "uuid": "362ad732-ddfb-4d63-bee5-4c16b35c3d4a", "comment": "Malware payload (RedLineStealer)", "value": "e93e251f732561ea90a96f5c0d16a536ea95ab68b81c0c70c77efd1961d73c9f", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649232, "uuid": "690f91ed-f737-46ca-9fbf-e8e071be19ac", "comment": "Malware payload (RedLineStealer)", "value": "68b24555995738ecf377605a99c19651e34ccf60", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649232, "uuid": "a7bfe991-24e0-40f4-a9f2-2f31960ab28e", "comment": "Malware payload (RedLineStealer)", "value": "a908c21e049459671f92d1379d49d7f2b6a25629173beabd9cdbee1d1e4f4d08282d9862242d2fbcebad9fd31e3e9210", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649232, "uuid": "7f749db0-3502-42b7-b796-4c6eaa294347", "value": "T19914FA80A3D98C19D4FD16394470B968B6B27D4F54C697AE1EC0F2FD5D32F489A02BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649232, "uuid": "9db1c8f5-6bdb-4aa4-be96-5779c289df0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649232, "uuid": "a0faddd9-13a8-4150-9e70-2a59d275c082", "value": "1536:+YyhqJ0oE9rKmtZm6vTeLTbXEelgyOFpzurNtkadOUw1y/pbYY3GH:8FoDOmP/0YVu2kkrhpPGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674649232, "uuid": "9a1752e9-047e-44aa-a57e-c426ebf4072e", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674649232, "uuid": "855a422e-273f-4bb8-90a3-a884412ceb04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649232, "uuid": "befeda04-c288-4572-9021-2ed2b7fbeac8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4aaf048-9cd6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674668121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668121, "uuid": "bb07ad58-bda1-4746-9a63-90d0db0813ef", "comment": "Malware payload (Gafgyt)", "value": "4d3868b3a0509449609444b092452eb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668121, "uuid": "ab91728e-ce37-4c20-afb8-c7627a80f6df", "comment": "Malware payload (Gafgyt)", "value": "ea127acaac733f900b9ebb1757bc15d8a7cc0141f9a1e79f40442ae841631719", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668121, "uuid": "49424c71-3f3f-48e5-8816-a1335a4909f1", "comment": "Malware payload (Gafgyt)", "value": "678ba446bfa722b726aee3cec5ffb8a2f6944dc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668121, "uuid": "1ab5dfd7-9303-4e95-89ac-a31821b39b73", "comment": "Malware payload (Gafgyt)", "value": "af4ca059e23cf74be4181115596c437efdf2cf94a0592358c9edf8b53bf9ab1de740f2650148b8526bf192477c0e499f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668121, "uuid": "e2236a1d-5fb6-4459-af42-9cf58246ad90", "value": "T1D1E32A09EA408B57C1E2277AF7CB424933339B64A7DB33095928ABF43FC279D5E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668121, "uuid": "40720572-afbc-4bd1-9da9-f88578f4fc7e", "value": "3072:fuNaNpF4uVN++dkhnxpQennF4M/9OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChnLQennCM/9ekmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668121, "uuid": "715e77df-321a-44f3-9c5e-9abcf96efe66", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668121, "uuid": "150dd422-8ba6-40a8-abc1-4fba788dd75a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668121, "uuid": "ae848432-66b3-4e88-9f70-d7469babad03", "value": "4d3868b3a0509449609444b092452eb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ee43dc-9ce7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1674675324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675324, "uuid": "05e48ce8-ebd1-41be-963e-3dded6360882", "comment": "Malware payload (Guildma)", "value": "1b758bdbf80bc5467f192a318441662c", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675324, "uuid": "8f657965-edda-4abd-8e1a-e54e2f0d7d6d", "comment": "Malware payload (Guildma)", "value": "ea5efecc9d9fac5c84e3ab38a378ee5eb73d0c5cebf06706101a856eebe70cf7", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675324, "uuid": "03b46d89-69ff-40ef-a2d4-820ff211c535", "comment": "Malware payload (Guildma)", "value": "b439af7ec375e25d470369dc09658e6a5b90774b", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675324, "uuid": "da9d16d9-0614-4cc9-ba6a-d20c83977545", "comment": "Malware payload (Guildma)", "value": "ffeaf5ff284be85f31023701d429490cd0e9d2ec007f25c04918e3c69ac4091f3b4da76e09c760cadaf465e0bf220e62", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675324, "uuid": "cd396775-fab3-4b04-b2e8-484745688ae7", "value": "T153E07D1979F4EF60404E31040D5451080C897B97093034DB2E9F036047488579E5FEB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675324, "uuid": "c7726299-d1fe-4ae3-b910-1200f96bd28a", "value": "6:SGIfGlkiWGnc0dIjdzNLg0OmldmsXeTRKbDoYR0y5frMaOjWgBAzYum:Qgki9LKjdzNLLOmHm7TRKw8HBOCpzYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674675324, "uuid": "455de247-8c47-4f0d-b68e-f7b925d11437", "value": 309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674675324, "uuid": "a2677182-d855-48f1-982f-ccd9a6a6ca97", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675324, "uuid": "04a30a2b-4d5d-4297-a14a-b77b31bcc7e6", "value": "1b758bdbf80bc5467f192a318441662c.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348122e6-9ce7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1674675235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675235, "uuid": "7074ca55-048a-4988-bcbe-9485c61343ae", "comment": "Malware payload (Guildma)", "value": "47152f33bc7650e9dacd43048ef88d8d", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675235, "uuid": "ffcd9a21-401f-4733-ab73-6e181c88ef6c", "comment": "Malware payload (Guildma)", "value": "ead0e34abccaf668eb22251d4bd2a14417e20cf74ab6680f806de14353af42da", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675235, "uuid": "f8ab6e8e-c0c5-4bb5-9e73-3d3f9e72729a", "comment": "Malware payload (Guildma)", "value": "e766b059264eb6e8ff8019bfa7609a8b2a7202af", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674675235, "uuid": "65adcc57-f384-41cc-80d8-94541187bc60", "comment": "Malware payload (Guildma)", "value": "dbb5a5fc39a53df3e5766eb58f82503e78a8f89bcbf72ce6e8fd2142cd83adc45e51ffe4cdd7206a582edadad4c1bf85", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675235, "uuid": "69bf5b5a-e5d9-4c88-a782-faf3c3e3f0c6", "value": "T1ECF02B09A5A0AFA1C05D62398C5596180C8DBB974B2420DA6A9F03A8565494EBE5F9B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675235, "uuid": "cec93cae-6098-4817-a3a9-e82635cbc58b", "value": "12:8rflM8OBE6ZGFgki9LKjdzNLLOmHm7TRKw8HBOCpzY5:8loGFFsLKJNLLOkm7TuHBOgY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674675235, "uuid": "ac2ff9e8-9bb0-4ca2-8079-27fc747e64d3", "value": 485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674675235, "uuid": "5e722664-9a34-45ca-bd57-2b0076e591a8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674675235, "uuid": "442c21be-83a4-4b5d-b2e1-a064560a9f43", "value": "47152f33bc7650e9dacd43048ef88d8d.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbd40b9-9d0b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1674690658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690658, "uuid": "b0ffdb8e-1be1-42f4-a3de-818bce9a695c", "comment": "Malware payload (Gh0stRAT)", "value": "c2eda25e66bfe7cdffbdcb4c57902acb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690658, "uuid": "13d70316-9004-4152-8ca4-42db61f38ec3", "comment": "Malware payload (Gh0stRAT)", "value": "ead17f0beb6b3f0e6461f62d417b7993ea34a973932e7a260f5a45205ddb1746", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690658, "uuid": "3290bf96-6e6b-46e8-a4f9-38ab714734a0", "comment": "Malware payload (Gh0stRAT)", "value": "8c0fa10a2e7816b37e90bfd4338321cac58d1771", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690658, "uuid": "cbf82936-49e5-4782-b7b6-047277e3ad6b", "comment": "Malware payload (Gh0stRAT)", "value": "1ab1ddec952799e6ae2c73cad812b6d53ba14a32fce02f2337469633061ef72c0a01bac0381c574e16ead3edc7424bb5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690658, "uuid": "d43c4919-b727-41d3-b234-c4e6457dde46", "value": "T104248C02E69005BBE9B720B444BF7B379E7A95A40B4C5ECBB748D7A104211D1FB3638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690658, "uuid": "3ef86c8c-def5-4ab9-8fe9-107e90752963", "value": "a9208cbd352be04e687a14e0dfc18846", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690658, "uuid": "7616b90e-2961-4604-bf9e-313af915b464", "value": "3072:KdQo6wtIptugitFof9zCPc4MG77IxZa39TtsAneb/eZJ73tt4TSOB3c7TLby:sQoPIHi0zYOG77aZQ10/6J7zWSOBay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674690658, "uuid": "9e05378c-e8b9-470a-92ae-0309753fb9d6", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674690658, "uuid": "8b0d3e31-e052-4b84-8387-0369cd6033bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690658, "uuid": "660b4722-a8b2-4765-9975-b76ebdc95640", "value": "EAD17F0BEB6B3F0E6461F62D417B7993EA34A973932E7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615e173a-9c82-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674631931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674631931, "uuid": "f2a02605-d032-4b20-a2a8-4d8d9d8810c6", "comment": "Malware payload (GCleaner)", "value": "0fb4e5752b01e77c47a356a501213a2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674631931, "uuid": "b08f2b9c-a1f6-4c2e-a6b8-9a9f531055d9", "comment": "Malware payload (GCleaner)", "value": "eb3b17009ee02926a1567c13b7847a986f062058243760d393524d90a26d1433", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674631931, "uuid": "375e3592-e670-4efd-a415-96f2f7e389fc", "comment": "Malware payload (GCleaner)", "value": "f84d7cdbbf77b84cf6ee587d6cdeab909f69d7c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674631931, "uuid": "76ee1751-3493-4e24-97ac-913d07d555dd", "comment": "Malware payload (GCleaner)", "value": "9604aa45e0d8e251e59d904ece39125cd7d0c8c7f11a2db867d015b5c2d3def1e51bb7d83616f81494d293f4fa189382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674631931, "uuid": "547ea920-f980-428b-9e83-84fabfaaf4ff", "value": "T1F685335B563AD071D0212F385F37AA82F8309E7520B6A55A368A0F4C1F7B785B14BFB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674631931, "uuid": "c6befe6e-ff9f-4008-ba68-12dccca06d2d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674631931, "uuid": "e837ae21-9097-44db-a7c0-7b733978db59", "value": "24576:Z3vaPdddlLBDheYvMUo17dNB+RUc/UCUJ1MEdz/2WYi+5H2wac+XfaLC15wvnPdb:ZSP7dNN5uiO5JmEgWRiH2dzXyLCgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674631931, "uuid": "edb089f7-aeed-4aea-8354-584f12a50c88", "value": 1780733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674631931, "uuid": "532f0c8b-6043-44a4-bef3-7048def98aee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674631931, "uuid": "dba0d41d-5841-4357-a6be-0f6ee323b872", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5ab593-9c72-11ed-88f6-42010a9c006e", "comment": "Malware payload (Dharma)", "timestamp": 1674624940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674624940, "uuid": "341457fd-5eed-482e-842b-4791f3337a61", "comment": "Malware payload (Dharma)", "value": "b55a6a785c1fab2b52afc9656c639e02", "object_relation": "md5", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674624940, "uuid": "7aa828f1-faa8-44d7-a933-c369cc517fb2", "comment": "Malware payload (Dharma)", "value": "ebb17d81ffb02c01b4f49c7267246f243272ca2aecda68a44e89a33f74a47a0f", "object_relation": "sha256", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674624940, "uuid": "a519e125-ee40-4b69-b608-7275918fb66a", "comment": "Malware payload (Dharma)", "value": "b2edddd040d4071666679c6be75f916f4982f1e2", "object_relation": "sha1", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674624940, "uuid": "e67d3718-ee50-406d-9820-bbf2b9947ac3", "comment": "Malware payload (Dharma)", "value": "8e2a19f7a4d4aae925396a69986173bc53b189eecb228ed865c98c00aae6066bd04970ac403cb66416a693b480dc6ee1", "object_relation": "sha3-384", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674624940, "uuid": "fdcc9d9e-3c1c-49cd-ac89-1b620cd3602b", "value": "T1B0939D29D861C134F8A220FECBF696FDAD644B201307D4D797C16E8AABC15D5F932623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674624940, "uuid": "01c847fb-52e9-410d-b8c0-7780d52d8c27", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674624940, "uuid": "41ac3c23-be98-46fa-b83e-c65b4c2e6673", "value": "1536:tBwl+KXpsqN5vlwWYyhY9S4A7I1cRtMoKAk0izr4tXyjvb/GSA:Hw+asqN5aW/hLZjEn0rloG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674624940, "uuid": "a43c66d0-1876-4411-87b6-108b61b651c3", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674624940, "uuid": "57a9e6cf-1823-4ced-87e4-d8f9359d5dbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674624940, "uuid": "7d8a66e9-8bd4-4215-86b1-d6abfb0272a2", "value": "2023-01-24_b55a6a785c1fab2b52afc9656c639e02_crysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950a8e5f-9caa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674649197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649197, "uuid": "aa65f97d-6fd9-4e78-912f-9dcd82757202", "comment": "Malware payload (RedLineStealer)", "value": "1d623f1a6b136e2e759c3281b1b29e30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649197, "uuid": "77687f0b-f567-4e5c-ba1b-9cff72cf7f3e", "comment": "Malware payload (RedLineStealer)", "value": "ec3223e36b0e57a73d2b91a0fbef370915dc50c174b483658bc1390b7b5103eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649197, "uuid": "85c92bd3-d03b-4249-a342-ce99e9b23e69", "comment": "Malware payload (RedLineStealer)", "value": "52bd3023c34f37a6b472d044d73256a78b292b59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649197, "uuid": "fc810ed8-0b17-4a8d-b5e0-e7da7db53cfd", "comment": "Malware payload (RedLineStealer)", "value": "b4582d9178f8ed3278963811f431e5f47cd22e2b67073a8e063c315eecd36064c9a651bc58eb1e3028999add1d24d525", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649197, "uuid": "b38e48f2-82d9-4c30-86f6-85e17c5e1ce9", "value": "T110A4BF12E298BA90F59DCA328D1EABEC763DB9505F15633A323C7A3F15701E0C52A71D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649197, "uuid": "2c57d53e-31f3-457a-ac8f-d0b35b5f7eb6", "value": "787cd3f7e6d0161bfca0cbd92375e751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649197, "uuid": "866c0536-f242-4467-83c0-94a6b0340b36", "value": "6144:yLUXecoblKnfMu/m6DA0LLSSkRVHgJ+WSnjq7VWRFBMolz90JAWZm:ywXFohIku/m6V9kRE7VWR5lzCAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674649197, "uuid": "9d56267f-d095-4fb1-b836-872c5476fac3", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674649197, "uuid": "1aecf757-da58-4223-97c6-a12ff40e2a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649197, "uuid": "ebe2835f-f702-40ff-98e5-e646292ac30a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3cfe6e-9cee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674678412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678412, "uuid": "0c609f30-8263-49a5-9f3d-018ee9d85ef5", "comment": "Malware payload (AgentTesla)", "value": "ccdc91bbcdfa74bd9106d4f302953e69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678412, "uuid": "8923cf06-f28d-4939-9316-5b5250773907", "comment": "Malware payload (AgentTesla)", "value": "ec68676ceaa04b52327909ef20b1c9df65f33f59a2aa76d7052cb857b88ae905", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678412, "uuid": "180feb4e-184e-4c92-9f3b-0ffd8e02fb2b", "comment": "Malware payload (AgentTesla)", "value": "e8bda392148bad91985b4e3c99ecc8e4d21306b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678412, "uuid": "bb22c8ce-1fbb-4bcc-8694-3679054d4f2d", "comment": "Malware payload (AgentTesla)", "value": "c816a8055f4682904d50a9e0b6bea9a3067972208693a34b580c004c363a5592dfb42330a0f330f8afb0ca4504babf57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678412, "uuid": "89434a43-7abb-4d95-8c05-0772a25745d2", "value": "T1BC15DF40B278DB02EEA88FF5101255A047B22E2BEF64F3545D82B1E76A73BD13E50E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678412, "uuid": "c50606b0-633f-4786-a3f6-7e7fe9e6ddd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678412, "uuid": "33d391bd-2895-4c63-b3b4-1366f8c7f506", "value": "24576:a8kyGyOoQzlGI6AAgZeqzZKT7n014ClldiIUA:a8kypOojI6AqqzZKT7n01lli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678412, "uuid": "c1fb8efe-5878-4a47-975d-34d2c1b58c37", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678412, "uuid": "43f6a3d4-c004-403b-9baa-37ab51740255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678412, "uuid": "94a1fc59-2fb1-43ad-98a8-f0ca9c0aea68", "value": "UPS Custom Permit_AWB 2259538816.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203935c5-9c63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1674618507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674618507, "uuid": "5f6ac5e7-52ad-4914-851a-d0812a78bfe7", "comment": "Malware payload (RecordBreaker)", "value": "8097893d7a34d1b8ecacbbfbbd02477d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674618507, "uuid": "a14df768-556d-4c27-9398-0d87c5fc5782", "comment": "Malware payload (RecordBreaker)", "value": "ecc8d91bbefede66254419ae296fa8c99ea14e0382f4cad801b7efa14cb1bc4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674618507, "uuid": "b393093c-e3f9-4e8d-a671-0be939e3b06e", "comment": "Malware payload (RecordBreaker)", "value": "50f3907cd1caecafc8266ee67b1bbd131094a9b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674618507, "uuid": "435b7c64-1c4e-4522-8f73-11bfb5bcd6c4", "comment": "Malware payload (RecordBreaker)", "value": "f82936df407d977a87636f6cabe4d795df26d8767645c10abcf4d25910f8dac91f68ea2bd4fd814ee47aeb5622525c4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674618507, "uuid": "5873b3a6-94d0-49fe-91cd-bf8bf1ed7f7b", "value": "T12A14E12179A1C072C5A551381830EB90FF7AF87247A854AF3B681B7E1F707D166BA393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674618507, "uuid": "36e3a605-4917-498a-9054-d9e2721682e0", "value": "5eb8e9ebd49d9ccce156e2e9eb6d0902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674618507, "uuid": "9b682046-788f-4de4-b34a-983c43432add", "value": "3072:iLBN29thWLPa13V5LBo3W1eE0wc8qOvw3Wc1WWVPu79V:i13Li13NIW90KqRWc1Vm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674618507, "uuid": "bcd76376-aa04-472e-87bd-1c233748ca95", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674618507, "uuid": "f4c687a7-4d21-4c13-99cd-1d3bbf8c1edc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674618507, "uuid": "1d0ef986-4e0b-4f17-a91a-4189341e79fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee4bbaa-9cf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674680433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680433, "uuid": "94964180-bd27-47e5-8e92-b2e56e163ddf", "comment": "Malware payload", "value": "fb24688801de99b309433989ef175015", "object_relation": "md5", "Tag": [ { "name": "pw-wesoft2023", "colour": "#443768", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680433, "uuid": "4e7ef041-152e-473e-a3ab-673c158c4951", "comment": "Malware payload", "value": "ed69146ff450bcc08cc9967058b8ec0e0e35f9c9db0a8b994c880af1d63682fc", "object_relation": "sha256", "Tag": [ { "name": "pw-wesoft2023", "colour": "#443768", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680433, "uuid": "5d96cbc7-ce05-4c44-a7a0-60fbd6072dfe", "comment": "Malware payload", "value": "9b8a4ba244b3fcd9e292917aa4c9f40fa0c0c998", "object_relation": "sha1", "Tag": [ { "name": "pw-wesoft2023", "colour": "#443768", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674680433, "uuid": "c0ced9eb-975b-4a53-a84b-37130c08a543", "comment": "Malware payload", "value": "995cec3c09bb38bf787f48176193997dfabf666db26d9199256286849fa20ee2d81c4eae1c9eebdd7b0771ecdd6e7625", "object_relation": "sha3-384", "Tag": [ { "name": "pw-wesoft2023", "colour": "#443768", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680433, "uuid": "200e6f8e-2cfd-42af-9d6c-5710480c9884", "value": "T1935633FAD1F43755B8C80A7E0432F41C349B754A86ECB83EC2E581F58363505A5B6EBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680433, "uuid": "39df46ba-a9f2-4188-8341-d0cb3f026721", "value": "98304:yQ2ubgECEvNgPCEGjfnaCxifp/hKE0DbTA9/VMIg5NldWyPKI5VSN:ou0ECEFkCEWfn1cxkEibs9dEmNGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674680433, "uuid": "280fedc3-f9dd-45a5-b354-5c37cc0d13cf", "value": 6055086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674680433, "uuid": "a1d638dc-14b8-43d1-a79f-3ecffb6fcf6a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674680433, "uuid": "1d78a267-8d6f-4c09-9050-d6d5b2a01b92", "value": "WeSoftApp.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2688904e-9d09-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674689814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674689814, "uuid": "b62b87e2-f77e-46d0-92ec-41a26db2755a", "comment": "Malware payload", "value": "c1ceae475c424c7693bc024913a8798e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674689814, "uuid": "e5371f6a-b060-4649-a54c-f7ce57c63d47", "comment": "Malware payload", "value": "ee49ab56811c88e78e2f51d9f556a7cf5da2eaf73c2682896c8809e6bd202f0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674689814, "uuid": "b9b06b08-b0de-496f-971e-28f4e5f573a8", "comment": "Malware payload", "value": "4d0a343780a4a1033d29d1ad881fdda5d3ccaa5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674689814, "uuid": "e915c2ca-b541-435e-9356-ace867f1ea34", "comment": "Malware payload", "value": "060ca5695ca01205873706af00d7e1b3192e74fdb044aba040e710e626eb4d81ca43135dccb357ce27859906d10cc2c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674689814, "uuid": "0bcdbb2d-ef99-4c54-a655-fcde7f5abbb8", "value": "T11564AE2272D0B8D0F9564A36CD2ADBD4396EF9D38F3C735B33D4AA1F18722A0D522615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674689814, "uuid": "41e28dee-65e5-4020-824d-e75125acc629", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674689814, "uuid": "130e2b5e-2480-427e-b135-cf23a537539b", "value": "3072:g/RML1L/nmySZbOfLRsctqfQxfTq2eayRELsr3sth/Q1+BOLH6g0+L4Oi/XcLYBb:xpLuySZbJoIneHfBOmg0+MOKXpKUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674689814, "uuid": "3cde47fd-8e5d-4a1b-8802-aa5b6daed3d0", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674689814, "uuid": "568c32e8-d9ba-4b5a-bf53-46a16a7a6e3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674689814, "uuid": "3affc8e8-879a-4977-8fa1-1f851cbecebd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf5c27d-9c7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674630821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630821, "uuid": "ab7c6f4c-0f07-4e4e-9113-886ae1b89b4a", "comment": "Malware payload (AgentTesla)", "value": "b3dd63c763ef1e2491c1abd4e7187f36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630821, "uuid": "a25f837c-be87-45fe-a21d-2eedc7cb8b44", "comment": "Malware payload (AgentTesla)", "value": "eebb3965175a6262b4bfc219589ca51349dab2924e9132648c50127da99a4f4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630821, "uuid": "051bb1f8-c797-4e22-a78a-952dab8a1db0", "comment": "Malware payload (AgentTesla)", "value": "0eab67a978f26410e345e28c8b2d99b24426671b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630821, "uuid": "62a3f551-96a6-48c4-9dac-5fc5bd8fd5fe", "comment": "Malware payload (AgentTesla)", "value": "b52a2f973625248cf08de97ef7dd0fb7c8aa7495720d52abc97f7477229f0f93545089a49770fd694b094e0677b3a105", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630821, "uuid": "b0be901a-dac5-4ba4-83c2-85a1835dae60", "value": "T10EF4BEBC7694ED8FC4678FBA85442C00A660F4735F03F383A05B15A99A1E7DE8E546E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630821, "uuid": "0b0c5d6f-8d36-455d-8af0-96ea593e6711", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630821, "uuid": "0ae903fa-911c-4002-8a7f-f40217f143de", "value": "12288:SA7DPkkgCds9eH/BckAdFXJIFtuy8va+wrykZm9ik:jPxndXpAIFt8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674630821, "uuid": "13724b0d-e572-4972-a69a-ae3503f18ebc", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674630821, "uuid": "30a3d1f2-959b-4555-aaf9-0b3771858b8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630821, "uuid": "5bfa63df-87da-47b3-afc0-378e16c36cb1", "value": "FedEx Express Receipt_AWB#53053232004643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13fda4cb-9cd8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674668738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668738, "uuid": "9c2f12a4-3ab0-47f8-851d-cdcd0e8c6087", "comment": "Malware payload (RedLineStealer)", "value": "abd29e229b6b0e10c0861e88c6b7eb96", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw - Proton2023", "colour": "#145D34", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668738, "uuid": "2b30e0ed-44d8-4a8f-8a29-8938d08afaae", "comment": "Malware payload (RedLineStealer)", "value": "eed0e0dadc48f8a2d03bde34668e382fb51d4368bda623d5ddce69c64395f648", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw - Proton2023", "colour": "#145D34", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668738, "uuid": "12eac37d-ee97-488a-8d71-5208d529a675", "comment": "Malware payload (RedLineStealer)", "value": "3684aae6d8897b11aec2e9c3a8c272d59a3c9f2e", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw - Proton2023", "colour": "#145D34", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668738, "uuid": "ca3a6d23-a551-4936-9fb4-9be37f14086a", "comment": "Malware payload (RedLineStealer)", "value": "b05a366e54ae7361afb26a516229b23a794ff9f33759bce11aadbfdb135d87c83050a70294800972119a5054001fc9a3", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw - Proton2023", "colour": "#145D34", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668738, "uuid": "10261197-cb0d-4952-90ec-4b90b6101b3f", "value": "T13DA633C695DE4BE028EFE3E7A4AD201E629533EA5D7D3243B6827AF53C1550F6C0A04D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668738, "uuid": "c807bf6e-b201-4710-979a-7a496234b148", "value": "196608:Ffr1BZ1UKKqRmqfdZk++YyIRt41WSDce8ohAUsTKR2TwGrSs9H:ZZBZ1dXpfdS++YyIT41TDPiTKAMGrSs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668738, "uuid": "38d60d4c-a042-4c01-b730-e7e1c117af05", "value": 9618123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668738, "uuid": "7dfe5009-f957-46ca-8f9c-dd342af9e825", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668738, "uuid": "5a46351c-8f4c-40d8-8de3-cfb8c68462e2", "value": "PROTON Partnerships.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b22d26-9c7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1674628348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674628348, "uuid": "e8b59781-1ff2-407c-9dc7-4ad6d5d0b97d", "comment": "Malware payload (Amadey)", "value": "88ef1281b1e3897911f992dc40425bd7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674628348, "uuid": "60168e02-afa5-4995-ad8f-b863f69a88ca", "comment": "Malware payload (Amadey)", "value": "f007ec211eb7d37d659855ee92327c26c74a339b602eaa473e8bcd596be1b7df", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674628348, "uuid": "7a1f71c6-c66c-4955-a5e7-849231953ddf", "comment": "Malware payload (Amadey)", "value": "531331ad0e440addec658dda886cdc4d41720039", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674628348, "uuid": "46405554-7bf0-4af5-9dfe-b111c9378779", "comment": "Malware payload (Amadey)", "value": "bd11744105dcba53e3e12367330b0a60d4db3ce7a561437df63e28fff65ec06b14bcb758e4481121ed3bec0b6a50dd90", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674628348, "uuid": "2f0956c1-9958-493e-99f0-9a40c00bf7cf", "value": "T197748D02E2A8BE91F4D9CA318D1EA7DC763EF9518D156625322C7A3F27701E1C52E31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674628348, "uuid": "3d66a351-0798-4f56-91b1-2ace0ac9804a", "value": "861af707b319724b1132a7a971c54bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674628348, "uuid": "1864602e-37d4-40fb-bd4b-04b44ac2813d", "value": "6144:7ZwLRnpK/puityxQdhDhJ5jq7VWRFBMolz900:72ZpK/IityxEhg7VWR5lzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674628348, "uuid": "3e3b59fe-142e-4932-bfb2-8f2f10e05259", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674628348, "uuid": "b1e5f30a-a6af-44c4-98fb-6a9ab88c3871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674628348, "uuid": "6d3b9466-db0d-40b5-8a53-332f38e3405e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e4cb6f-9cb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1674655270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655270, "uuid": "209004ac-caad-4ecc-b295-f1981495fb9f", "comment": "Malware payload (CoinMiner)", "value": "9ce12515012b3707e38586841dd12e88", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655270, "uuid": "fb87c6ea-927e-4f1d-8f88-d6050b5c6462", "comment": "Malware payload (CoinMiner)", "value": "f06d698967cee77e5a7bf9835b0a93394097e7590c156ed0d8c6304345701cfa", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655270, "uuid": "6656b181-0cd7-4ccd-b1ce-ec65eaf719a9", "comment": "Malware payload (CoinMiner)", "value": "30e3b6b788abf3975845aeb79ce5f2f1e913e964", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655270, "uuid": "8c89dba6-f7a0-45ed-94dc-d4c14a866959", "comment": "Malware payload (CoinMiner)", "value": "1002604dd85728a0d8e89c8361acf4543e2f9ded488439182ca02c4fa5fa0030f2f369e67b950fddb1a9634a96e341e1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655270, "uuid": "f4164832-4607-4b73-9930-72b6316dca75", "value": "T14F066D5BF1E320FCC19BD030475BD7636A31B8A902307E7B6684EA752E62E60676DF11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655270, "uuid": "411fa2a3-bb72-4403-b038-8a57813ebd92", "value": "98304:8V7K94UU7vqyQdj2S7fqECV8QUbMNvEKwFq3kSf7IMzqfyJd4P92uEabQvaRPi:O7rNvEKwFq3kSfgfyJd4PkT1ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674655270, "uuid": "058aab6e-bf9b-4c52-9cb8-07e8cebe8df1", "value": 3873353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674655270, "uuid": "a7ab7195-e225-4f24-a7b8-bd9987ee7985", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655270, "uuid": "cd69e615-53d3-4cf6-bf21-d2e21c4a296e", "value": "f06d698967cee77e5a7bf9835b0a93394097e7590c156ed0d8c6304345701cfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c01fb7-9cb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1674651581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651581, "uuid": "0b72faab-31b3-462d-9e85-54b996f1e374", "comment": "Malware payload (zgRAT)", "value": "0596aefc251ba32dcb538593b0616568", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651581, "uuid": "684e271a-d27d-4bbf-b840-45bc1a67be61", "comment": "Malware payload (zgRAT)", "value": "f085f0ece42084f2ce26c28a27ebc9457ae32b2ecd632b3073500b7e17805659", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651581, "uuid": "3184bacc-64ad-4b7e-83df-04dddbdd184f", "comment": "Malware payload (zgRAT)", "value": "9ceb68e35b93711e8247512c21ad2ccd6b8da938", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651581, "uuid": "a255599b-1311-4bf7-9dd0-251301b65611", "comment": "Malware payload (zgRAT)", "value": "75f23c41a0279ff34c0966e8ad31a5f89ce93d0d909d88c540c0f68be8a2a489fd5009241c6fc46fd5c963adedf18e25", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651581, "uuid": "521823f4-bc1b-491e-b005-3beb19fa0247", "value": "T195A523D4F3841AB2CC69FF7626AF6AF127633CFCEC2665555408B63E4C7A3609422D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651581, "uuid": "d1cba108-a4dc-46b8-ab5d-46d00c2bc995", "value": "49152:gbB0FQB5MLPlG5/8uMLq0u5hRD5pbjX7i4l8B/oy6kRMF4mK/LPS/yYCxL:g90sW0dRfj7O/oyBqi/TS/yYCxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674651581, "uuid": "797197db-f0fd-43a1-900a-0b7aa307caf4", "value": 2187264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674651581, "uuid": "03454b35-eadb-4ec5-acbd-484d573c8a10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651581, "uuid": "26ebfff8-b0db-4b08-b297-0b98bb816d47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75148199-9c49-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674607482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607482, "uuid": "0b39e262-2f55-45dd-9d28-4f0c1b6f657c", "comment": "Malware payload (Mirai)", "value": "d162a4bb0501c59510cf265725ed8f2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607482, "uuid": "3b729bce-4830-43cc-a633-61fdfd72a0d0", "comment": "Malware payload (Mirai)", "value": "f0ed95cc9a8c9972afe69254fcd9ecc429074b27bfaddfafecb763b9a4fbabcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607482, "uuid": "efa46f99-d309-46f0-855d-ea2445807fff", "comment": "Malware payload (Mirai)", "value": "fc5295d47f2a41f9e5a60b3559e7094ec84dafe2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607482, "uuid": "3dfff375-78f3-4095-abdf-92b3b2d2a92e", "comment": "Malware payload (Mirai)", "value": "4002f83c8c9c0ba6bef80843ab4cd01703fa3290c8b3b2ba354db6e4fdd1641b6ad12ecd9556743eacd338042d1ec802", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607482, "uuid": "c2aac3cc-b4df-4386-8e5e-cbe213bae06b", "value": "T114230842B22C0947C6929A70273FC2F1C3FBA97C20E4B6CD251F6B568D35D769186F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607482, "uuid": "994ffffa-ecc9-4c24-b78f-6c58bc1c4c1e", "value": "768:mprZsuBw6xEvk1qn0E66RGE27lKWKLuBT9WIEYbYbYbYH:mz+vk1qnRlwAuBTAQ000H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674607482, "uuid": "2aee8d71-2eb0-4878-a8ec-1250e3cb5caa", "value": 47352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674607482, "uuid": "402ff82d-aa86-4784-bc50-011ed0baae7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607482, "uuid": "137a0c96-d892-4604-a948-9b03c30b7afd", "value": "d162a4bb0501c59510cf265725ed8f2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d7f734-9caf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674651257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651257, "uuid": "8952079c-c939-4069-83be-277e2ba6531d", "comment": "Malware payload", "value": "30628f0f7f9870aef93172de5936bab6", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651257, "uuid": "8525be48-e7fc-4b47-90c6-0421deac4189", "comment": "Malware payload", "value": "f18652128eed28061610cd1b5c19d5189e3204487934ab67a5d805e0ab64e78b", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651257, "uuid": "d2deb406-6ad3-4d46-9c2a-eb305c7aeb7d", "comment": "Malware payload", "value": "d59b673cf773db9f4b16b806825b2638a582b22b", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674651257, "uuid": "6e6c3d18-0a27-4400-b1db-8e09eaaa42d9", "comment": "Malware payload", "value": "13f18c94340b828fd9fd6b61b367337de39bbaec301e97349dec600317ec020e9f662b68466d4e844f4d46caaaf17ce0", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651257, "uuid": "a582d312-6a76-4e29-804b-c59abe45bc47", "value": "T115B2736EB80E0CED801AEE456AF5F847D8277042AAC99DC37AD7CD176010FA26D0D793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651257, "uuid": "0dfc7230-7d84-429c-8411-e595e24c57ef", "value": "384:YPH1+0O5hhSLH6LS19rMKAN90SVnErRPHVhJp3SbEQSVnEbaCPHLh61SVnELaW8r:oHoJH8aLS/DcueEVHDjibBeE9HVSeERa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674651257, "uuid": "24110ad3-bedc-4f3f-96eb-dd565b79c20d", "value": 24378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674651257, "uuid": "ac2bb9ea-1b3a-4882-aef4-9ea7880c0356", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674651257, "uuid": "295e4fb7-3a24-4e8b-828a-042a7c66efe5", "value": "informeCritico.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc03eca-9ce2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674673207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674673207, "uuid": "ca02c85e-22cb-4a40-b76b-f99942eabe05", "comment": "Malware payload (Smoke Loader)", "value": "3e6d47e0fc966755127459fd9d87c565", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674673207, "uuid": "83aef246-a8b1-4c24-b8d7-a8adc21a08bf", "comment": "Malware payload (Smoke Loader)", "value": "f1c5218cc5183088f61660308dd662f0129d59dd71cb742c846e6c334ff6c7b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674673207, "uuid": "ffc5251f-8f6b-4469-a9f3-f9e2e179d5ec", "comment": "Malware payload (Smoke Loader)", "value": "bbd6be4a40cc4d26bfebbead7170689c66b6f7af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674673207, "uuid": "a7330b4f-b03f-4d39-a406-f3ad64ec27cf", "comment": "Malware payload (Smoke Loader)", "value": "7b0d023226343ddcf7e8a083a7ea7b9100155efc965a53febf83f795d7d5f9947dce2472f1e7adf3e5c6952551b983c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674673207, "uuid": "8a675693-8cfa-4fc8-aa0f-74866b972236", "value": "T1AF64BF2172D0A860F9194A36CD2AEBD43B6DF8D28F3DB35732D4671F28F32A1C566215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674673207, "uuid": "c59b9366-a7f9-4ac8-9c77-f10cb027ce6c", "value": "8ec76f5c59a9f0c161f9365e55dfcda6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674673207, "uuid": "47d7dfd3-8306-4a50-98cf-65f7952ca3f4", "value": "6144:7zzLc7SwKysdFqf6UaydI0+MOKX8GIDeniWUTn:7f2SPyQLWQWUTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674673207, "uuid": "1db93e02-5acf-4f54-9723-1dca019fecbf", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674673207, "uuid": "d8f359f5-9f89-434d-a189-aab3f28a5ade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674673207, "uuid": "63bea3ab-8579-4cce-9f4c-598a5cc918e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17127175-9c9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674642114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642114, "uuid": "ad873a98-22ec-4143-bab1-aaed75a66c61", "comment": "Malware payload (Smoke Loader)", "value": "233c8fb34be6191c517d14f49ecbdf67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642114, "uuid": "9350aa42-783c-43b0-a05a-375634e8c273", "comment": "Malware payload (Smoke Loader)", "value": "f22786a37967bb75c2236e0c5718db4deeaa3ab46772b8230525f021c9d23caa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642114, "uuid": "f2bfd983-db02-4264-b29a-6c556f1088a4", "comment": "Malware payload (Smoke Loader)", "value": "e166c4e5dd9cd730da70f8107da227358359cfcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642114, "uuid": "940de9ff-e982-4daa-ae08-5f8fcc514e1f", "comment": "Malware payload (Smoke Loader)", "value": "5475190dfac05da458f6fe6184b09ae651537530f2e39ed47ccd726f656bf86db50a107909cf9b95a63ff1797fdab322", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642114, "uuid": "60823bee-45ff-419e-8bd0-00626880a793", "value": "T18D748E12E299BED1F599CA318D1EA7DC363EF8918F146636322C7A3F25701E0C52A31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642114, "uuid": "25a3c36e-434b-4a8b-b95c-c32c5e0e63e9", "value": "861af707b319724b1132a7a971c54bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642114, "uuid": "2ff4c45f-9429-423c-98e3-c75831ce0f5a", "value": "6144:ODLCug/OKNbC/hLCS0R0Ppbz5Djq7VWRFBMolz90XfkT:aGJ18/8STpvY7VWR5lz+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674642114, "uuid": "03e53f2c-d107-47ce-8ab4-973c694a7d0f", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674642114, "uuid": "b0da41fe-3aef-472b-a888-9eb97d644afb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642114, "uuid": "dd0466ad-14b8-4bc4-991e-e5b6012c0b5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a789dd-9c7d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674629863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674629863, "uuid": "157b70bd-85ef-488a-ae68-7468dce38db4", "comment": "Malware payload (Formbook)", "value": "19465536d631611e809784cf92d5f3dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674629863, "uuid": "5c141e8d-9619-43fe-8571-b6e976e60897", "comment": "Malware payload (Formbook)", "value": "f2a813ed5d99e263f28a0b9224ae1d4f484b606cab37305b56c75a70cff31518", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674629863, "uuid": "0a53dc0a-7587-47c4-9538-8e5f1eff46d1", "comment": "Malware payload (Formbook)", "value": "d6348309083c3f15fc0158a3a57534c88b71706a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674629863, "uuid": "0eff50a7-ff94-4b66-bf22-a0cc1c89c842", "comment": "Malware payload (Formbook)", "value": "2a87421ac5ef8cb73d15ffceb9db8f43ccf432f2358f26e01febecb2cea60f2ff4d91d3cbbcbba3b569fc70afe911b5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674629863, "uuid": "778e22f7-413f-4b96-a0b9-843554ff8988", "value": "T15B157BE1435D99F9F9A51F3516293D1862A66C8BC7B0D02DBE4B743F94F528A00F83E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674629863, "uuid": "d7ebc543-d0a6-4eba-80b6-bfd6394785fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674629863, "uuid": "2e350dd9-88f7-4413-ab2d-bd17db53285c", "value": "12288:X+X+77kQ97VqVEnUn6qtIhMTmKC8JS4qQbX4TX3zm8FUzW/Eggzx00/wl2HfI6aZ:X+X+79bqSKIKTpC8JxBbEzmxzJA6AL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674629863, "uuid": "268c411e-cf90-45c1-81c1-9c1e0c474ccd", "value": 949760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674629863, "uuid": "4e41e4b0-d938-442e-9bff-24353090fadf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674629863, "uuid": "4970737b-8f2c-4172-b555-d2cfdb025068", "value": "COMPUTATION DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea71f8d-9ca6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674647307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647307, "uuid": "c596b4e1-6e12-43be-8619-6ce8ab43c6c3", "comment": "Malware payload", "value": "a73e4ef4fb0982c6efeaaa4ece59d58b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647307, "uuid": "47c6ecd0-8bde-4a0e-a089-654222b1d252", "comment": "Malware payload", "value": "f58292078342730e873a7f4b01d1cab543256abe90097b32582344b4ed28e3cb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647307, "uuid": "bcfa38cc-3a4f-4ce1-8a23-52266bc69994", "comment": "Malware payload", "value": "65ef2539189a90a5b176550b02d1ecc93ade6b4a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674647307, "uuid": "ed6cda9b-54ac-4c3c-ada4-28e92e587700", "comment": "Malware payload", "value": "2ddea623fcb65039072427848a0eb2d11c4fc998844e0431b9f22d309594db8e17f6b671206a2e138005e5c43e7d4e50", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647307, "uuid": "16c010d7-a7e1-4301-8020-b6f38422be34", "value": "T1D7530219C27C21518F7C13B2EC5133C84AFAD9551E48367A4389FC849A82B7BBE4A6C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647307, "uuid": "ff62baa3-3a23-4a73-8045-cbbecf9bcc2c", "value": "1536:sI5NX5kIXJvmE6TeYVo/2dUF9oEKD2NTF:sIXX5kJE6/K2iF9nKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674647307, "uuid": "6729da84-0b07-4013-af24-6d70ab267107", "value": 65635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674647307, "uuid": "0515215e-fe57-4d04-bda0-0d6db2db8e5e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674647307, "uuid": "4db77888-0aee-4d13-8f23-55d3a1c7766d", "value": "INV-27-12-022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d246114-9cfd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674684859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684859, "uuid": "be57ac80-3a86-44a3-b773-4740706b3547", "comment": "Malware payload", "value": "d9b503d2c40560b089e4f02e72b66fc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684859, "uuid": "dbb2157b-abc4-4a23-9254-2fa414e9a61e", "comment": "Malware payload", "value": "f5a84bf51c4075d3dc72f3fb33a6137292b453086642a95114bdb3a5eb00195a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684859, "uuid": "556beefa-e07c-40b2-a37d-ff3cf9725865", "comment": "Malware payload", "value": "8ffa6faedfdec1ea757c67d20c09fb95addd294d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684859, "uuid": "72e6c69e-2b46-4672-aec7-829b02b50452", "comment": "Malware payload", "value": "fb727d5c3228340890a261557871f330329f3dcfc509a73ebcdc9d80cf88156a3e4fdc841c21ffaadf718ba819bf5a7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684859, "uuid": "c37daadd-0265-4fe3-b49d-40795fc9ef34", "value": "T1EB84CF2279D07C60ED294636CD2BDBD4392EB8D28F3D770732E4A61F2D732A0D526256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684859, "uuid": "053af04c-31d4-48ef-a508-f8db04fa5ac6", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684859, "uuid": "9dcec11e-86fd-4947-b3a4-2241402e3adc", "value": "6144:nILEGr9HWQ5oQCjEpvKwxUEmgRl80+MOKX3b4UT:nIJRHWCoQC4xug0WQUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674684859, "uuid": "ec0f6c73-7e6a-42ec-a502-dcef5b0a0a4f", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674684859, "uuid": "67381172-c798-41e9-8266-55b3e02f3718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684859, "uuid": "e8d1b735-d49a-40f9-b586-3ccbb9eb0d2f", "value": "d9b503d2c40560b089e4f02e72b66fc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2195df-9cdb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1674670231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670231, "uuid": "4b3304e5-802b-4066-a255-6938cb826bfc", "comment": "Malware payload (AveMariaRAT)", "value": "8c49dfb1a471937fac6b6bc493e2fe75", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670231, "uuid": "5a7a71b2-6b3b-4083-bfdb-4da37b58afb1", "comment": "Malware payload (AveMariaRAT)", "value": "f61da7d25fd86a1f145e8e337461f919f2b1f6f74388482786737177c5d707ce", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670231, "uuid": "0b4b2136-f085-48e9-8b54-fcb735c7b6c5", "comment": "Malware payload (AveMariaRAT)", "value": "f2e12e9b558f26241310824d5bcd4a8c64fccd55", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674670231, "uuid": "19f162c0-841d-4c34-909e-7642c09f3f7f", "comment": "Malware payload (AveMariaRAT)", "value": "806148a5edcdef44b19365bc89711f3e5b1d15fa3b473284d152ad4b2f735a490489e021fd2b48313a99e3a94f2ba417", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670231, "uuid": "1a17a3fa-b9cf-4f15-a583-795f3009952b", "value": "T16B357AF531690A23C276A8087419732D2E11E65C18C7276DDB6FC2B19F5FAE35E88327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670231, "uuid": "5f3aa1f5-f873-44f2-8e78-0d7773a5aa45", "value": "12288:xKfFP11Qkd0NED0C1pT+qPycFzV15fVzFHRsUr:cfFPgOHD0C1pT+qPycFzH5DRsUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674670231, "uuid": "f7955775-b717-437e-965e-e2e4d3990b00", "value": 1135423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674670231, "uuid": "b3409342-d64e-4709-8181-08e1edabf6e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674670231, "uuid": "e1d8b4aa-d67b-43fc-a937-d3567c21c514", "value": "Scan_20230124_105556.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f36283c-9cef-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674678662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678662, "uuid": "c2bf744c-d271-4c7e-a8a8-1517044be712", "comment": "Malware payload (SnakeKeylogger)", "value": "5af3b9cee4ef5f2b9210486ea52f4b93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678662, "uuid": "ad08255a-d445-4f35-ae54-5fc8f262a621", "comment": "Malware payload (SnakeKeylogger)", "value": "f62a125f352829465fa47169796d506a7a26766b1ae2f2a3b55df58970996bda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678662, "uuid": "0d9561dd-eb19-43d6-a4a2-8ef43f01570a", "comment": "Malware payload (SnakeKeylogger)", "value": "90d93618f9b603bc160b09e58f778790e8ca9ce1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678662, "uuid": "c2ec397d-d7da-477c-80bc-6c829ca44a0d", "comment": "Malware payload (SnakeKeylogger)", "value": "5543859b1d2b457f52d2f8a5d7088a4722d2837fa80902b826e99d328ca2ba681e737a6a0551139c4ae0785f8cded1e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678662, "uuid": "f024ccfc-551c-401c-ae51-5b5c0381e011", "value": "T168E1D800B39C4372DE734B37A8E353401774E35598938BBEACA5622BED166850E72BB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678662, "uuid": "9b2fae0b-28e2-40ad-8087-1fe89a4ec17a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678662, "uuid": "e06d9ba9-43d7-4579-8592-ff8cd54032a5", "value": "96:H/ipKgeeUOyVZfmVLhjtU3R9070IDkPOtuZizNt:V8anCLhjtSE/YPOKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678662, "uuid": "6627c101-90d2-4fa4-9715-ba48d2d66367", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678662, "uuid": "ca868937-5b11-4dca-879d-2d864c3188fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678662, "uuid": "3197f645-e333-419a-a2ef-7b3da68f2d94", "value": "Ojqremwj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa61bcdd-9cd6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674668265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668265, "uuid": "267d4171-9beb-47c4-a439-f7fa1a8bd546", "comment": "Malware payload (Smoke Loader)", "value": "3a08ad9e7276b2996c28f9f57ec08f2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668265, "uuid": "bf8a0f2f-9e9e-4eb0-bd88-353480a5774d", "comment": "Malware payload (Smoke Loader)", "value": "f665feace3274a8d0f20b01af94ccc09ff114de5f8da6f4b32b08cdf86a70a43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668265, "uuid": "ef3cd34c-893f-40a7-8fc6-2842fb441f9f", "comment": "Malware payload (Smoke Loader)", "value": "30f30ba74de4593c1b4e0414fd612cc8b144ff90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668265, "uuid": "0bae612f-6dc4-45a4-93c7-084e161f15a6", "comment": "Malware payload (Smoke Loader)", "value": "509b95fe595b65ca2f40dfe6b8d523b86fe806b9fa8c192b3ed6f371e3a772e052eefa1f8662fdd63123472424729983", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668265, "uuid": "f1902697-1813-416e-b081-89a9acd24d66", "value": "T16664AE127690FCA0F9164A76CD2ADBD4392EF8D28F3C735732D4EA1F29732A0C566215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668265, "uuid": "8e54f935-24b7-4e67-aac4-15cc678ea2a9", "value": "8ec76f5c59a9f0c161f9365e55dfcda6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668265, "uuid": "9d1657f2-bbf7-4794-a0c9-dee55e07cb96", "value": "6144:kjZLmln7cuzqfiejX19+Fwe0+MOKXkex6yOUTn:k96nHzq66qrWwAUUTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668265, "uuid": "d77912d1-90ff-45e1-8474-d7a4adc13453", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668265, "uuid": "c473d872-f099-4c33-a9e9-c964bac05e0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668265, "uuid": "54a5c8c5-1964-46a9-a452-15efe540d143", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ff3894-9caa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674649199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649199, "uuid": "afb243b8-f4bb-4be8-b477-61911e7f6224", "comment": "Malware payload (Formbook)", "value": "58b8732ed17532b518bd90b68b934b23", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649199, "uuid": "6b8ca82a-273b-4670-b7bf-600bfedc769a", "comment": "Malware payload (Formbook)", "value": "f6eb53bca5075725d889aa5de1f4541cd764bed2bd46aeefcfa4a1b018b6a4fb", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649199, "uuid": "9605a37d-3cb7-48f1-858f-bca7ab4045f6", "comment": "Malware payload (Formbook)", "value": "dbb672289a9ebde17cb77424615a1c186995d1f3", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674649199, "uuid": "3e097312-5b23-4760-b0bf-eac51fd841e1", "comment": "Malware payload (Formbook)", "value": "114a23f5fd1a46674aae03db02facecf179f086b52660519138841f9d670307ce00bbd7f18df7ea7c7d46f47059941fc", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649199, "uuid": "01cb7b9a-f358-4165-a784-a48481659086", "value": "T15F54227EBFF4567EC075C6324EE354522AE1103E2E03AA6D6E976338DC24BD327154A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649199, "uuid": "5967280a-97f9-4015-91bc-f6138ff621aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649199, "uuid": "6ced92b0-e404-4cc7-9695-736e4242f313", "value": "6144:Z4CJRQliHM5ZsM5Iszp/znpBIZYJrAHAY7e1+vJmuxt:VuYMx5IshzrInH34+Bmuxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674649199, "uuid": "2895ddee-cf27-4529-a250-3d5cb5b77579", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674649199, "uuid": "0fa5fa7b-54be-4d2c-b8fd-a26cace26a37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674649199, "uuid": "0379d782-cf46-4113-80a1-68c5962c1353", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67134994-9c49-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674607459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607459, "uuid": "f308d39f-a4aa-4ba6-8a19-77ccca9ebbe0", "comment": "Malware payload (Mirai)", "value": "1db20f99c7c50d41fd908a2a06d49b37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607459, "uuid": "1eb0b0c4-1109-4003-af27-06632350e43d", "comment": "Malware payload (Mirai)", "value": "f7143eaa5681597889ad088993e1da2070570621f92a951bf10564f124fb9d56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607459, "uuid": "5442506c-63e5-4282-9888-20baf074741d", "comment": "Malware payload (Mirai)", "value": "b5be6377790e520f1c5b62a97f95be9435db8c81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674607459, "uuid": "f329825c-1653-49dd-9027-c9f7e1a6a220", "comment": "Malware payload (Mirai)", "value": "dd63483b27057c303e3b4bb48bfbd5bcb3a2e7f0e64bd2a47f541883c6dbaf5e4df69b0364aa5b64e41b3a7326f5d342", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607459, "uuid": "ff7cfba2-1bcd-4a9e-b4bf-156360ad7042", "value": "T11B136C6B8439AEC8D558B63C78624E39176BE024835F1FBB1784846982C7FACF5173E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607459, "uuid": "9b86dbbc-19d8-475f-bddc-93b495631ea6", "value": "768:YaJkRCwtjhDkfuN89raqGGaeOZkXfDLEnCTooTG2kvjwdDh:YaYCwt18WcfDLEnj1EdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674607459, "uuid": "081ccf3f-ac01-467a-84a7-1916d3b82cb7", "value": 43736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674607459, "uuid": "f98eda49-5766-45dd-a24f-2631eb73d797", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674607459, "uuid": "0be15f26-dd78-43a5-b3f0-864bb31ac90f", "value": "1db20f99c7c50d41fd908a2a06d49b37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d8409d-9d0a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674690598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690598, "uuid": "f071718f-7f44-4c5f-92cf-a4fad6847d07", "comment": "Malware payload", "value": "0978578bab20584de47a0bb6e1eff58b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690598, "uuid": "4f725413-c167-42d0-8c6a-e8a0291686f5", "comment": "Malware payload", "value": "f71c5f39ee84e6e4c7f647cc424e64b46f4e6cff081e6c153217670486056e98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690598, "uuid": "9a4bcbbd-8543-42b7-8534-3c440d758e8d", "comment": "Malware payload", "value": "e4fba06d1759ec87b4048ef1571a85d57b8b844a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674690598, "uuid": "6dadf825-8062-4161-b900-ba3935cea9e1", "comment": "Malware payload", "value": "0ab410ee1c0487cd905b1b20d1ef2347f78053c02e9e6028b39c32aef47f6475bb31599c753f30ca59f820283eeed14e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690598, "uuid": "f8047e6c-e4ea-4028-ba61-1e89476c3070", "value": "T12BD5E011FF2DE4B1F2AA8138D56285BC4E202C26BAD281577E7CFE0D6775381607A739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690598, "uuid": "5c4c5c0b-1512-4ec6-8a04-a2969058f5f2", "value": "deb4d3a9d45e0bc2f710694103c0f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690598, "uuid": "bfd960df-2789-4b95-b5d6-93e03e224a72", "value": "24576:nLGXfyAY+g9ZogVAQg6RZAhtWBbBN+HnquJoUzMu+V1oTrg+JniCsV8AXNTn:nLGu9ZogVNbW4bBIVlZV0hCsTXNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674690598, "uuid": "eafe0d16-e608-4796-aa6a-3f4ae421bb82", "value": 2802176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674690598, "uuid": "24ad6d5e-3039-4625-80a4-8f33f8315c81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674690598, "uuid": "bbf7a0cf-c3ca-4a08-b5e9-849f90509319", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a10ff56-9c9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674642119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642119, "uuid": "d75c8f13-b682-475b-b048-b0b7821584fc", "comment": "Malware payload (Formbook)", "value": "3e0ff29b04ce9b6ca93fe26eae5ea271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642119, "uuid": "b58bc291-f286-4069-aa5d-5afd11c3d23b", "comment": "Malware payload (Formbook)", "value": "f79a020cedb43bbd1f4948a2566d081fed934d56f871741d2548f792e8800e7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642119, "uuid": "f0406710-22e6-4ad0-b4ff-53408243a29f", "comment": "Malware payload (Formbook)", "value": "c9c29504bd24e3c7ac591ec1312e32a9c5623a3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674642119, "uuid": "ab647012-20cb-410e-b8d9-73b6a56e2367", "comment": "Malware payload (Formbook)", "value": "468abc63f4d4ece12e27c7f93d160e7c2c0d58e4206595144c2edc87e92d83932cd1d0e78fe160cee8c841301ce28362", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642119, "uuid": "4d29abbb-844c-4efd-8135-98f2ff0e0994", "value": "T158F4CFFC7794BD8FC0178F7A84542C006A60F4B35B43E383A05B16699A1EBDE9E506E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642119, "uuid": "682cde16-5efb-4c51-9c3e-89f521ec020f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642119, "uuid": "b248bac1-d58b-4190-980f-2df51565427f", "value": "12288:k9posleqpoUIGApUa0h3hnzEcWjPX8UBhxE1q1feA+rsnKrFEcFXL1GH/h8:kEsMzG9Zhz0rDDxQq1febr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674642119, "uuid": "f95be3ab-ed1d-4c15-8f88-10477a457658", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674642119, "uuid": "874e6653-82d8-4cdc-b0c3-dd019fe9d6f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674642119, "uuid": "a9c29f45-7cf1-45bd-a968-b1beb18d40c2", "value": "Halkbank,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ad616f-9cd6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674668049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668049, "uuid": "54da402a-2d20-4d04-8b05-255b5e8f4ac8", "comment": "Malware payload (Gafgyt)", "value": "da29c9b309fdc369b4b3bc8c665696bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668049, "uuid": "a9e46d5d-837f-43e7-a569-c69d6cff0117", "comment": "Malware payload (Gafgyt)", "value": "f88e386b77f013f9c861cf3811f0e39a3289ebe8e73d5404495e731a71b0a2c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668049, "uuid": "e993ab75-810f-477b-b0bc-fe2a940201af", "comment": "Malware payload (Gafgyt)", "value": "936259dc99dd3b2e509f87bcabd1f23c95d113bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674668049, "uuid": "70b109b6-95d0-4839-ae81-a38a42d7491a", "comment": "Malware payload (Gafgyt)", "value": "b513344a037d35584801b6c0d109e37188303db124721aa031c22d39d0a228594277a5b84c6aae782b51c8f01b91d3bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668049, "uuid": "4c382109-91d7-4b2e-b935-2496ccfdf800", "value": "T1F8831943B72D0B43C49B6AF12DF72BF08769F96117A76180A11EBFC44772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668049, "uuid": "6e8895bf-0afb-4989-a3bf-60adc74145c4", "value": "1536:BQOc40ozMPjej5qckA39ikRFaenrWBfOEmQ9VqXjtWf2Xe:Bl+3y4ckA3BDrWZOEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674668049, "uuid": "62b83abe-6b47-4434-809c-1581d55bf51c", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674668049, "uuid": "baf8293f-5982-4ce6-a3b8-0683a149a3b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674668049, "uuid": "b8cde9b4-178b-4f6c-83cb-cad77d8444e2", "value": "da29c9b309fdc369b4b3bc8c665696bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c81b4c-9c80-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674630968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630968, "uuid": "71b23314-0d36-4a51-a3d2-7be6cac4224a", "comment": "Malware payload", "value": "b8425326dbd29b342954599bf351a3f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "libneoffice.com", "colour": "#1C57C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630968, "uuid": "80184bcc-d474-4c10-a75d-dc521f9fc0ad", "comment": "Malware payload", "value": "f907509818c44aabe08ddbe554152adcd37e894833750c23039f571394541eb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "libneoffice.com", "colour": "#1C57C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630968, "uuid": "596d58b3-37fa-4b61-81ec-1175e39409f1", "comment": "Malware payload", "value": "8a7d3d0164d4b12fa3fac216a9d40028d58b15e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "libneoffice.com", "colour": "#1C57C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674630968, "uuid": "b9b451c0-a46d-4b8e-966b-01ce24798dc5", "comment": "Malware payload", "value": "03d896dd69694b63886b618c3309e612cb44c6a0b2bd157c27e96c4db4fee6e6e4dc89d59717af602334036cbe04c2a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "libneoffice.com", "colour": "#1C57C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630968, "uuid": "55a87f91-de7d-472a-a7f8-211437f613a7", "value": "T1F9166B03F6A186E9C0ADC17887579723E772BC894B21B79B5BD05A313F22B605F5E348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630968, "uuid": "9a87a89f-b149-4245-b67a-ce4e40f8bd4b", "value": "c7940ab09ba5db7694669621de3ef310", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630968, "uuid": "9f1900df-59d7-4385-a429-bc19c40f30d2", "value": "49152:fRCEXJ+YsXP2mv3dqAUrxpZe9hs/i+kyX0HF21Av/0yC/o0H1gI5TJIx/o1B:JMUPRZkp5U1gIfIJo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674630968, "uuid": "d13367b8-886b-4415-aa5b-1585ed656cd0", "value": 4213760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674630968, "uuid": "b853046b-98c8-4703-a4d9-7bd40133f75c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674630968, "uuid": "8689b8b6-0810-4b57-b9bc-dc165c104fca", "value": "LibreOffice-release.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f99110-9c99-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674641820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641820, "uuid": "413be727-47d5-4e7e-af19-f554ab429ccf", "comment": "Malware payload (GCleaner)", "value": "251acc55e9394b864085c1946eefe8a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641820, "uuid": "2da00cbd-bfb2-4ae8-beb3-0452159dbce7", "comment": "Malware payload (GCleaner)", "value": "f936e807ddb4d31646722eb154887b3dfcf4d638b8003c91ea47b13712cf5aeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641820, "uuid": "1625420b-40d9-4fd8-82e3-ab3294b818ff", "comment": "Malware payload (GCleaner)", "value": "382a373cf244e6c69d1f511931fb84c7dd7020bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674641820, "uuid": "a76c2ea4-3106-4d8d-b55b-cf0f93608106", "comment": "Malware payload (GCleaner)", "value": "be8bac127dde00a0ee5f94d50b952891da33fc9ca25d733750bc2128257f2880826c7493fa07710e6033dd6f72839f9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641820, "uuid": "13e86ace-5884-4b44-89a3-82663a73c7af", "value": "T1F38533E25159913EE291A735DDB08C02CF36B2331A71A208B5EF298F4B575819D83BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641820, "uuid": "2d86cbf6-e2d5-496d-87b0-a42c78038add", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641820, "uuid": "5153b91f-dd13-419e-95f0-e2b81f3c6163", "value": "49152:Zbcs2aYQjec2Ng9HfutZQBpRAGoSw5ULCgv2MR:tcZaxecGg9HEZQBpRDeEv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674641820, "uuid": "ca220546-2853-4920-95ea-a292d13b5ebb", "value": 1785380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674641820, "uuid": "0919f54b-303a-4c3e-b04e-a3da97393479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674641820, "uuid": "e69212de-af25-44f2-a36c-864c46478d0b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d907ac-9ca4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1674646400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646400, "uuid": "a6d89481-dfe6-44c2-a05e-06707eab4888", "comment": "Malware payload (Gozi)", "value": "a2bb3bad984131e6e512f9a91d207d24", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646400, "uuid": "91d4f374-c16e-4fd3-b1f6-aa3590ee4575", "comment": "Malware payload (Gozi)", "value": "f964d792432f87e031aceeb3b81e8d100d4984dfaca91cac2137c5cd8dabcdde", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646400, "uuid": "bf3c9580-18f8-4d85-8846-39127bd8eb8b", "comment": "Malware payload (Gozi)", "value": "b45946e3edd46ab3753c60cd91c07fffcaedec26", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674646400, "uuid": "bafde3b2-8f66-4d68-8a41-d17f6c49da9d", "comment": "Malware payload (Gozi)", "value": "a268ad244572a16f3037fca8f2eb2ef724f7cb0543f21faf2348487b324f6997ec0f00af8dd4c39d6f6713b478cfae39", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646400, "uuid": "79b476e6-ad6a-4382-9bcb-b25e93b49b30", "value": "T1CC14D01366E0BC72C92646358D6BCBEC7ADDF9044E5867172B381A3F2A703B1D673219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646400, "uuid": "c08c70f1-0777-47be-ba70-fa79716f6387", "value": "13743b83cdbed1b091d19518975401a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646400, "uuid": "cdced17b-4805-43d9-b2eb-ffd77e16ea45", "value": "6144:pCxLvYy7IVQf2JF2qNYihWY8gVmwCOaM8rHtx:MxB7IVQeSKYihT8gVmw05tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674646400, "uuid": "eed8b04c-35e9-4d82-bdcb-0d80dba0363c", "value": 200987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674646400, "uuid": "8b58c7f8-9233-465b-97ca-407491484dec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674646400, "uuid": "3b4f18a3-9685-4202-971f-6ca28fb6ae5e", "value": "scarica (4).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16ce273-9cfb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674684088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684088, "uuid": "2e3ad2ec-ca67-42da-a174-3420bd412b6e", "comment": "Malware payload", "value": "4cef3a78471373a5ef7be94cbef23d01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684088, "uuid": "13f82ada-d383-42b5-a4b9-2bbf59767345", "comment": "Malware payload", "value": "f99cc12706599938589bff18302d202649c8867c400c83dc8c2ee9f5543feb73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684088, "uuid": "7a24a991-b15d-486c-b13b-78672d1d2e73", "comment": "Malware payload", "value": "94f6948f067403349da8e1ff07d85e62aa283f14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674684088, "uuid": "a2ca4d93-e4b7-4213-95c1-61c4c04ecc78", "comment": "Malware payload", "value": "9256b7e74b402875f45ec172e781bfebb1fd7638fc1be65e8dd9e19da635ab435b0b1e12986ab17a15d5fb06b1ea188a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684088, "uuid": "aa8de3c3-4e9e-4823-ac85-89e4da115dec", "value": "T1DC853312C1E1CD75F193CD750D389640A922B9364E70617FB20CAAAC6F27AF1C593B6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684088, "uuid": "04a898d9-4f4d-4303-89e6-4a1b97da0c6a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684088, "uuid": "32cc8caf-401a-4623-b1cf-186b4e60a03a", "value": "49152:ZljSSys4BBihjBeNslyF9yGcyIHuijWFLCgv2MR:3jSSysjbM9yf1HRW5v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674684088, "uuid": "cfa8b484-4fbd-41d3-a2f2-337e05340829", "value": 1766883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674684088, "uuid": "1d9467f3-3e5a-4a58-92fb-ea9dce03430d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674684088, "uuid": "0a916141-1506-4c26-b8df-fbb8c1dffd26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3327eb41-9d03-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674687258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674687258, "uuid": "d1dd6f9b-4a65-410e-9f82-7c3789e86533", "comment": "Malware payload", "value": "bb128181a215cc7d7ae78320e6aa09b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674687258, "uuid": "c7fec809-7485-4e76-9970-44426c7e387e", "comment": "Malware payload", "value": "f9e3dbba9faf950d42b4ab743bdfbcd1d5756a05bebbfef4a55efb8de3c64599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674687258, "uuid": "bb6394a8-543c-4d15-b7e5-04fd8b52a88d", "comment": "Malware payload", "value": "96acde35d17030fec72335e21f600e5878712c02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674687258, "uuid": "7dadabf0-6367-468e-971b-c33d2ec6dcb5", "comment": "Malware payload", "value": "a8186357b786aa678793c8effd3ec846bee5d646b4497ffa05e8dd3ece359eacb9dc80761e005c75913cc2fc00070082", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674687258, "uuid": "ecff67a1-dcd2-452b-bcc5-b589f38c6362", "value": "T1CB64BF2275F0B860ED264A75CD1ADBD4392FF9D28F3C739732C4AA1F1C722A0D166615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674687258, "uuid": "9e117d12-69d0-4f5a-a838-c6a7081e40c3", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674687258, "uuid": "58d63590-6e4b-484e-b2a2-fb1f39e28b44", "value": "6144:10Lv7ucU6YtmFCjM1StI26iArffg0+MOKXEUT:10fbU6fCjM1StI26iCgWoUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674687258, "uuid": "336df4e9-495a-4f3f-99a2-e932294009ae", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674687258, "uuid": "30fd100a-677b-4d77-93f9-5cdf175f3609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674687258, "uuid": "180f90ad-07ec-4a5c-8007-27d9cfd13c76", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f980d30f-9c64-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674619301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674619301, "uuid": "a72cd86c-d0c8-490b-958a-716cb301a07a", "comment": "Malware payload (GCleaner)", "value": "60f78254760b195a92e9f720a3fbc0ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674619301, "uuid": "ffcde128-436d-4285-abf3-84fa79765d9d", "comment": "Malware payload (GCleaner)", "value": "fa0e1c01a2b64430edd79c4597f696abb613a1070c74ef8dc8278a257a0dccd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674619301, "uuid": "3608fbfb-53ad-46ba-ae49-e67cacb6212e", "comment": "Malware payload (GCleaner)", "value": "657bc4abcd91bb74db74a4489536f18ceb37f4c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674619301, "uuid": "4c232a5c-90a1-47f2-a2ad-ae20d4e07a81", "comment": "Malware payload (GCleaner)", "value": "18a4c6a0f738bfb8686ca17be1a030ce2a90280f943ca02b99865f5037e4869159be9fd38f502cc3ce4397cd146e1c07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674619301, "uuid": "7c3e5597-056a-4cea-979f-a927d5c85a28", "value": "T12885336AB02A9233C652D7370EAA8549EF46FD191935904A318C75FE0F1F7F0706BBA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674619301, "uuid": "37fc759c-9589-4eca-8a3a-17f898f08ac7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674619301, "uuid": "f0efe4ab-540a-4420-babb-e6315a410308", "value": "24576:Z3Bbsheqcb2kWfG7EbDCtdBMW8KcoGRgZut08zAMy4BZEkt4BEMCiAePnrtEqXMZ:ZUcKkW+NtdLqPRg47A47LMvjMLCgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674619301, "uuid": "faa361c3-4e74-4583-9511-85e1c70224cf", "value": 1810123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674619301, "uuid": "a9e7d9f5-5bb8-4cdd-a0f7-3f5b03d38df4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674619301, "uuid": "02c1a595-d3be-4ba2-8ad8-3505a1b6094f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e776d679-9cee-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1674678541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678541, "uuid": "7930d275-c6b1-4572-81ab-cd2b0b6722b3", "comment": "Malware payload (SystemBC)", "value": "e62582236c24973720e092adec05f8c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678541, "uuid": "2f1192a5-dbcd-4395-bcb0-f7181dff5ccf", "comment": "Malware payload (SystemBC)", "value": "fb45af7bb8ffdcddaaec2a9e88968fbcb82eaedbdf1c16a7e9ac861906a07e23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678541, "uuid": "e03dac9f-959a-4c2b-b4f8-d77666299ff9", "comment": "Malware payload (SystemBC)", "value": "dc865394a456b89282bf248eeff3509ec0116911", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674678541, "uuid": "6a75da5a-d86f-4813-be53-817464187075", "comment": "Malware payload (SystemBC)", "value": "39b06aed590f8d4eed61abf325b7bf8f3a83f1472d08cd68277835f32a86dd5f93d14b8e3457951a27c9ba0e2eec712c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678541, "uuid": "f5363e2c-dbf9-41c8-b0cd-1da51d7810b3", "value": "T1F4F3AD2932D1C033D047457459E3CAB5AE6AF8350F6A5A8B7BC41B7D5F303E29B2A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678541, "uuid": "1e832427-25da-4951-8351-81929d782311", "value": "3387a3592629261940cdc4764a709ef2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678541, "uuid": "df6f1e94-caed-4381-b2ec-a526f6c4981b", "value": "3072:SXiOd5A7ENBKYEm9/1fUQcl7XcOOILUJC2PsrZLILNNOmr:SXiEA7EfKYE6RU1AnvspsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674678541, "uuid": "572ca3f9-f3a8-4714-a16f-5bf4d40cd432", "value": 160256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674678541, "uuid": "eb71b411-cb74-4054-8d05-ce380cb33fd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674678541, "uuid": "db95a5fe-1d3c-41c0-a66d-20c25ea54750", "value": "e62582236c24973720e092adec05f8c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8b3c6a-9cf7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674682097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682097, "uuid": "bb2bf53a-fbf8-4618-89f0-6de3e793340f", "comment": "Malware payload", "value": "f73a5f4ef6fbfac3013f15555de2277a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682097, "uuid": "d6b95af5-fc9e-40d9-a017-69139dc67d08", "comment": "Malware payload", "value": "fb8ada72a53520884c7a30d763804dfe09775443a006068cd06b043c8c1c63c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682097, "uuid": "90780f4d-db86-41a7-b644-e3b689662ccf", "comment": "Malware payload", "value": "13ac5980195083b5fdca172ca7ea0f41e0494bd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674682097, "uuid": "fbe0f73b-fa94-47ee-9068-8306de3b817b", "comment": "Malware payload", "value": "02a49ebc82d6eac7c8c31b3087284b69e7895f80a995ba0a8093d40ed365fa6868e50d5bb204fb7011cd616dee73b61a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682097, "uuid": "61525a07-ac19-4412-8a57-4111b9580642", "value": "T131D27D4477EC017BEBAF4BBDA93912910B31B6276426EF9E78DC00CD1B623458112B7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682097, "uuid": "449c7eca-5b3b-4b5f-b0f6-2aa1a5305a5d", "value": "768:qDhTl11BRwGTYy+7+o1E3333wqkg260/4l/y4QkAmZbIkr05tIevQ:Ol11BRwGTY2io0AtyfxEIk2vQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674682097, "uuid": "4fd43593-52c0-4a9e-ae27-86e8c88c3853", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674682097, "uuid": "d6e1cb3b-08f0-4b43-969c-c2d97af03e12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674682097, "uuid": "45059e43-ffcf-48e8-b35a-94a6d7ddf4dd", "value": "22-1194 FE7191PO1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d989a635-9cb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674655325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655325, "uuid": "9f8f8ef8-5e5a-468d-bab0-ad3f95202f08", "comment": "Malware payload (GCleaner)", "value": "eab2c408ff1f5432e0a1764bb7b73324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655325, "uuid": "18bfed98-7b30-4e55-8a34-77e954e8df73", "comment": "Malware payload (GCleaner)", "value": "fc2f086c51e5415a7154159bf8f02653a55b8c20af2edf18b6cbf57757d2476a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655325, "uuid": "3e6d04dd-d452-4288-8f7e-34e95b32fdd0", "comment": "Malware payload (GCleaner)", "value": "6c88d39a044e4a937b3532b9f6498f0be136278e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674655325, "uuid": "777cfaff-4683-43e5-a9d7-de817fc2220b", "comment": "Malware payload (GCleaner)", "value": "9301f60651832a403f152da9b0ac3ec04afabedf091e2848a14c57727c42dc8834e042dd05148ef9ded09368a318972e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655325, "uuid": "f6029387-2d26-4500-8df8-6f3d41553086", "value": "T121853312F651E076D252DB354B2D15A1EA87BF7A147010033D2E1FFC07BAA84AD8A7F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655325, "uuid": "da5078ff-ecb8-4e98-9f21-fd98bfd23062", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655325, "uuid": "581575d3-ed84-4010-a935-f6d928b85b73", "value": "49152:ZBS0bcvanM48ZbjHGz1QCCgzhX1oSLCgv2MR:PSBZbazS0hX1o6v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674655325, "uuid": "bef17bfb-a788-4bca-8eab-ce091d515db9", "value": 1798675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674655325, "uuid": "ff5e1c1c-6c02-4c79-bec4-c72c122f73a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674655325, "uuid": "5ed16048-9c6d-4b3f-9bf8-8bda7d238512", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c594613-9d05-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674688079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674688079, "uuid": "73610691-f2f7-4a56-8c00-89aa64b8f643", "comment": "Malware payload", "value": "30db39c1f756b5d61d812f67b980b250", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674688079, "uuid": "c4a5281d-cde5-47bf-8101-622dec888c3d", "comment": "Malware payload", "value": "fd19241e3dbb2519f4f10b8e415e5dee056a7f2894bd7b0e7000a544147caf0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674688079, "uuid": "d81e5a41-700a-404b-9a6a-facdacd18f1a", "comment": "Malware payload", "value": "c5927167b1d05acef26d5ea645c556d71ecf6539", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674688079, "uuid": "da4f4eef-0a02-4c7c-8ade-2b8e62ec1e83", "comment": "Malware payload", "value": "71e7f299de06404927e98d9679175c56e7c9fa4016539a662b685094a3c61df7317111d0165574402b8e4178f617234c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674688079, "uuid": "580dbeea-7204-4735-9300-8451a3c401e1", "value": "T17B84C01176D0AA60FE2A4576CD3ADBD439AEF8D28F3C775732B46A1F1C322A0D523215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674688079, "uuid": "5d269961-31d0-4cec-b432-2c25a5b623ba", "value": "a993f91e59404a5ee43a789b605c9d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674688079, "uuid": "a18cdacd-dcec-45c8-b65d-6fa716733693", "value": "6144:GlLnbqN7Rj0ldaRuv5TnfFfV13JhQ0+MOKXIUT:GlvW7SGuv5TBXJmW0UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674688079, "uuid": "562c5d02-6a9f-46b1-be74-1e642bac987d", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674688079, "uuid": "f86c59d2-1ee9-4c92-afee-9011760115d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674688079, "uuid": "e39cb13a-bb5c-40e8-99dd-9b3a9b384835", "value": "30db39c1f756b5d61d812f67b980b250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30cbc741-9c9f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674644305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674644305, "uuid": "9ad3cb59-60fa-4fa9-abf4-9f98a3611b38", "comment": "Malware payload (Smoke Loader)", "value": "250973815ae5ccaa0b928d111effe1d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674644305, "uuid": "154c51ab-64b9-48aa-b43d-7cca05c2cc4b", "comment": "Malware payload (Smoke Loader)", "value": "fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674644305, "uuid": "657dc27f-5835-4be8-9297-9c293728c31e", "comment": "Malware payload (Smoke Loader)", "value": "5e4f54161514a0c089e5f4d7e90cffb06bb8fbaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674644305, "uuid": "5dfa0d14-5724-477e-acc0-a738edaaebf0", "comment": "Malware payload (Smoke Loader)", "value": "22eb94fecb55704c504f6d4f270f9b2e2c77ea6474959651a78486779f9d07a249137e43781aef766dd7fc59f289a741", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674644305, "uuid": "32dbf7dc-39cf-4b58-a03e-402c96c2485a", "value": "T14C748E12E298BBD0F599CA718D2EA7EC763EF9505D146327322C7A3F19702E0C16A71D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674644305, "uuid": "90d6276b-1153-4d21-bd65-b123c31d9cff", "value": "787cd3f7e6d0161bfca0cbd92375e751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674644305, "uuid": "e9a40c22-382e-46e5-904b-43130159b6ba", "value": "6144:uL32eg3D58Dw69VFutShtnzOjq7VWRFBMolz9095m:ur2x3in9VFuSHt7VWR5lz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674644305, "uuid": "72c47437-b6ff-424b-8ab1-53db2c94c82e", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674644305, "uuid": "fd9e396a-5acc-4a4c-969a-e16424c7d055", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674644305, "uuid": "61222b84-6b9a-4f85-8a87-f17b9d685655", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348fb38b-9ce9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674676094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676094, "uuid": "0a340338-7475-47e2-a2cb-d68f1c883eea", "comment": "Malware payload", "value": "729fc88a2f0dc3ee641e602a55456cb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676094, "uuid": "9f7c0afa-c410-4d54-a7a2-e5104d7592f7", "comment": "Malware payload", "value": "fecee4f517a477026ec77e410eec9e0c41a779c14abffd87eab83cfd5fe05bd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676094, "uuid": "6c824615-8859-46c0-89d9-c18f963cd28a", "comment": "Malware payload", "value": "c2b2fdb590427633090eefff3b277d2314e5f645", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674676094, "uuid": "a5d94f78-ecb5-429d-9df2-34e72b693a90", "comment": "Malware payload", "value": "662823ca3ce69147df6b8fbc096a774f43baf5248bc713c67b8064072f37a9f74d9511d6ef2d5e6cb1e78bebc0be6b9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676094, "uuid": "499756b8-2e32-4a49-b3f2-9031361bb485", "value": "T1A37633157EE544BAC74B4173D9839BD072FCA8285E016AFF3741AF184938493A72FA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676094, "uuid": "8f7c14d2-6a2d-4cb7-ada4-a8d0be6b3d49", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676094, "uuid": "ddfda082-fc9c-4460-99e9-7eb0bc4319fe", "value": "196608:91OnA+jG7j5H7F8Gt4Fp2lCdQrFgxg+36/lksrMj2o:3Oc+oA2sdQrexWXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674676094, "uuid": "e86c783f-f690-4ef3-92d2-73c523d17739", "value": 7611290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674676094, "uuid": "4457e0d1-0081-4357-8490-b11e7c4b6c33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674676094, "uuid": "06a43185-4846-4a13-9642-1ae012dbd9ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28daec3-9c85-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1674633355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633355, "uuid": "6f5f2c40-3c9b-46d0-87ff-0212ea9dd9cb", "comment": "Malware payload (AsyncRAT)", "value": "96a0822a132f93f3ee12b8a85284516a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633355, "uuid": "5be1cf8c-26d6-4c79-878b-74813e3c9109", "comment": "Malware payload (AsyncRAT)", "value": "ffe2e43e59074cf27875cc31e8be84503b1a6854dd3f2480b5aff7b6b220a416", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633355, "uuid": "a0d1118d-7e36-4950-a26b-83fb85953f52", "comment": "Malware payload (AsyncRAT)", "value": "14eca3b683575f026c105f7b4afc81204323868f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674633355, "uuid": "df2936e0-325e-422f-b90e-2b2b477d74fe", "comment": "Malware payload (AsyncRAT)", "value": "536147275db84e58d0d23a9d373f84ff0d636ef98b0e2aa070e5efc368b680c76939429ebed89848b7487908d183d5d6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633355, "uuid": "30997403-1867-4243-a361-11d493dbff07", "value": "T109D5E1320B5AFF97E6AB0F7484C53A107D390843AF5BD294F9C8156B95C8B64F988E70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633355, "uuid": "60405506-cd2d-4309-b7f6-b6a88b455bd3", "value": "49152:FkkR95Qht1hYZ6t+HFzed7/x5rmsxftZ:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674633355, "uuid": "fd9e58a0-2934-425e-876a-4fa7927fc054", "value": 2787328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674633355, "uuid": "ea6243dd-bb6c-48a0-a71d-9b7c7d5751a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674633355, "uuid": "50ee4ee5-4e4f-445c-990c-fd8031c7126a", "value": "96a0822a132f93f3ee12b8a85284516a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }